MASTER PROVIDER SERVICES AGREEMENT

3. PROVIDER RESPONSIBILITIES

1.  **Clinical Authority.**

Provider retains sole, exclusive, and independent authority over all clinical decisions, including diagnosis, treatment recommendations, treatment selection, medical necessity determinations, scheduling, scope of practice, supervision of clinical staff, choice of materials and pharmaceuticals, and all other aspects of the practice of dentistry, medicine, or any other licensed healthcare profession. PaiKnight does not, and shall not, exercise any control or direction over any clinical matter.

2. Supervision and Independent Judgment.

Provider acknowledges and agrees that, as the licensed clinician, Provider is responsible for: (a) being present at, or appropriately supervising, all Covered Services in accordance with the laws and rules of Provider’s state of practice; (b) ensuring that all medical necessity determinations are made independently by Provider and reflect Provider’s independent clinical judgment; (c) reviewing, approving, and signing any documentation (including letters of medical necessity prepared on Provider’s letterhead) before such documentation is submitted to any Payer; and (d) all disclosures required under Applicable Law to Patients regarding the use of administrative support vendors.

3. Information and Cooperation.

Provider will provide PaiKnight with such information, documents, access, and cooperation as PaiKnight reasonably requires to perform the Services, including Patient information (subject to the BAA), Payer information, Provider credentials, EDI enrollment information, and timely responses to PaiKnight communications. Provider warrants that all information provided to PaiKnight is accurate and complete in all material respects.

4. Licensure and Compliance.

Provider warrants and covenants that, throughout the Term: (a) Provider holds all licenses, certifications, accreditations, and authorizations required to render the Covered Services in the state(s) identified on the Order Form; (b) Provider is in good standing with all applicable licensing authorities; (c) Provider is not excluded from any federal or state healthcare program; (d) Provider complies with HIPAA and all other Applicable Law; and (e) Provider has and will maintain professional liability insurance in commercially reasonable amounts.

5. Anti-Fraud.

Provider will not, and will procure that no person acting on its behalf will, (a) submit or cause to be submitted any Claim for a service that was not rendered or that was misrepresented in any material respect; (b) up-code, unbundle, or otherwise manipulate procedure codes in violation of Applicable Law or Payer rules; or (c) engage in any other conduct that would constitute fraud, abuse, false claims, or billing manipulation under any Applicable Law. PaiKnight is entitled to refuse to submit, withdraw, or refuse to support any Claim that PaiKnight reasonably believes violates this Section, and any such refusal shall not constitute a breach of this Agreement by PaiKnight.

6. Prior Audits, Investigations, and Historical Liabilities.

Provider represents and warrants that, as of the Effective Date, neither Provider nor any of its owners, officers, or billing personnel is subject to, or has received notice of, any pending or threatened (a) Payer audit (including any prepayment or postpayment review), (b) governmental investigation, inquiry, or enforcement action, (c) overpayment demand, recoupment, or repayment request, (d) investigation, claim, or qui tam action under the federal False Claims Act or any state analogue, or (e) other regulatory action, in each case relating to Provider’s billing, coding, claims, or reimbursement practices. Provider shall promptly (and in any event within five (5) business days) notify PaiKnight in writing upon becoming aware of any such matter arising during the Term. Provider acknowledges and agrees that PaiKnight’s Services relate solely to Claims prepared or submitted with PaiKnight’s involvement during the Term, and that Provider retains sole responsibility for all claims, billing practices, and liabilities predating PaiKnight’s engagement or arising outside PaiKnight’s involvement.

