Business Associate Agreement

PLACEHOLDER DRAFT. This Business Associate Agreement has not yet been reviewed by counsel. It describes the intended terms in plain language and will be replaced by the final version before it takes effect for your practice.

1. Parties and purpose

This Business Associate Agreement (BAA) is between the practice identified at checkout (the Covered Entity) and Kontoku, LLC doing business as Prescripta (the Business Associate). It governs how Prescripta creates, receives, maintains, and transmits protected health information (PHI) on behalf of the Covered Entity in connection with the Prescripta platform.

2. Permitted uses and disclosures

Prescripta uses and discloses PHI only to provide the services in the Membership Agreement, as required by law, or as otherwise permitted in this BAA. Prescripta does not use PHI to train any artificial intelligence model and does not sell PHI.

3. Safeguards

Prescripta maintains administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of electronic PHI, including encryption at rest and in transit, per-practice isolation, access controls, and audit logging.

4. Reporting

Prescripta reports to the Covered Entity any use or disclosure of PHI not permitted by this BAA, any security incident, and any breach of unsecured PHI without unreasonable delay and within the time required by law.

5. Subcontractors

Prescripta ensures that any subcontractor that creates, receives, maintains, or transmits PHI on its behalf agrees in writing to the same restrictions and conditions that apply to Prescripta under this BAA.

6. Individual rights

Prescripta makes PHI available to the Covered Entity as needed for the Covered Entity to meet its obligations for access, amendment, and accounting of disclosures under HIPAA.

7. Term and termination

This BAA is effective when accepted and continues while Prescripta holds PHI for the Covered Entity. Either party may terminate this BAA if the other materially breaches it and does not cure the breach within a reasonable period. On termination, Prescripta returns or destroys PHI where feasible, and extends the protections of this BAA to any PHI it must retain.

8. Acceptance

By checking the acceptance box at checkout, the person placing the order confirms they are authorized to bind the Covered Entity, has read this BAA, and agrees to it. Prescripta records the version, the time, and the IP address of acceptance, keeps a copy of the exact text accepted, and emails that copy to the Covered Entity.