Business Associate Agreement

This agreement is between AI LeadBoosters LLC, a Wyoming limited liability company at 1309 Coffeen Avenue STE 1200, Sheridan, Wyoming 82801 ("we", "us"), and the business accepting it ("you"). It takes effect on the date you accept it and continues for as long as we hold any Protected Health Information of yours.

You are a Covered Entity, or a Business Associate acting for one. We are your Business Associate. This agreement governs anything we do with Protected Health Information on your behalf, and it overrides anything in any other agreement between us that conflicts with it.

By accepting, you confirm you are authorised to bind your business to this agreement.

Breach, Covered Entity, Business Associate, Designated Record Set, Protected Health Information, Required by Law, Security Incident, Subcontractor and Unsecured Protected Health Information carry the meanings HIPAA gives them, and change when HIPAA changes them.

• HIPAA means the Health Insurance Portability and Accountability Act of 1996, the HITECH Act, and the rules made under them, as amended.
• Privacy Rule means 45 CFR Part 160 and Part 164, Subparts A and E. Security Rule means Part 160 and Part 164, Subparts A and C. Breach Notification Rule means Subpart D.
• PHI means Protected Health Information we create, receive, maintain or transmit for you.
• Discovered, of a Breach, has the meaning at 45 CFR 164.410(a)(2): the first day on which we know of it, or would have known of it had we exercised reasonable diligence. Every clock in this agreement runs from that day, not from the day we finish investigating.

We may use and disclose PHI only to provide the service, as this agreement permits, as the Privacy Rule would permit you, or where the law requires it. Nothing else. We will not use or disclose PHI in a way that would breach the Privacy Rule if you did it yourself.

• We ask for and keep only the minimum necessary for the purpose, as 45 CFR 164.502(b) requires.
• We may use PHI for our own proper management and administration, and to carry out our legal responsibilities.
• We may disclose PHI for those purposes where the law requires it, or where the recipient agrees in writing to protect it, to use it only as we gave it to them, and to tell us of any breach of it.
• We may de-identify PHI under 45 CFR 164.514(b). Once de-identified it is no longer PHI. Tell us before you go live if you would rather we did not, and we will not.
• We may aggregate PHI to provide data aggregation services relating to your health care operations, as 45 CFR 164.504(e)(2)(i)(B) permits.
• We will not sell PHI, and we will not use or disclose it for marketing or fundraising.
• We will not use PHI to train artificial intelligence models, ours or anyone else’s.

Our service is built so that the content of your calls does not reach our systems. Call audio and transcripts stay with the voice provider that answers the call, under a Business Associate Agreement we hold with them.

What we record about a call is that it happened, how long it lasted, whether it fell inside your opening hours, what it achieved, and which of your own services it concerned. We do not receive the caller, their number, a transcript or a recording.

• Written summaries of calls are not stored for healthcare customers. The feature cannot be enabled for you, by you or by us.
• If we ever change what the service holds, we will tell you in writing before the change takes effect, and this agreement continues to govern whatever we do hold.

We implement administrative, physical and technical safeguards that reasonably and appropriately protect the confidentiality, integrity and availability of any electronic PHI we create, receive, maintain or transmit for you, and we comply with the Security Rule with respect to it.

• Access is limited to the people who need it to run the service, and removed when they no longer do.
• Data is encrypted in transit and at rest.
• Our workforce is trained on the handling of PHI, and bound to confidentiality.
• We review these safeguards at least once a year, and will summarise that review for you on reasonable request.

We use subcontractors to deliver the service, including the voice provider that answers your calls. Before any subcontractor creates, receives, maintains or transmits PHI for us, it must agree in writing to restrictions and conditions at least as protective as those in this agreement, as 45 CFR 164.502(e)(1)(ii) requires.

• We will name our subcontractors that receive PHI on request, and keep that list current.
• Some subcontractors process data outside the United States. If your own rules require that PHI stay within the United States, tell us before we connect your phone, and we will tell you whether we can serve you.
• Our subcontractors may de-identify and aggregate PHI on the terms their own agreements permit.
• We remain responsible to you for what our subcontractors do with your PHI.

We will report to you any use or disclosure of PHI not permitted by this agreement, any Breach of Unsecured PHI, and any Security Incident involving PHI, without unreasonable delay and in any event within twenty business days of Discovery.

• The report will give what 45 CFR 164.410(c) requires, so far as we know it: what happened and when, the categories of PHI involved, who was affected or the number of individuals if we cannot yet name them, what we have done, and what we are doing to stop it happening again. Anything we learn later follows promptly.
• We will mitigate, so far as practicable, any harmful effect we know of, as 45 CFR 164.530(f) requires.
• You make the notifications to individuals, the Secretary and the media. We will give you the information you need to make them, and we will not notify an individual on your behalf unless you ask us to in writing.
• Routine unsuccessful attempts at unauthorised access, and routine network noise that reaches no PHI, are reported to you by this paragraph rather than one at a time. Nothing here excuses an incident that did reach PHI.