7. Claim Certification; Provider as Sole Submitter.

As between the Parties, Provider is, and shall at all times remain, the sole legal submitter and certifier of every Claim. PaiKnight performs only ministerial, administrative submission functions pursuant to, and strictly in accordance with, Provider’s authorization. By authorizing the submission of any Claim through the Platform or otherwise, Provider expressly certifies that such Claim, and all documentation supporting it, is truthful, accurate, and complete in all material respects and complies with Applicable Law and applicable Payer rules. Provider shall complete, as a condition of the submission of each Claim, a per-Claim electronic attestation within the Platform confirming the foregoing certification and, for high-value Claims (meaning any Claim with billed charges equal to or exceeding the threshold specified on the Order Form or, if no threshold is specified, US$10,000, and any Claim within a procedure category or Payer risk category designated in PaiKnight’s documented compliance policy), confirming eligibility and benefits verification, Provider credentialing and network status, and clinical, coding, and medical-necessity support. Nothing in this Agreement transfers to PaiKnight any certification responsibility of Provider under the federal False Claims Act or any other Applicable Law.

8. Overpayments.

If Provider identifies, or receives credible information concerning, a suspected overpayment by any Payer in respect of any Claim, Provider shall promptly investigate such suspected overpayment and, where required by Applicable Law or the applicable Payer contract, timely report and refund such overpayment within the period required by Applicable Law. PaiKnight may suspend the Services (in whole or in part) or terminate this Agreement immediately upon written notice if Provider fails to comply with this Section, and no such suspension or termination shall constitute a breach of this Agreement by PaiKnight. PaiKnight bears no responsibility or liability for any failure by Provider to investigate, report, or refund any overpayment.

9. Patient Cost-Sharing.

Provider shall (a) bill Patients for all applicable deductibles, coinsurance, copayments, and other cost-sharing amounts; (b) make commercially reasonable, good-faith efforts to collect such amounts; (c) waive or reduce Patient cost-sharing only on a case-by-case basis pursuant to a documented, compliant financial-hardship policy; and (d) not engage in any routine waiver of Patient cost-sharing and not advertise or operate any routine “no out-of-pocket” arrangement. Provider shall provide evidence of its compliance with this Section upon PaiKnight’s reasonable request.

10. Payer Contract Restrictions; Offshore PHI Access.

Provider represents and warrants that its Payer agreements permit (or do not prohibit) the offshore handling of, and access to, PHI as authorized under Section 2.4 and the BAA. Provider shall promptly notify PaiKnight in writing of any Payer-contract or state-law restriction on the offshore handling of, or access to, PHI of which Provider is or becomes aware, and PaiKnight may adjust or restrict the delivery of the affected Services accordingly.

11. Onboarding; KYC and Ongoing Compliance Verification.

Provider shall complete PaiKnight’s onboarding, know-your-customer (KYC), and compliance verification procedures as a condition of receiving the Services, and shall promptly provide such information and documentation as PaiKnight reasonably requests for that purpose, including evidence of identity, licensure, ownership, corporate standing, and federal and state exclusion, sanctions, and debarment screening. Provider shall keep such information accurate, complete, and current throughout the Term and shall promptly notify PaiKnight in writing of any material change to it. PaiKnight may repeat such verification periodically during the Term, and Provider’s continued satisfaction of PaiKnight’s KYC and ongoing compliance verification requirements is a condition of PaiKnight’s continued provision of the Services.

5. FEES AND PAYMENT

1.  **Monthly Retainer; SaaS Subscription.**

Provider will pay PaiKnight (a) the monthly Provider Retainer confirmed by PaiKnight to Provider in writing before invoicing, and (b) any monthly or annual SaaS Subscription Fee separately confirmed in writing. Such Fees are payable in advance and are non-refundable except as expressly provided in this Agreement. The Retainer and the SaaS Subscription Fee are fixed fees for services rendered and platform access and are not contingent on Claim outcomes or any clinical metric. The pricing schedule disclosed on the Order Form is not a Provider selection. Following consultation, PaiKnight may confirm in writing that the applicable Retainer arrangement is per-Patient monthly pricing, a Commitment Package (Section 5.7) with a fixed monthly fee subject to the applicable LMN-Patient capacity limits, or the DSO Group Program (Section 5.8) with a fixed monthly fee for each participating provider professional. Under the per-Patient monthly option, each LMN Patient is billed at the stated per-Patient rate for every month in which that Patient’s case remains active in PaiKnight’s workflow. A case remains active until PaiKnight’s applicable documentation and reimbursement-support work is completed or closed, or the case is withdrawn in writing. A Patient whose case remains active across multiple months is included in the active case count and billed in each such month, and new LMN Patients are added to the active case count when their cases enter the workflow. Patients supported in excess of a confirmed Commitment Package capacity are chargeable at the per-Patient rate stated on the Order Form.

