Business Associate Agreement

This Business Associate Agreement ("BAA" or "Agreement") is entered into between AdvancedCare USA Inc. ("Business Associate" or "Scriber") and the healthcare provider or covered entity creating an account on the Scriber platform ("Covered Entity"). This Agreement is required under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), as amended by the Health Information Technology for Economic and Clinical Health Act ("HITECH Act"), and their implementing regulations.

By accepting this Agreement during registration, the Covered Entity acknowledges that they have read, understood, and agree to be bound by its terms as of the date of account creation.

1. Definitions

Terms used in this Agreement have the same meaning as those defined in the HIPAA Rules (45 C.F.R. Parts 160 and 164). The following definitions apply specifically to this Agreement:

• Protected Health Information (PHI): Individually identifiable health information transmitted or maintained in any form or medium, as defined in 45 C.F.R. §160.103.
• Electronic Protected Health Information (ePHI): PHI that is created, stored, transmitted, or received in electronic form.
• Services: The AI-powered clinical documentation and transcription services provided by Scriber, including the web application, mobile application, and Chrome extension.
• Breach: The acquisition, access, use, or disclosure of PHI in a manner not permitted by the HIPAA Privacy Rule that compromises the security or privacy of such information.

2. Permitted Uses and Disclosures by Business Associate

Scriber may use or disclose PHI only as necessary to perform the Services described in the applicable service agreement, and as permitted or required by this Agreement or as required by law. Specifically, Scriber may:

• Use PHI to provide and improve the clinical documentation services, including speech-to-text transcription and AI-generated clinical notes.
• Use PHI for the proper management and administration of Scriber's business, provided that such use is required by law or Scriber obtains reasonable assurances that the information will remain confidential.
• Use PHI to carry out the legal responsibilities of Scriber.
• Report violations of law to appropriate federal and state authorities, consistent with 45 C.F.R. §164.502(j)(1).

3. Obligations and Activities of Business Associate

Scriber agrees to:

• Not use or further disclose PHI other than as permitted or required by this Agreement or as required by applicable law.
• Use appropriate safeguards and implement the requirements of 45 C.F.R. Part 164, Subpart C (Security Rule) to prevent use or disclosure of PHI other than as provided in this Agreement.
• Report to the Covered Entity any use or disclosure of PHI not provided for by this Agreement of which it becomes aware, including breaches of unsecured PHI, as required by 45 C.F.R. §164.410.
• Ensure that any subcontractors that create, receive, maintain, or transmit PHI on behalf of Scriber agree to the same restrictions, conditions, and requirements that apply to Scriber under this Agreement.
• Make its internal practices, books, and records available to the Secretary of the U.S. Department of Health and Human Services for determining compliance with the HIPAA Rules.
• Provide access to PHI in a designated record set, at the request of the Covered Entity, to fulfill the Covered Entity's obligations under 45 C.F.R. §164.524.
• Make available PHI for amendment and incorporate any amendments to PHI as directed or agreed to by the Covered Entity, pursuant to 45 C.F.R. §164.526.
• Maintain and make available the information required to provide an accounting of disclosures to the Covered Entity as required by 45 C.F.R. §164.528.

4. Obligations of Covered Entity

The Covered Entity agrees to:

• Notify Scriber of any limitation(s) in the Covered Entity's notice of privacy practices that would affect Scriber's use or disclosure of PHI.
• Notify Scriber of any changes in, or revocation of, permission by an individual to use or disclose PHI, if such changes affect Scriber's permitted or required uses and disclosures.
• Notify Scriber of any restriction to the use or disclosure of PHI that the Covered Entity has agreed to in accordance with 45 C.F.R. §164.522.
• Not request Scriber to use or disclose PHI in any manner that would not be permissible under the HIPAA Privacy Rule if done by the Covered Entity.
• Obtain any required patient authorizations prior to submitting PHI to Scriber, and ensure patients have been properly informed about the use of AI-powered transcription and documentation services.

5. Data Security Measures

Scriber implements comprehensive technical, administrative, and physical safeguards to protect PHI, including:

• Encryption: All PHI is encrypted in transit (TLS 1.2+) and at rest (AES-256) using Microsoft Azure infrastructure.
• Access controls: Role-based access controls, multi-factor authentication support, and audit logging for all PHI access.
• Data isolation: Customer data is logically separated; clinical note data is not used to train AI models without explicit written consent.
• Audit trails: Comprehensive audit logging of all PHI access, modifications, and disclosures.
• Breach notification: Scriber will notify the Covered Entity of a Breach of Unsecured PHI within 60 calendar days of discovery.

6. Subcontractors

Scriber may utilize the following categories of subcontractors that may access or process PHI in connection with the Services:

• Microsoft Azure: Cloud infrastructure, storage, and AI services (OpenAI, Speech Services). Microsoft is a HIPAA-eligible service provider under a separate BAA with Microsoft.
• Azure Cognitive Services / OpenAI: Speech-to-text transcription and AI note generation. Customer data submitted to Azure OpenAI is processed under Microsoft's enterprise data privacy commitments and is not used to train models.

Scriber maintains Business Associate Agreements with all subcontractors that access or process PHI.

7. Term and Termination

This Agreement shall be effective upon the Covered Entity's acceptance during account registration and shall remain in effect until terminated. Either party may terminate this Agreement upon thirty (30) days written notice to the other party. Additionally:

• If the Covered Entity violates a material term of this Agreement, Scriber may terminate this Agreement immediately upon written notice.
• Upon termination, Scriber will, at the Covered Entity's option, return or destroy all PHI received from, or created or received by Scriber on behalf of, the Covered Entity that Scriber still maintains.
• If return or destruction is not feasible, Scriber will extend the protections of this Agreement to such PHI and limit further uses and disclosures to only those purposes that make the return or destruction infeasible.

8. Miscellaneous

• Amendment: The parties agree to take such action as is necessary to amend this Agreement from time to time as is necessary for compliance with the requirements of the HIPAA Rules and any other applicable law.
• Survival: The obligations of Scriber under the section entitled "Effect of Termination" shall survive the termination of this Agreement.
• Interpretation: Any ambiguity in this Agreement shall be resolved to permit the Covered Entity to comply with the HIPAA Rules.
• Governing Law: This Agreement is governed by the laws of the State of Delaware, without regard to its conflict of laws provisions.

9. Contact Information

For questions regarding this Business Associate Agreement, data privacy, or HIPAA compliance, please contact: