BUSINESS ASSOCIATE AGREEMENT

Effective Date: [Insert Date]

This Business Associate Agreement ("Agreement") is entered into by and between:

Covered Entity: [Customer Name / Healthcare Organization]
[Customer Address]
[City, State, ZIP]

Business Associate: Code Rare, LLC
Atlanta, Georgia, USA
Email: info@rarestrides.com

1. Definitions

All capitalized terms not otherwise defined shall have the meaning set forth in the HIPAA Privacy, Security, and Breach Notification Rules (45 C.F.R. Parts 160 and 164).

2. Obligations of Business Associate

• Use or disclose PHI only as permitted by this Agreement or as required by law.
• Implement appropriate safeguards (256-bit SSL/TLS, client-side AES-256-GCM password encryption, MFA, full audit logging, SQL Server TDE) to protect PHI.
• Report any Security Incident or Breach to Covered Entity within 10 business days of discovery.
• Ensure any Subcontractors that create, receive, maintain, or transmit PHI agree to the same restrictions and conditions.
• Make PHI available for access, amendment, and accounting as required by HIPAA.
• Upon termination, return or destroy all PHI as directed by the Covered Entity.

3. Permitted Uses and Disclosures

Business Associate may use or disclose PHI only to perform survey collection and reporting services on behalf of the Covered Entity, and as otherwise permitted or required by this Agreement or applicable law.

4. Obligations of Covered Entity

Covered Entity shall notify Business Associate of any restrictions or changes in permitted uses of PHI that may affect Business Associate's ability to perform its obligations under this Agreement.

5. Term and Termination

This Agreement shall remain in effect until terminated. Either party may terminate upon 30 days written notice if the other party is in material breach and has not cured the breach within that period.

6. Miscellaneous

This Agreement is governed by the laws of the State of Georgia. It constitutes the entire agreement between the parties with respect to its subject matter and may be executed electronically.

IN WITNESS WHEREOF, the parties have executed this Agreement as of the Effective Date above.