2. SCA Work Protection Fee.

Provider will additionally pay PaiKnight a fee (the “SCA Work Protection Fee”) in the fixed, flat amount set forth on the Order Form for the applicable case-complexity tier in respect of each Claim that PaiKnight supports through the Services. The SCA Work Protection Fee is earned when either (a) the applicable SCA is fully executed, or (b) the case becomes a Substantially Processed SCA Case and Provider subsequently terminates, withdraws, transfers, circumvents, or otherwise prevents PaiKnight from completing the SCA process. For a fully executed SCA, invoicing and collection of the SCA Work Protection Fee will ordinarily be deferred until the Payer issues payment for Covered Services performed under the SCA; if Provider cancels or interferes with a Substantially Processed SCA Case before execution, that deferral immediately ends and the entire applicable SCA Work Protection Fee becomes immediately due and payable. The SCA Work Protection Fee is compensation for the SCA-related work, resources, and administrative value provided by PaiKnight, including the administrative claims-support, appeals-support, documentation-preparation, and workflow-administration services rendered by PaiKnight in respect of such Claim, is not a legal contingency fee, public-adjuster fee, finder’s fee, or referral fee, and is not paid in respect of any Patient referral. For the avoidance of doubt: (a) the SCA Work Protection Fee is a fixed, flat charge for the defined administrative services described in this Agreement, and is not calculated as a percentage of, and is not contingent on, the amount recovered or collected in respect of any Claim; (b) the SCA Work Protection Fee is payable only in respect of Claims for Covered Services that have been rendered by Provider in accordance with Provider’s independent clinical judgment and submitted with Provider’s authorization; (c) if the law of any state applicable to the Services requires a particular fee structure, the SCA Work Protection Fee shall automatically be adjusted to the extent necessary to remain a compliant fixed or flat-fee arrangement, and the Parties shall promptly document such adjustment in an amended Order Form; and (d) the SCA Work Protection Fee applies only to eligible commercial-Payer cases, and no SCA Work Protection Fee shall attach to any Medicare, Medicaid, TRICARE, or other federal healthcare program claim, including any crossover or secondary claim.

“Substantially Processed SCA Case” means a case for which PaiKnight has completed the material documentation, authorization, GAP-exception, medical-necessity, and administrative requirements applicable to the case; the case is under active SCA negotiation or awaiting preparation, approval, or signature; and execution of the SCA is the principal remaining step.

Provider acknowledges that the recurring Retainer, SaaS Subscription, Commitment Package, and DSO Group Program fees, on the one hand, and the SCA Work Protection Fee, on the other, are separate and independent fee categories: the recurring fees are paid in advance for ongoing monthly administrative services, and the SCA Work Protection Fee is charged for each qualifying SCA case that reaches an earning milestone described above. Payment of one fee does not satisfy, replace, reduce, or eliminate the other. No duplicate SCA Work Protection Fee shall apply to the same case; if the SCA Work Protection Fee is paid following cancellation of a Substantially Processed SCA Case and the SCA is later executed, that payment satisfies the SCA Work Protection Fee for that case.

3. Appeals Support and Documentation Preparation.

Appeals Support and Documentation Preparation performed for a qualifying SCA case are components of the SCA-related work covered by the applicable SCA Work Protection Fee under Section 5.2. The Provider does not separately elect these components or select the applicable case-complexity tier. PaiKnight evaluates the work required for the case and applies the corresponding fixed SCA Work Protection Fee stated on the Order Form.

