Last Updated: July 6th 2026
This Business Associate Agreement, taking effect as of the date of acceptance of terms (“BAA”), is entered into by and between Customer (“Covered Entity”) and Lemma Technologies Inc and its affiliates, successors, and assigns (“Business Associate”). Business Associate and Covered Entity are parties to a Terms of Service agreement. In the course of delivering its services, Business Associate anticipates that it will generate or obtain Protected Health Information from or on behalf of Covered Entity. Such information is governed by the Federal Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191, as amended by the Health Information Technology for Economic and Clinical Health Act, Title XIII of the American Recovery and Reinvestment Act of 2009 (the “HITECH Act”), together with all related regulations issued by the Secretary (collectively, “HIPAA”). Given the foregoing and the obligations imposed by HIPAA, Business Associate and Covered Entity agree to the following terms and conditions.
Capitalized terms used but not separately defined in this BAA shall carry the same meaning ascribed to them under HIPAA, as currently in effect or as subsequently amended.
“Services Agreement” shall refer to any current or future agreements, whether written or oral, between Covered Entity and Business Associate pursuant to which Business Associate provides services to Covered Entity involving the use or disclosure of Protected Health Information.
Use and Disclosure.
Where Protected Health Information is generated by or disclosed to Business Associate, Business Associate agrees that it will not use or disclose such Protected Health Information except as authorized by the Services Agreement, this BAA, or as Required by Law. Business Associate shall adhere to all provisions of this BAA concerning the privacy and security of Protected Health Information and shall comply with all current and future HIPAA requirements applicable to “business associates.”
Appropriate Safeguards.
Business Associate agrees to implement suitable safeguards to prevent the use or disclosure of Protected Health Information except as contemplated by this BAA. Without limiting the foregoing, Business Associate shall:
Reporting.
Business Associate agrees to report to Covered Entity, without unreasonable delay, any use or disclosure of Protected Health Information not authorized under this BAA, promptly upon becoming aware of such occurrence.
Minimum Necessary Standard.
To the extent required by the “minimum necessary” standard under HIPAA, Business Associate shall only request, use, and disclose the minimum amount of Protected Health Information needed to fulfill the purpose of the request, use, or disclosure.
Mitigation.
Business Associate agrees to take reasonable steps to mitigate, to the extent practicable, any harmful effect that is known to Business Associate resulting from a use or disclosure of Protected Health Information in violation of this BAA. Business Associate shall reasonably cooperate and coordinate with Covered Entity in investigating any violation of this BAA and/or any Security Incident or Breach.
Subcontractors.
Business Associate shall enter into a written agreement satisfying the requirements of 45 C.F.R. §§ 164.504(e) and 164.314(a)(2) with each Subcontractor that generates, obtains, maintains, or transmits Protected Health Information on behalf of Business Associate.
Access to Designated Record Sets.
To the extent that Business Associate maintains Protected Health Information in a Designated Record Set, Business Associate agrees to make such information available, upon Covered Entity's request, to Covered Entity or, as directed by Covered Entity, to an Individual, to satisfy the requirements of HIPAA Regulations.
Amendments to Designated Record Sets.
To the extent that Business Associate maintains Protected Health Information in a Designated Record Set, Business Associate agrees, within thirty (30) days of receiving a request from Covered Entity, to make such Protected Health Information available for amendment and to incorporate any approved amendment(s) into the Designated Record Set in accordance with HIPAA Regulations.
Access to Books and Records.
Business Associate agrees to make its internal practices, books, and records related to the use and disclosure of Protected Health Information available to the Secretary for the purpose of determining compliance with the Privacy Rule.
Accountings.
Business Associate agrees, within thirty (30) days of receiving a request from Covered Entity for an accounting of disclosures of Protected Health Information, to provide Covered Entity with such information as is in Business Associate's possession and as would be necessary for Covered Entity to fulfill a request by an Individual for an accounting of disclosures in accordance with HIPAA.
Services Agreement.
Except as otherwise restricted by this BAA, Business Associate may use or disclose Protected Health Information to carry out functions, activities, or services for or on behalf of Covered Entity as set forth in the Services Agreement, provided that any such use or disclosure would not contravene HIPAA if performed by Covered Entity.
Use for Administration of Business Associate.
Except as otherwise restricted by this BAA, Business Associate may use Protected Health Information for the proper management and administration of Business Associate or to discharge Business Associate's legal obligations. Covered Entity acknowledges and agrees that proper management and administration of Business Associate includes, without limitation, modifications or enhancements to its software or services, and development of new features, functionality, or related products and services.