Twenty business days is the outside limit, not the plan. HIPAA gives you sixty calendar days from Discovery to notify individuals, and this window is set so that most of it is still yours.

Where PHI we hold forms part of a Designated Record Set, we will help you meet requests to access it under 45 CFR 164.524, to amend it under 164.526, and to account for disclosures under 164.528. We will respond to you within ten business days of your request.

We will not answer an individual directly unless you tell us to in writing or the law requires it. A request that reaches us is forwarded to you promptly.

Tell us of any restriction you agree under 45 CFR 164.522, any request for confidential communications, and any change or withdrawal of an authorisation, where it affects what we may do. We will honour it from the day you tell us.

• Give us your notice of privacy practices, and tell us if anything in it limits how we may use or disclose PHI.
• Only disclose PHI to us in a way HIPAA permits, and only what the service needs.
• Do not ask us to use or disclose PHI in a way that would breach HIPAA if you did it yourself, except where this agreement expressly permits it for our own management or legal obligations.
• Decide whether your calls are recorded, and meet the notice and consent rules that apply where you and your callers are. Several states require every party to consent.
• Keep the contact details on your account current. A breach report goes to the email on the account.

We will make our internal practices, books and records relating to the use and disclosure of PHI available to the Secretary of Health and Human Services for the purpose of determining your compliance with the Privacy Rule.

On reasonable written notice, and not more than once a year unless there has been a Breach, we will make available to you the parts of those records that relate to your PHI. We may withhold anything that would expose another customer’s information, our security measures in a way that weakens them, or information we are not free to share.

Where we carry out an obligation of yours under the Privacy Rule, we will meet the requirements that apply to you in doing it.

Each of us is responsible for our own failure to meet this agreement, and neither of us is responsible for the other’s.

• We will cover the direct costs you reasonably incur to investigate, notify and remediate a Breach of Unsecured PHI to the extent it was caused by our failure to meet this agreement or by our negligence. That includes the cost of the notifications HIPAA requires you to make because of it.
• You will cover the same where the cause was yours, including PHI you sent us that you had no right to send.
• Neither of us owes the other indirect, consequential or punitive damages, or lost profits, arising out of this agreement.
• Any overall cap on liability in our services agreement applies to this agreement too, except to a liability that cannot be capped by law, and except to civil money penalties imposed on one of us because of the other’s conduct.

This section is the one your own counsel will want to read. It is a fair starting position rather than a take-it-or-leave-it one, and we will discuss changes to it before you accept.

This agreement starts when you accept it and runs until every obligation in it is met or your service with us ends, whichever is later.

• Either of us may end it if the other materially breaches it and does not cure that breach within thirty days of being told about it. You may end the underlying service at the same time.
• If a cure is not possible, the other may end it immediately.
• When it ends, we will return or destroy all PHI we hold, at your direction, and keep no copies. We will confirm in writing when that is done.
• If returning or destroying some of it is not feasible, we will tell you why, limit further use and disclosure to the purposes that make it infeasible, and this agreement keeps applying to whatever we still hold, for as long as we hold it.
• You may ask us to delete your data at any time, and we do not charge to do it.

• Where this agreement and any other agreement between us conflict on the handling of PHI, this one governs.
• Anything ambiguous in this agreement is read in the way that allows both of us to comply with HIPAA.
• HIPAA is a floor, not a ceiling. Where the law of your state protects health information more strictly, we will meet that too, once you have told us it applies.
• We will both agree to any amendment needed to keep this compliant with HIPAA as it changes. If either of us cannot, the other may end this agreement on thirty days notice.
• Neither of us may assign this agreement without the other’s consent, except that either may assign it to a successor of substantially the whole of its business, who is bound by it.
• This agreement is for the two of us. It gives no rights to anyone else, including the individuals whose PHI it covers.
• Sections on uses, safeguards, breach, records, liability and termination survive the end of this agreement for as long as we hold any PHI.
• Governed by the laws of the State of Wyoming, without regard to conflict of law rules, except where HIPAA or the law of your state applies of its own force.
• If any part of this is unenforceable, the rest stands.
• Notices to us go to legal@leadboostersai.com. Notices to you go to the email on your account.

Accepting this electronically binds your business exactly as a handwritten signature would. We record who accepted, when, and which version, and you can read the version you accepted at any time from your dashboard.