4. Invoicing and Payment.

PaiKnight will invoice Provider monthly. The Retainer and SaaS Subscription Fee are invoiced in advance for the following month, and the SCA Work Protection Fee is invoiced in arrears. Invoices are due within fifteen (15) days of the invoice date. Past-due amounts accrue interest at the lesser of one and one-half percent (1.5%) per month and the maximum rate permitted by Applicable Law. Provider shall pay all Fees free and clear of any deduction, set-off, or counterclaim.

5. Taxes.

All Fees are exclusive of any sales, use, value-added, or similar taxes (other than taxes on PaiKnight’s net income). Provider is responsible for all such taxes applicable to the Services.

6. Pricing Uniformity.

PaiKnight will use commercially reasonable efforts to apply uniform pricing across Providers of comparable size, specialty, and elected scope of Services, except for differences attributable to volume, scope of Services elected, jurisdiction-specific compliance costs, and good-faith promotional pricing.

7. Commitment Packages; Early Termination.

If PaiKnight and Provider separately confirm a discounted commitment package in writing (a “Commitment Package”), the discounted Commitment Package rates set forth on the Order Form are conditioned on Provider maintaining the Services, and paying the full minimum financial commitment, for the full committed term stated in that written confirmation (the “Committed Term”). Provider’s decision not to submit the expected number of Patients, or not to use the full package capacity, does not reduce that payment commitment. If, before the end of the Committed Term, (a) Provider terminates this Agreement other than for PaiKnight’s uncured material breach under Section 13.3, or (b) PaiKnight terminates this Agreement under Section 13.3 or for Provider’s failure to complete or maintain KYC or ongoing compliance verification under Section 13.2, then the balance of the Retainer and SaaS Subscription Fees that would have been payable for the remainder of the Committed Term shall become immediately due and payable in full as of the effective date of termination, in addition to all other amounts accrued through that date. No acceleration applies where PaiKnight terminates for convenience under Section 13.2 or where Provider terminates for PaiKnight’s uncured material breach. The Parties acknowledge and agree that this acceleration reflects the value of the separately confirmed committed-term discount, is a reasonable estimate of PaiKnight’s loss of bargain, and constitutes liquidated compensation and not a penalty.

8. DSO Group Program.

The DSO Group Program is available only to a multi-clinic organization with multiple participating provider professionals that processes at least one hundred (100) LMN Patients per month in aggregate across the participating group. The monthly Retainer stated on the Order Form applies separately to each participating provider professional in the DSO group and is not a single flat fee for the entire group. PaiKnight must confirm the Provider’s eligibility and participating-provider count in writing before applying DSO pricing. Continued eligibility requires the group to maintain the stated monthly LMN-Patient volume. If the group does not maintain the minimum volume, PaiKnight will confirm an applicable Retainer arrangement for the following billing cycle. The DSO Group Program does not change the Initial Term stated on the Order Form unless the Parties expressly agree otherwise in writing.

6. CLAWBACK; ADJUSTMENTS

1.  **Payer Adjustments and Recoupments.**

Provider acknowledges that all Payer payments may be subject to retrospective review, adjustment, recoupment, offset, take-back, or chargeback. Except as expressly provided in this Section 6.1, Provider shall remain solely responsible for every such adjustment or recoupment, and no Fee paid or payable to PaiKnight shall be refundable, creditable, or subject to set-off merely because a Payer subsequently denies, adjusts, reverses, or recoups payment of a Claim.

PaiKnight shall have no responsibility for any recoupment arising from or relating to Provider’s clinical judgment, medical-necessity determinations, documentation, coding instructions or approvals, licensure, credentialing, network participation, Payer agreements, Patient eligibility, coordination of benefits, prior authorization, Patient cost-sharing, the services rendered, information supplied by Provider, or any act or omission outside PaiKnight’s expressly agreed Services.

