Health Exam Inc. Network Business Associate Agreement

Last Updated: August 6, 2026

This Business Associate Agreement (this "Agreement") is incorporated by reference into and made a part of Health Exam's Terms of Use, and is entered into by and between Health Exam Inc., a Delaware corporation, d/b/a Health Exam ("Health Exam") and the applicable healthcare provider, practice, health system, payer, or other organization ("Customer") that has agreed to the Terms of Use; provided, however, that the terms of this Agreement apply only if and solely to the extent that (1) Customer is a Covered Entity as defined under HIPAA (defined below), and (2) Health Exam receives, creates, maintains, or transmits Protected Health Information in connection with the Services Agreement (defined below) whereby Health Exam, as a Business Associate, performs services for or on behalf of Customer, as a Covered Entity. Health Exam, in its capacity as a Business Associate, is referred to herein as "Business Associate," and Customer, in its capacity as a Covered Entity, is referred to herein as "Covered Entity." Business Associate and Covered Entity are each individually a "Party" and collectively the "Parties."

If Customer is not a Covered Entity, or if Health Exam does not create, receive, maintain, or transmit PHI on Customer's behalf, this Agreement does not apply and imposes no obligations on either Party.

Witnesseth

WHEREAS, the Parties enter into this Agreement for the purposes of complying with the Health Insurance Portability and Accountability Act of 1996 and the regulations promulgated thereunder ("HIPAA") and the security and privacy provisions of the American Recovery and Reinvestment Act of 2009, also known as the Health Information Technology for Economic and Clinical Health Act (the "HITECH Act");

WHEREAS, Covered Entity is a covered entity as such term is defined under HIPAA and as such is required to comply with the requirements thereof regarding the confidentiality and privacy of Protected Health Information (defined below);

WHEREAS, Covered Entity has accepted Business Associate's Terms of Use or has entered into one or more other agreements with Business Associate (each, a "Services Agreement") pursuant to which Business Associate may receive Protected Health Information for or on behalf of Covered Entity; and

WHEREAS, by providing services pursuant to the Services Agreement and receiving Protected Health Information for or on behalf of Covered Entity, Business Associate shall become a Business Associate of Covered Entity, as such term is defined under HIPAA, and will therefore have obligations regarding the confidentiality, privacy, and security of Protected Health Information that Business Associate receives from, or on behalf of, Covered Entity.

NOW THEREFORE, in consideration of the mutual agreements and undertakings of the Parties, and for other good and valuable consideration, the sufficiency of which is hereby acknowledged, the Parties, intending to be legally bound, agree as follows.

1. Definitions

Any capitalized term not specifically defined herein shall have the same meaning as is set forth in 45 C.F.R. Parts 160 and 164, where applicable. The terms "use," "disclose," and "discovery," or derivations thereof, although not capitalized, shall also have the same meanings set forth in HIPAA.

"Breach" shall have the same meaning given to such term at 45 C.F.R. §164.402.
"Business Associate" shall have the same meaning given to such term at 45 C.F.R. §160.103.
"Covered Entity" shall have the same meaning given to such term at 45 C.F.R. §160.103.
"Data Aggregation" shall have the same meaning given to such term at 45 C.F.R. §164.501.
"De-Identified Data" shall mean health information that has been de-identified in accordance with 45 C.F.R. §§164.502(d) and 164.514(a)–(c) and that is therefore not PHI.
"Designated Record Set" shall have the same meaning given to such term at 45 C.F.R. §164.501.
"Electronic Protected Health Information" or "ePHI" shall have the same meaning given to such term at 45 C.F.R. §160.103, limited to the information created, received, maintained, or transmitted from or on behalf of Covered Entity.
"Health Care Operations" shall have the same meaning given to such term at 45 C.F.R. §164.501.
"Individual" shall have the same meaning as the term "individual" at 45 C.F.R. §160.103 and shall include a person who qualifies as a personal representative in accordance with 45 C.F.R. §164.502(g).
"Protected Health Information" or "PHI" shall have the same meaning as the term "protected health information" at 45 C.F.R. §160.103, except limited to the information received from Covered Entity, or created, maintained, or received on behalf of Covered Entity. For the avoidance of doubt, PHI shall include ePHI.
"Required By Law" shall have the same meaning given to such term at 45 C.F.R. §164.103.
"Secretary" shall mean the Secretary of the U.S. Department of Health and Human Services or their designee.
"Security Incident" shall have the same meaning given to such term at 45 C.F.R. §164.304.
"Services" shall mean the Health Exam platform, including the Aya AI clinical information assistant, and any related products, features, APIs, or professional services made available to Customer under the Services Agreement.
"Subcontractor" shall have the same meaning as the term "subcontractor" at 45 C.F.R. §160.103, except limited to any such individual or entity who creates, receives, maintains, or transmits PHI on behalf of Business Associate.
"Unsecured PHI" shall mean PHI that is not rendered unusable, unreadable, or indecipherable to unauthorized individuals through the use of a technology or methodology specified by the Secretary (e.g., encryption). This definition applies to both hard-copy PHI and ePHI.

