1. Parties and acceptance

This Business Associate Agreement (the “Agreement”) is between [Your practice] (the “Covered Entity”) and SpeakSOAP LLC (“SpeakSOAP”). It supplements SpeakSOAP’s Terms of Service (the “Service Agreement”) and applies whenever SpeakSOAP creates, receives, maintains or transmits Protected Health Information for the Covered Entity.

The person accepting this Agreement for the Covered Entity confirms that they are authorized to bind the Covered Entity. Acceptance by electronic signature in the SpeakSOAP application is a signature for all purposes. This Agreement takes effect when it is accepted (the “Effective Date”).

2. Definitions

Capitalized terms used but not defined in this Agreement have the meanings given in the HIPAA Rules, including Breach, Designated Record Set, Disclosure, Individual, Minimum Necessary, Notice of Privacy Practices, Required By Law, Secretary, Security Incident, Subcontractor, Unsecured Protected Health Information and Use.

(a) “HIPAA Rules” means the Privacy, Security, Breach Notification and Enforcement Rules at 45 C.F.R. Parts 160 and 164, as amended.

(b) “Protected Health Information” or “PHI” has the meaning given in 45 C.F.R. 160.103, limited to information SpeakSOAP creates, receives, maintains or transmits for the Covered Entity. It includes electronic PHI.

(c) “Services” means the SpeakSOAP application and related services described in the Service Agreement.

(d) “Unsuccessful Security Incident” means an attempted Security Incident that does not result in unauthorized access, use, disclosure, modification or destruction of PHI or interference with system operations, such as pings and other broadcast attacks on a firewall, port scans, denial-of-service attempts, unsuccessful sign-in attempts, and interception of encrypted data where the key is not compromised.

3. Permitted uses and disclosures

(a) SpeakSOAP may use and disclose PHI only to provide the Services to the Covered Entity under the Service Agreement and this Agreement, or as Required By Law. The Services include recording and transcribing visits, live video visits with their transcription and chat, drafting clinical notes, home exercise programs and billing documents for the Covered Entity to review, scheduling and online booking, the patient portal and its messages, invoices and payments for a Covered Entity that takes patient payments through the Services, and storing, printing and exporting the Covered Entity’s records. The Services also include reports on how the Covered Entity uses the Services, for the Covered Entity and for the SpeakSOAP workforce members who support its account. These reports give counts, such as of patients, notes, visits and patient portal activity, and do not identify any Individual.

(b) SpeakSOAP may use PHI for its proper management and administration or to carry out its legal responsibilities. It may disclose PHI for those purposes only if the disclosure is Required By Law, or if SpeakSOAP first obtains reasonable written assurances from the recipient that the PHI will be held confidentially, used or further disclosed only as Required By Law or for the purpose for which it was disclosed, and that the recipient will notify SpeakSOAP of any instance it becomes aware of in which the confidentiality of the PHI has been breached.

(c) SpeakSOAP will limit its uses and disclosures of, and requests for, PHI to the Minimum Necessary, consistent with any minimum necessary policies the Covered Entity gives SpeakSOAP.

(d) SpeakSOAP will not use or disclose PHI in any manner that would violate Subpart E of 45 C.F.R. Part 164 if done by the Covered Entity, except for the uses and disclosures in paragraph (b).

(e) To the extent SpeakSOAP carries out any of the Covered Entity’s obligations under Subpart E of 45 C.F.R. Part 164, SpeakSOAP will comply with the requirements of Subpart E that apply to the Covered Entity in carrying out those obligations.

4. Restrictions

(a) SpeakSOAP will not sell PHI, use or disclose PHI for marketing or fundraising, or receive any payment in exchange for PHI.

(b) SpeakSOAP will not use PHI to train, fine-tune or otherwise improve artificial intelligence models, whether its own or a vendor’s. SpeakSOAP will use artificial intelligence and speech-recognition providers only under business associate agreements that do not allow them to use PHI to train their models.

(c) SpeakSOAP will not de-identify PHI for its own purposes and will not attempt to re-identify any Individual.