A credit against PaiKnight’s Fees shall arise only where, following the timely exhaustion of all reasonably available administrative appeal rights, it is established by PaiKnight’s written admission or by a final, non-appealable arbitral or judicial determination that the recoupment resulted directly and solely from PaiKnight’s material failure to follow Provider’s written and approved claim-submission instructions. Any such credit shall be limited to the Fee actually paid to PaiKnight for the affected Claim and shall not include the amount recouped by the Payer, lost revenue, interest, penalties, or consequential damages. Any credit available under this Section constitutes Provider’s sole and exclusive contractual remedy against PaiKnight arising from or relating to the applicable recoupment, and Provider shall have no right to recover the recouped amount, consequential damages, penalties, interest, lost revenue, lost profits, or any other amount from PaiKnight.

Provider shall notify PaiKnight of any proposed recoupment within five (5) business days after receipt, provide all supporting documentation, and preserve all applicable appeal rights. Provider may not withhold or set off Fees based on an alleged recoupment unless agreed by PaiKnight in writing or determined by a final arbitral or judicial award. Provider’s failure to provide timely notice, preserve appeal rights, supply requested documentation, or reasonably cooperate in contesting the recoupment shall permanently waive any entitlement to a credit under this Section.

2. Disputed Amounts.

If Provider in good faith disputes any invoice, Provider shall pay all undisputed amounts when due and shall notify PaiKnight in writing of the disputed amount and the basis for the dispute within ten (10) days of the invoice date. The Parties will negotiate in good faith to resolve any disputed amount within thirty (30) days of such notice.

3. Payer Payments; No Assignment.

All Payer reimbursements shall be made directly to Provider. PaiKnight shall not be identified as the rendering provider, billing provider, supplier, payee, assignee, beneficiary, or owner of any Claim or reimbursement right; shall not submit Claims under PaiKnight’s own NPI, TIN, provider number, or bank account; and shall not receive or control Payer reimbursement funds. Nothing in this Agreement constitutes an assignment to PaiKnight of Provider’s insurance benefits, Claims, accounts receivable, or reimbursement rights.

13. TERM; TERMINATION

1.  **Term.**

This Agreement begins on the Effective Date set forth on the Order Form and, unless earlier terminated in accordance with this Section 13, will continue for the initial term set forth on the Order Form (the “Initial Term”), and shall automatically renew for successive twelve (12) month renewal terms (each, a “Renewal Term” and, together with the Initial Term, the “Term”), unless either Party gives the other written notice of non-renewal at least sixty (60) days prior to the end of the then-current term.

2. Termination for Convenience.

After the Initial Term, either Party may terminate this Agreement for convenience upon ninety (90) days’ prior written notice. In addition, PaiKnight may terminate this Agreement for convenience at any time, including during the Initial Term, upon thirty (30) days’ prior written notice to Provider, and may terminate this Agreement immediately upon written notice if Provider fails to complete, or ceases to satisfy, PaiKnight’s KYC or ongoing compliance verification requirements under Section 3.11.

3. Termination for Cause.

Either Party may terminate this Agreement immediately upon written notice if the other Party (a) commits a material breach of this Agreement and fails to cure such breach within thirty (30) days of receiving written notice of the breach (or, in the case of a breach by Provider of Sections 3.4 (Licensure), 3.5 (Anti-Fraud), or the BAA, immediately and without a cure period); (b) becomes insolvent, makes a general assignment for the benefit of creditors, files a petition in bankruptcy, or has a receiver appointed for substantially all of its assets; (c) is excluded from any federal or state healthcare program or loses any license required to perform its obligations under this Agreement; (d) engages in conduct that would, in the reasonable judgment of the other Party, expose the other Party to material regulatory, reputational, or legal risk; or (e) in the case of termination by PaiKnight only, Provider undergoes a change of control (meaning any transaction or series of related transactions by which any person or entity acquires direct or indirect control of Provider or of all or substantially all of Provider’s assets) that, in PaiKnight’s reasonable judgment, materially increases PaiKnight’s regulatory, compliance, or reputational risk.

