Business Associate Agreement

Why this document exists

If your practice is a covered entity under HIPAA, and you use Articarry to handle your patients' protected health information, HIPAA requires a written agreement between us. This is it. In plain terms: your practice remains responsible for the patient relationship, and Articarry is responsible for handling the information you entrust to it, using it only for what you hired it to do, protecting it, and telling you quickly if it is ever exposed.

1. Definitions

Capitalized terms not defined here have the meanings given in the HIPAA Privacy, Security, Breach Notification, and Enforcement Rules at 45 CFR Parts 160 and 164 ("HIPAA Rules"). "Covered Entity" means you. "Business Associate" means Articarry, Inc., a Delaware corporation. "PHI" means protected health information Articarry creates, receives, maintains, or transmits for you: in practice, a child's audio recordings, their first name and date of birth, and the practice and clinical records attached to them.

2. What Articarry may do with PHI

Articarry may use and disclose PHI only:

• to provide the service to you and to the child's guardian;
• for Articarry's proper management and administration, and to carry out its legal responsibilities, as 45 CFR 164.504(e)(4) permits. Where Articarry discloses PHI for that purpose, it does so only as law requires, or with written assurances from the recipient that the information stays confidential and that any breach is reported back;
• to provide data aggregation services relating to your operations;
• as required by law;
• to create de-identified information under 45 CFR 164.514(b), which Articarry may then use to run and improve the service. Identifiable recordings are never used to train a model, Articarry's own or anyone else's, unless the individual's personal representative has given the separate optional authorization described below.

What Articarry does not do. It does not sell PHI. It does not use or disclose PHI for marketing. It does not use identifiable PHI to build or improve the product: that work runs on de-identified information, or on a separate, optional authorization a guardian may decline without losing any part of the service. Identifiable recordings are never used to train a model, Articarry's own or anyone else's, without that separate authorization.

Articarry will not use or disclose PHI in a way that would break the Privacy Rule if you did it yourself, except where 164.504(e)(4) allows it. It applies the minimum necessary standard to its own uses and disclosures.

3. Safeguards

Articarry will use appropriate administrative, physical, and technical safeguards, and will comply with the Security Rule at 45 CFR 164 Subpart C with respect to electronic PHI, to prevent use or disclosure of PHI other than as this agreement allows. Today that includes: encryption in transit and at rest; all PHI held in one region with a hosting provider (Microsoft) under a business associate agreement; secrets held in a managed vault and reached by managed identity; access control checked on every request against the specific clinician or guardian who owns the record; an append-only audit log of sensitive reads and writes; structured logging that redacts PHI so it never reaches a log line, a URL, or an error message; and a documented retention schedule, with audio expiry enforced by the storage platform itself.

Articarry maintains a written risk analysis and the administrative policies the Security Rule requires, reviews them when the service changes materially, and makes a summary available to you on request.

4. Reporting

• Articarry will report to you any use or disclosure of PHI not permitted by this agreement, promptly after it becomes aware of it.
• Articarry will report a Breach of Unsecured PHI to you without unreasonable delay, and no later than ten (10) calendar days after discovery. The report identifies the individuals involved so far as known, what happened, when, what information was involved, what Articarry has done, and what it recommends.
• Articarry will report Security Incidents affecting PHI. Unsuccessful attempts that cause no unauthorized access (routine scans, blocked sign-in attempts, denied requests) are reported in aggregate on your request rather than individually.
• Articarry will cooperate with your own notification obligations and provide the information you reasonably need to meet them.

Where a Breach is caused by Articarry, Articarry bears the reasonable, documented cost of the notification that Breach requires, including notifying the affected individuals, the Secretary, and the media where the Rules require it.

5. Subcontractors

Articarry will require every subcontractor that creates, receives, maintains, or transmits PHI on its behalf to agree in writing to the same restrictions and conditions that apply to Articarry, as 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2) require. Articarry's current subcontractors handling PHI, and the status of each agreement, are published and kept current so you can review them before you enroll a patient.

6. Individuals' rights

• Access (164.524). Articarry makes PHI in a Designated Record Set available to you, or to the individual at your direction, so you can meet an access request. The product also gives a guardian a direct export of their family's data.
• Amendment (164.526). Articarry will make PHI available for amendment, and incorporate any amendment you direct, within a reasonable time.
• Accounting (164.528). Articarry keeps the information needed for an accounting of disclosures, and provides it to you on request. Its audit log is append-only for this reason.
• Restrictions and confidential communications. You will tell Articarry about any restriction or confidential-communication request that affects how it may use or disclose PHI, and Articarry will honor it.

7. Access for HHS

Articarry will make its internal practices, books, and records relating to the use and disclosure of PHI available to the Secretary of Health and Human Services for determining your compliance with the Privacy Rule.

8. Your obligations

• Tell Articarry about any limitation in your notice of privacy practices, any change to or withdrawal of an individual's permission, and any restriction you have agreed to, so far as any of those affect Articarry's use or disclosure of PHI.
• Do not ask Articarry to use or disclose PHI in a way that would break the Privacy Rule if you did it yourself.
• Obtain the consent, authorization, or permission that applies to your patients before enrolling a child, and send an invite only to the person entitled to give it.

9. Term and termination

• This agreement starts when you accept it and runs until all PHI is returned or destroyed, or until it is terminated.
• If either side materially breaches this agreement, the other may end it, allowing 30 days to cure a breach that can be cured. Where cure is not possible, it may be ended immediately.
• At the end. Articarry will return or destroy all PHI it still holds, including PHI held by its subcontractors, and keep no copies, where that is feasible. Where it is not feasible, Articarry will tell you why, keep protecting the information under this agreement, and limit further use and disclosure to what makes return or destruction infeasible, for as long as it holds the information.
• Backups are overwritten on their usual cycle. Articarry states that cycle in its privacy notice rather than claiming an instant purge it cannot perform.

10. General

• Regulatory references are to the section as amended from time to time.
• Interpretation. Any ambiguity is resolved to permit compliance with the HIPAA Rules.
• Amendment. The parties will amend this agreement as needed for either to comply with changes in law. A new version is published, and you are asked to accept it.
• No third-party beneficiaries. Nothing here creates rights in anyone other than the parties, their successors, and permitted assigns.
• Conflict. Where this agreement and the Terms of Service conflict about PHI, this agreement controls.
• Survival. Sections 2, 3, 4, 6, 7, and 9 survive termination for as long as Articarry holds PHI.

Execution. Accepting this agreement in the product is its execution, and Articarry records the version you accepted, the date and time, and a fingerprint of the exact text you were shown. A copy is published and printable at any time. If your practice or its counsel needs a countersigned paper original, or a state-specific addendum, write to support@articarry.com and we will provide one.