Disclosure for Administration of Business Associate.
Except as otherwise restricted by this BAA, Business Associate may disclose Protected Health Information for the proper management and administration of Business Associate, provided that (i) such disclosures are Required by Law, or (ii) Business Associate obtains reasonable assurances from the receiving third party that it will safeguard the confidentiality of the Protected Health Information and use or further disclose it only as Required by Law or for the purpose for which it was originally disclosed.
Data Aggregation.
Business Associate may use Protected Health Information to provide Data Aggregation services in connection with the Health Care Operations of Covered Entity, if required or authorized under this BAA or the Services Agreement.
De-Identified Information.
Business Associate may use Protected Health Information to generate de-identified health information in compliance with the HIPAA de-identification standards. Business Associate may disclose de-identified health information for any purpose permitted by applicable law.
Permissible Requests by Covered Entity.
Except as provided in Section 3 of this BAA, Covered Entity shall not direct Business Associate to use or disclose Protected Health Information in any manner that would not be permissible under the Privacy Rule if carried out by Covered Entity.
Minimum Necessary PHI.
When disclosing Protected Health Information to Business Associate, Covered Entity shall provide only the minimum amount of Protected Health Information necessary for Business Associate to accomplish the intended purpose.
Permissions; Restrictions.
Covered Entity represents and warrants that it has obtained and shall continue to obtain any consents, authorizations, and/or other legal permissions required under HIPAA and other applicable law for the disclosure of Protected Health Information to Business Associate.
Notice of Privacy Practices.
Except as required by HIPAA or other applicable law, with Business Associate's consent, or as set forth in the Services Agreement, Covered Entity shall not include any limitation in its notice of privacy practices that would restrict Business Associate's use or disclosure of Protected Health Information under this BAA.
Term.
This BAA shall become effective as of the date hereof and shall remain in effect until all Protected Health Information provided by Covered Entity to Business Associate, or generated or obtained by Business Associate on behalf of Covered Entity, is destroyed or returned to Covered Entity, or, where return or destruction is infeasible, protections are extended to such information in accordance with the termination provisions of this Section.
Termination Upon Breach.
Notwithstanding any other provision of this BAA, either party (the “Non-Breaching Party”), upon becoming aware of a material breach by the other party (the “Breaching Party”), shall afford the Breaching Party an opportunity to cure the breach or end the violation. If the Breaching Party fails to cure the breach or end the violation within thirty (30) calendar days, the Non-Breaching Party may terminate this BAA and all provisions of the Services Agreement that involve the use or disclosure of Protected Health Information.
Effect of Termination.
In providing its services and/or products, Business Associate shall comply with all applicable HIPAA standards and requirements (including, without limitation, those set forth in 45 CFR Part 162) with respect to the transmission of health information in electronic form in connection with any transaction for which the Secretary has adopted a standard under HIPAA (“Covered Transactions”). Business Associate shall ensure that its services and/or products are compliant with HIPAA's standards and requirements no fewer than thirty (30) days prior to the applicable compliance dates under HIPAA. Business Associate represents and warrants that it is aware of all current HIPAA standards and requirements pertaining to Covered Transactions and shall comply with any amendments as they become effective. Business Associate shall require all of its agents and subcontractors who assist in providing its services and/or products to comply with the terms of this Section.
Regulatory References.
Any reference in this BAA to a section of HIPAA shall mean such section as currently in effect or as amended or modified from time to time, including any corresponding provisions of subsequent superseding laws or regulations.
Amendment.
The Parties agree to take such action as may be necessary to amend the Services Agreement from time to time as required for the parties to maintain compliance with the requirements of HIPAA.
Survival.
The respective rights and obligations of Business Associate under Section 5(c) of this BAA shall survive the termination of the Services Agreement or this BAA.
Interpretation.
Any ambiguity in this BAA shall be resolved in a manner that enables the parties to comply with HIPAA.
General.
The terms of this BAA are hereby incorporated into the Services Agreement. To the extent that Business Associate receives Protected Health Information from or on behalf of Covered Entity, and except as otherwise provided in Section 7(d) of this BAA, in the event of a conflict between the terms of this BAA and the terms of the Services Agreement, the terms of this BAA shall control. All provisions of the Services Agreement not modified by this BAA shall remain in full force and effect.