4. Effect of Termination.

Upon termination or expiration: (a) all rights and licenses granted hereunder cease immediately; (b) Provider shall pay all amounts accrued and outstanding through the effective date of termination, including (i) SCA Work Protection Fees in respect of Claims for which Services were materially completed prior to termination and that are subsequently paid in accordance with Section 13.5, (ii) all remaining Commitment Package fees subject to acceleration under Section 5.7, (iii) all unpaid SCA Work Protection Fees for executed SCAs, and (iv) the full SCA Work Protection Fee for every Substantially Processed SCA Case as to which Provider has terminated, withdrawn, transferred, circumvented, or otherwise prevented completion of the SCA process; (c) each Party shall return or destroy the other Party’s Confidential Information; and (d) PaiKnight shall return or destroy PHI in accordance with the BAA.

5. Tail Period for SCA Work Protection Fees.

For Claims as to which PaiKnight has materially completed its Services (including preparation and submission of the Claim and any pending appeal) prior to the effective date of termination, the SCA Work Protection Fee shall continue to be payable for a period of one hundred eighty (180) days after termination if and when such Claims are paid by the applicable Payer. This Section 13.5 survives termination.

6. Survival.

Sections 1, 3.4 through 3.11, 4, 5.5, 5.7, 6, 7, 8, 9, 10, 11.2, 11.3, 12, 13.4, 13.5, 13.6, 14, 15, and 16, and the BAA, survive termination of this Agreement.

7. Suspension of Services.

Without limiting its termination rights, PaiKnight may suspend the Services, in whole or in part, immediately upon written notice to Provider if (a) PaiKnight reasonably determines that continued performance would create a material legal, regulatory, or compliance risk for PaiKnight; (b) Provider fails to pay any undisputed amount when due and such failure continues after any applicable cure period; or (c) a compliance concern regarding Provider’s claims, billing, or cost-sharing practices reasonably requires an immediate operational pause pending investigation. PaiKnight will lift any such suspension promptly once the circumstances giving rise to it have been resolved to PaiKnight’s reasonable satisfaction. Fees continue to accrue during any suspension arising from Provider’s act or omission, and no suspension in accordance with this Section constitutes a breach of this Agreement by PaiKnight.

15. GOVERNING LAW; DISPUTE RESOLUTION

1.  **Governing Law.**

This Agreement is governed by, and shall be construed in accordance with, the laws of the State identified as the Provider’s primary State of operation on the Order Form (the “Governing State”), without regard to its conflict-of-laws principles. The Parties acknowledge that this choice of law does not, and is not intended to, waive the applicability of any mandatory U.S. federal or state healthcare regulatory law (including HIPAA, the HITECH Act, the federal Anti-Kickback Statute, the Stark Law, the federal False Claims Act, and applicable state insurance, fee-splitting, corporate-practice-of-medicine or -dentistry, licensing, and consumer-protection laws), which apply to the performance of this Agreement irrespective of the governing law chosen by the Parties.

2. Forum.

Subject to Section 15.3, any dispute arising out of or in connection with this Agreement, including any question regarding its existence, validity, or termination, shall be finally resolved by binding arbitration administered by the American Arbitration Association (“AAA”) under its Commercial Arbitration Rules then in effect, before a single arbitrator, with the seat and hearing locale in the Governing State, and judgment on the award may be entered in any court of competent jurisdiction. Where such arbitration is unavailable or unenforceable, the state and federal courts located in the Governing State shall have exclusive jurisdiction. Nothing in this Section requires arbitration of any claim that, as a matter of mandatory law, may not be arbitrated.

3. Carve-Outs.

Notwithstanding Section 15.2, (a) either Party may seek injunctive or other equitable relief in any court of competent jurisdiction to protect its intellectual property, Confidential Information, or PHI; (b) PaiKnight may bring an action for the collection of unpaid Fees in any court having jurisdiction over Provider; and (c) nothing in this Agreement limits any Party’s right to raise or defend any claim, objection, or proceeding under mandatory U.S. federal or state law in the appropriate U.S. forum.