2. Obligations and Activities of Business Associate

Business Associate agrees that (i) it shall use or disclose PHI only in connection with fulfilling its duties and obligations under this Agreement and the Services Agreement; (ii) it shall not use or disclose PHI other than as permitted or required by this Agreement or as Required By Law; (iii) it shall not use or disclose PHI in any manner that violates applicable federal or state law, or that would violate such law if used or disclosed in such manner by Covered Entity; and (iv) it shall use and disclose only the minimum necessary PHI for its specific purposes.
Business Associate agrees to use appropriate administrative, physical, and technical safeguards consistent with the size and complexity of Business Associate's operations, and to comply, where applicable, with Subpart C of 45 C.F.R. Part 164 with respect to ePHI, to prevent use or disclosure of PHI other than as provided for by this Agreement.
Business Associate agrees to report to Covered Entity any use or disclosure of PHI not provided for by this Agreement, including, without limitation, Breaches of Unsecured PHI as required at 45 C.F.R. §164.410, and any Security Incident of which it becomes aware. The Parties acknowledge and agree that this Section constitutes notice by Business Associate to Covered Entity of the ongoing existence and occurrence of attempted but unsuccessful Security Incidents for which no additional notice to Covered Entity shall be required. Unsuccessful Security Incidents include, without limitation, pings and other broadcast attacks on Business Associate's firewall, port scans, unsuccessful log-on attempts, denials of service, and any combination of the foregoing, so long as such incidents do not result, to the extent Business Associate is aware, in unauthorized access to, or use or disclosure of, ePHI. For all reporting obligations under this Agreement, the Parties acknowledge that, due to the nature of the Services, Business Associate may not know the nature of the PHI or the identities of the Individuals to whom the PHI relates. Accordingly, Business Associate may be limited in its ability to provide information regarding the identities of the Individuals who may have been affected by a Security Incident or Breach, or in its ability to provide detailed information regarding what PHI was affected.
In accordance with 45 C.F.R. §§164.502(e)(1)(ii) and 164.308(b)(2), if applicable, Business Associate agrees to ensure that any Subcontractors that create, receive, maintain, or transmit PHI on behalf of Business Associate agree in writing to substantially the same restrictions, conditions, and requirements that apply to Business Associate under this Agreement with respect to such PHI.
To the extent Business Associate maintains PHI in a Designated Record Set, Business Associate agrees, upon Covered Entity's written request, to make available PHI in a Designated Record Set to Covered Entity as necessary to satisfy Covered Entity's obligations under 45 C.F.R. §164.524. Covered Entity will be responsible for making all determinations regarding the grant or denial of an Individual's request for PHI, and Business Associate will make no such determinations. Except as Required By Law, only Covered Entity will be responsible for releasing PHI to an Individual pursuant to such a request. Any denial of access determined by Covered Entity pursuant to 45 C.F.R. §164.524 shall be the responsibility of Covered Entity, including resolution or reporting of all appeals and complaints arising from such denials.
To the extent Business Associate maintains PHI in a Designated Record Set, Business Associate agrees to make any amendment(s) to such PHI as requested in writing by Covered Entity pursuant to 45 C.F.R. §164.526. Covered Entity will be responsible for making all determinations regarding the grant or denial of an Individual's request for an amendment, and Business Associate will make no such determinations. Any denial of amendment determined by Covered Entity shall be the responsibility of Covered Entity, including resolution or reporting of all appeals and complaints arising from such denials.
Business Associate agrees to document and make available the information required to provide an accounting of disclosures to Covered Entity as necessary to satisfy Covered Entity's obligations under 45 C.F.R. §164.528.
To the extent that Business Associate is to carry out one or more of Covered Entity's obligations under Subpart E of 45 C.F.R. Part 164, Business Associate agrees to comply with the requirements of Subpart E that apply to Covered Entity in the performance of such obligations.
Business Associate agrees to make its internal practices, books, and records relating to the use and disclosure of PHI available to the Secretary at reasonable times for purposes of determining Covered Entity's and/or Business Associate's compliance with HIPAA.
Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a use or disclosure of PHI by Business Associate in violation of this Agreement.
Business Associate shall require each member of its workforce with access to PHI to complete appropriate privacy and security training and shall maintain sanction policies for workforce members who fail to comply with Business Associate's privacy and security policies.