4. Pre-Suit Negotiation.

Before commencing any formal proceeding, the Parties shall first attempt to resolve any dispute through good-faith negotiation between senior officers of each Party for a period of not less than thirty (30) days.

5. Prevailing-Party Attorneys’ Fees.

In any arbitration or court proceeding arising out of or relating to this Agreement, the prevailing Party shall be entitled to recover its reasonable attorneys’ fees, costs, and expenses from the non-prevailing Party, in addition to any other relief awarded.

6. Notice of Claims Against Provider.

If any legal or administrative claim, action, proceeding, investigation, or dispute relating to Claims, billing, reimbursement, or the Services is threatened or commenced against Provider, Provider shall, before taking any substantive step in response, first notify PaiKnight by email to legal@paiknight.com using the notification form prescribed and provided by PaiKnight for that purpose, and shall keep PaiKnight reasonably informed of the status of the matter, so that the Parties may coordinate an appropriate administrative response. Nothing in this Section requires Provider to delay any response required by law, court order, or a regulator within a mandatory deadline, limits Provider’s right to engage its own legal counsel at any time, or constitutes the provision of legal advice or legal representation by PaiKnight.

EXHIBIT A

BUSINESS ASSOCIATE AGREEMENT

This Business Associate Agreement (this “BAA”) supplements and is made a part of the Master Provider Services Agreement between PaiKnight LLC (“Business Associate”) and Provider (“Covered Entity”). Capitalized terms used but not defined in this BAA have the meanings given to them in the HIPAA Rules.

1. Definitions.

“HIPAA Rules” means the Privacy, Security, Breach Notification, and Enforcement Rules at 45 C.F.R. Parts 160 and 164.

“PHI” means Protected Health Information limited to the information Business Associate creates, receives, maintains, or transmits on behalf of Covered Entity. Other capitalized terms used herein (including “Business Associate”, “Covered Entity”, “Breach”, “Disclosure”, “Required by Law”, “Security Incident”, “Subcontractor,” “Unsecured PHI,” and “Use” have the meanings given in the HIPAA Rules.

2. Permitted Uses and Disclosures.

(a) Business Associate may Use and Disclose PHI only as necessary to perform the Services under the Agreement, as Required by Law, or as expressly permitted by this BAA. (b) Business Associate may Use PHI for the proper management and administration of Business Associate and to carry out its legal responsibilities. (c) Business Associate may Disclose PHI for the proper management and administration of Business Associate or to carry out its legal responsibilities provided that the Disclosures are Required by Law or Business Associate obtains reasonable assurances from the person to whom the PHI is Disclosed that it will be held confidentially and Used or further Disclosed only as Required by Law or for the purpose for which it was Disclosed, and that the person notifies Business Associate of any instance of which it becomes aware in which the confidentiality of the PHI has been breached. (d) Business Associate may Use PHI to provide Data Aggregation services relating to the health care operations of Covered Entity, as permitted under 45 C.F.R. Section 164.504(e)(2)(i)(B). (e) Business Associate may de-identify PHI in accordance with 45 C.F.R. Section 164.514(a)-(c) and Use and Disclose such de-identified data for any lawful purpose.

3. Obligations of Business Associate.

Business Associate shall: (a) not Use or further Disclose PHI other than as permitted or required by this BAA, the Agreement, or as Required by Law; (b) Use appropriate safeguards, and comply with Subpart C of 45 C.F.R. Part 164 with respect to electronic PHI, to prevent Use or Disclosure of PHI other than as provided by this BAA; (c) report to Covered Entity any Use or Disclosure of PHI not provided for by this BAA of which it becomes aware, including any Breach of Unsecured PHI as required by 45 C.F.R. Section 164.410, and any Security Incident of which it becomes aware; (d) in accordance with 45 C.F.R. Section 164.502(e)(1)(ii) and 164.308(b)(2), ensure that any Subcontractor that creates, receives, maintains, or transmits PHI on behalf of Business Associate agrees in writing to substantially the same restrictions, conditions, and requirements that apply to Business Associate with respect to such PHI; (e) make available PHI in a Designated Record Set to Covered Entity as necessary to satisfy Covered Entity’s obligations under 45 C.F.R. Section 164.524; (f) make any amendment(s) to PHI in a Designated Record Set as directed or agreed to by Covered Entity pursuant to 45 C.F.R. Section 164.526; (g) maintain and make available the information required to provide an accounting of Disclosures to Covered Entity as necessary to satisfy Covered Entity’s obligations under 45 C.F.R. Section 164.528; (h) to the extent Business Associate is to carry out one or more of Covered Entity’s obligation(s) under Subpart E of 45 C.F.R. Part 164, comply with the requirements of Subpart E that apply to Covered Entity in the performance of such obligation(s); and (i) make its internal practices, books, and records available to the Secretary of the U.S. Department of Health and Human Services for purposes of determining compliance with the HIPAA Rules.

4. Breach Notification.

Business Associate shall report any Breach of Unsecured PHI to Covered Entity without unreasonable delay and in any event no later than thirty (30) calendar days after discovery of the Breach. The notification shall include, to the extent then known, the information required by 45 C.F.R. Section 164.410(c), and Business Associate shall provide additional information as it becomes available. Business Associate shall cooperate with Covered Entity in the investigation, mitigation, and notification of any Breach.

5. Offshore Access to PHI

Covered Entity expressly acknowledges and authorizes Business Associate’s access to PHI by Business Associate’s personnel and Subcontractors located outside the United States, including in the United Arab Emirates and the Philippines, subject to (i) the absence of any Payer-contract or state-law restriction prohibiting such offshore access, and (ii) Business Associate’s implementation of appropriate administrative, physical, and technical safeguards including: encrypted transmission, role-based access controls, multi-factor authentication, jurisdiction logging, workforce HIPAA training, and Subcontractor BAAs flowing the foregoing obligations through to all offshore personnel and vendors with access to PHI.

6. Obligations of Covered Entity

Covered Entity shall: (a) notify Business Associate of any limitation in its Notice of Privacy Practices, to the extent such limitation may affect Business Associate’s Use or Disclosure of PHI; (b) notify Business Associate of any changes in, or revocation of, the permission by an Individual to Use or Disclose PHI, to the extent such changes may affect Business Associate’s Use or Disclosure of PHI; (c) notify Business Associate of any restriction on the Use or Disclosure of PHI that Covered Entity has agreed to or is required to abide by under 45 C.F.R. Section 164.522, to the extent such restriction may affect Business Associate’s Use or Disclosure of PHI; and (d) not request Business Associate to Use or Disclose PHI in any manner that would not be permissible under the HIPAA Rules if done by Covered Entity, except as set forth in Sections 2(b)-(d) above with respect to the proper management and administration and legal responsibilities of Business Associate and data aggregation services.

7. Term and Termination

This BAA is effective on the Effective Date of the Agreement and continues until termination or expiration of the Agreement. Upon termination, Business Associate shall return or destroy all PHI received from, created, maintained, or received by Business Associate on behalf of Covered Entity that Business Associate still maintains in any form, and shall retain no copies of such PHI; provided that, if such return or destruction is not feasible, Business Associate shall extend the protections of this BAA to the PHI and limit further Uses and Disclosures to those purposes that make the return or destruction infeasible for so long as Business Associate maintains such PHI.

8. Miscellaneous

(a) Regulatory Reference. A reference in this BAA to a section in the HIPAA Rules means the section as in effect or as amended. (b) Amendment. The Parties shall take such action as is necessary to amend this BAA from time to time as is necessary for compliance with the HIPAA Rules and any other applicable law. (c) Interpretation. Any ambiguity in this BAA shall be resolved to permit compliance with the HIPAA Rules. (d) Survival. The obligations of Business Associate under Section 7 survive termination of this BAA.