3. Permitted Uses and Disclosures by Business Associate

Business Associate may only use or disclose PHI as necessary to perform its obligations under the Services Agreement. In addition, Business Associate is authorized to use PHI to de-identify the PHI in accordance with 45 C.F.R. §§164.502(d) and 164.514(a)–(c), and to use and disclose such De-Identified Data to provide, evaluate, secure, and improve its products and services, including the training, tuning, and evaluation of artificial-intelligence and machine-learning models.
Business Associate may use or disclose PHI as permitted or Required By Law.
Business Associate may not use or disclose PHI in a manner that would violate Subpart E of 45 C.F.R. Part 164 if done by Covered Entity, except for the specific uses and disclosures set forth herein.
Business Associate may use PHI for its proper management and administration, including to develop statistical and operational data regarding usage of its products or services, to detect and prevent fraud, abuse, or misuse of the Services, or to carry out its legal responsibilities.
Business Associate may disclose PHI for its proper management and administration or to carry out its legal responsibilities, provided that the disclosures are Required By Law, or Business Associate obtains reasonable assurances from the person to whom the information is disclosed that the information will remain confidential and be used or further disclosed only as Required By Law or for the purposes for which it was disclosed to the person, and that the person notifies Business Associate of any instances of which it is aware in which the confidentiality of the information has been breached.
Business Associate may provide Data Aggregation services to the extent permitted under HIPAA, and may use, disclose, and combine PHI created or received on behalf of Covered Entity pursuant to this Agreement with PHI received by Business Associate in its capacity as a business associate of other covered entities, to permit data analyses relating to the Health Care Operations of the respective covered entities and/or Covered Entity.

4. Artificial Intelligence and the Aya Assistant

Clinical decision support only. The Services, including Aya, provide informational and educational output intended to support — never replace — the independent professional judgment of a licensed clinician. Covered Entity is solely responsible for all clinical decisions, diagnoses, treatment, prescribing, documentation, and patient communications.
Minimum necessary inputs. Covered Entity acknowledges that the Services are not designed to require PHI. Covered Entity shall not submit PHI to the Services except where reasonably necessary, and shall use De-Identified Data wherever feasible.
Model improvement. Business Associate will not use PHI to train, tune, or otherwise improve generally available artificial-intelligence or machine-learning models. Business Associate may use De-Identified Data and aggregate usage metrics for such purposes as permitted in Section 3.1.
No autonomous action. The Services do not autonomously order, prescribe, bill, or otherwise take action on behalf of Covered Entity or any Individual.
Output limitations. Business Associate makes no representation that model output is complete, current, or free from error. Covered Entity shall verify all output against authoritative clinical sources before relying on it.

5. Safeguards, Security Program, and Breach Notification

Security program. Business Associate maintains a written information-security program that includes access controls, unique user identification, role-based authorization, audit logging, secure software development practices, vulnerability management, encryption of PHI in transit (TLS 1.2 or higher) and at rest (AES-256 or equivalent), business-continuity and disaster-recovery planning, and periodic risk analysis consistent with 45 C.F.R. §164.308(a)(1).
Breach notification timing. Business Associate shall notify Covered Entity of any Breach of Unsecured PHI without unreasonable delay and in no case later than thirty (30) calendar days after discovery of the Breach, unless a shorter period is Required By Law or a law-enforcement delay applies under 45 C.F.R. §164.412.
Contents of notice. To the extent known and reasonably available, such notice shall include: (i) a description of what happened, including the date of the Breach and the date of discovery; (ii) the types of PHI involved; (iii) the identification of each Individual whose Unsecured PHI has been, or is reasonably believed to have been, accessed, acquired, used, or disclosed; (iv) the steps Business Associate has taken or will take to investigate, mitigate harm, and prevent recurrence; and (v) a contact for further information.
Cooperation. Business Associate shall reasonably cooperate with Covered Entity in Covered Entity's investigation of, and required notifications regarding, a Breach. Except where Required By Law, Covered Entity is responsible for notifying affected Individuals, the Secretary, and the media as required under 45 C.F.R. §§164.404–164.408.

6. Obligations of Covered Entity

Covered Entity shall promptly notify Business Associate of any limitation(s) in Covered Entity's notice of privacy practices under 45 C.F.R. §164.520, to the extent that such limitation may affect Business Associate's use or disclosure of PHI.
Covered Entity shall notify Business Associate of any changes in, or revocation of, the permission by an Individual to use or disclose their PHI, to the extent that such changes may affect Business Associate's use or disclosure of PHI, prior to the effective date of such revocation.
Covered Entity shall notify Business Associate of any restriction on the use or disclosure of PHI that Covered Entity has agreed to or is required to abide by under 45 C.F.R. §164.522, to the extent that such restriction may affect Business Associate's use or disclosure of PHI, prior to the effective date of such restriction.
Covered Entity shall obtain any authorizations or consents as may be Required By Law for any of the uses or disclosures of PHI pursuant to this Agreement or the Services Agreement.
Covered Entity shall not request that Business Associate use or disclose PHI in any manner that would not be permissible under Subpart E of 45 C.F.R. Part 164 if done by Covered Entity.
Covered Entity is responsible for managing its own user accounts, credentials, and access rights within the Services, including promptly deactivating access for workforce members who no longer require it, and for all activity occurring under its accounts.

7. Term and Termination

Term. The term of this Agreement shall commence as of the date Covered Entity first accepts the Terms of Use or otherwise enters into a Services Agreement (the "Effective Date") and shall terminate upon the termination of the Services Agreement or on the date either Party terminates this Agreement for cause as authorized in Section 7.2, whichever is sooner.
Termination for Cause. Each Party authorizes termination of this Agreement by the other Party if a Party determines the other Party has breached a material term of this Agreement and the breach is not cured within thirty (30) days after the breaching Party's receipt of written notice of the alleged breach. Where cure is not feasible, the non-breaching Party may terminate immediately.
Obligations Upon Termination. Upon termination of this Agreement for any reason, Business Associate shall, if feasible as determined by Business Associate, return or destroy all PHI received from, or created or received by Business Associate for or on behalf of, Covered Entity that Business Associate or any of its Subcontractors still maintains in any form, and shall retain no copies of such PHI. If Business Associate determines that return or destruction is infeasible, Business Associate shall extend the protections of this Agreement to such PHI and limit further uses and disclosures to those purposes that make the return or destruction infeasible, for so long as Business Associate maintains such PHI.
Survival. The obligations of Business Associate under this Section 7.3 and Sections 2, 3, 5, and 8 shall survive the termination of this Agreement.

8. Miscellaneous

Regulatory References. A reference in this Agreement to a section of HIPAA or the HITECH Act means the section as in effect or as amended, and for which compliance is required.
Amendment. The Parties agree to take such action as is necessary to amend this Agreement from time to time as is necessary for compliance with the requirements of HIPAA, the HITECH Act, and any other applicable law. Business Associate may amend this Agreement by posting an updated version and providing notice as set forth in the Terms of Use; continued use of the Services after the stated effective date constitutes acceptance.
Interpretation. Any ambiguity in this Agreement shall be resolved in favor of a meaning that permits compliance with HIPAA and the HITECH Act. In the event of a conflict between this Agreement and the Services Agreement with respect to PHI, this Agreement shall control.
No Third-Party Beneficiaries. Nothing in this Agreement shall confer upon any person other than the Parties, and their respective successors and permitted assigns, any rights, remedies, obligations, or liabilities whatsoever.
Independent Contractors. None of the provisions of this Agreement is intended to create, nor shall be deemed or construed to create, any relationship between the Parties other than that of independent parties contracting for the purpose of effecting the provisions of this Agreement.
Notices. Notices under this Agreement shall be delivered in writing to the addresses set forth in the Services Agreement or, for Business Associate, to the contact in Section 9, and shall be deemed given upon receipt.
Limitation of Liability. Except as otherwise expressly provided herein, the limitations of liability and disclaimers set forth in the Services Agreement and the Terms of Use apply to this Agreement.
Assignment. Neither Party may assign this Agreement without the prior written consent of the other Party, except that either Party may assign this Agreement in connection with a merger, acquisition, or sale of substantially all of its assets.
Severability. If any provision of this Agreement is held to be invalid or unenforceable, the remaining provisions shall remain in full force and effect.
Governing Law. This Agreement shall be governed by and construed in accordance with the laws of the State of Delaware, without regard to its conflict-of-laws principles, except to the extent preempted by federal law.
Entire Agreement. This Agreement, together with the Terms of Use and any Services Agreement, constitutes the entire agreement between the Parties with respect to PHI and supersedes all prior understandings on that subject.

9. Contact

Questions regarding this Agreement, or requests for a countersigned copy, may be directed to:

Health Exam Inc.

Attn: Privacy Officer

Email: privacy@healthexam.ai

Website: https://www.healthexam.ai

See also our Terms of Use and Privacy Policy.