5. Safeguards

(a) SpeakSOAP will use appropriate administrative, physical and technical safeguards, and comply with Subpart C of 45 C.F.R. Part 164 with respect to electronic PHI, to prevent use or disclosure of PHI other than as this Agreement provides.

(b) These safeguards include encrypting PHI in transit and at rest, limiting access to PHI to workforce members who need it to provide the Services, requiring the Covered Entity’s staff to confirm a new device with a code sent to their email or with a passkey, locking sign-in after repeated failed attempts, logging access to PHI in the Services and keeping those logs in storage that cannot be altered or deleted, monitoring SpeakSOAP’s systems for security threats, and training SpeakSOAP’s workforce on the HIPAA Rules.

(c) SpeakSOAP will keep a current written risk analysis and security policies, and will give the Covered Entity a written summary of its safeguards on reasonable request, no more than once every twelve (12) months.

6. Reporting

(a) SpeakSOAP will report to the Covered Entity any use or disclosure of PHI not provided for by this Agreement, and any Security Incident, of which it becomes aware, without unreasonable delay and no later than ten (10) days after discovery, or any shorter period applicable law requires.

(b) SpeakSOAP will notify the Covered Entity of any Breach of Unsecured PHI as required by 45 C.F.R. 164.410, without unreasonable delay and no later than ten (10) days after discovery or any shorter period applicable law requires, except where a law enforcement official requires a delay under 45 C.F.R. 164.412. A Breach is treated as discovered as provided in 45 C.F.R. 164.410(a)(2). The notice will include, to the extent known, the identification of each Individual whose Unsecured PHI has been, or is reasonably believed to have been, accessed, acquired, used or disclosed, and any other information the Covered Entity needs to notify Individuals under 45 C.F.R. 164.404(c). SpeakSOAP will supplement the notice as more information becomes available.

(c) This paragraph is notice of the ongoing existence of Unsuccessful Security Incidents, for which no further notice will be given.

(d) SpeakSOAP will mitigate, to the extent practicable, any harmful effect known to it of a use or disclosure of PHI in violation of this Agreement, and will cooperate with the Covered Entity’s investigation of, and notifications about, any Breach.

7. Subcontractors

(a) In accordance with 45 C.F.R. 164.502(e)(1)(ii) and 164.308(b)(2), SpeakSOAP will ensure that any Subcontractor that creates, receives, maintains or transmits PHI on its behalf agrees in writing to the same restrictions, conditions and requirements that apply to SpeakSOAP under this Agreement, including compliance with Subpart C of 45 C.F.R. Part 164.

(b) SpeakSOAP’s Subcontractors on the Effective Date are Amazon Web Services (hosting, storage, database, sign-in, video visits, speech transcription and artificial intelligence), Microsoft (Azure OpenAI, for drafting and the other artificial intelligence features of the Services) and Google (Google Workspace, for email). SpeakSOAP will add a Subcontractor that handles PHI only through a new version of this Agreement under Section 11. Payment processors acting within 42 U.S.C. 1320d-8, such as Stripe for a Covered Entity that takes patient payments through the Services, are not Subcontractors.

8. Individuals’ rights

(a) Access. The Services let the Covered Entity view, print and export the PHI SpeakSOAP maintains for it, and send an Individual a copy of their own records, to the Individual’s portal or by a link that asks for their date of birth. This is how SpeakSOAP makes PHI in a Designated Record Set available for the Covered Entity to meet 45 C.F.R. 164.524. If the Covered Entity cannot obtain PHI it needs through the Services, SpeakSOAP will provide it within ten (10) business days of a written request.

(b) Amendment. The Services let the Covered Entity amend PHI, including by addendum to a signed note. SpeakSOAP will make any other amendment the Covered Entity directs under 45 C.F.R. 164.526 within ten (10) business days of a written request.

(c) Accounting. SpeakSOAP will document the disclosures of PHI that 45 C.F.R. 164.528 requires to be accounted for, and will give that information to the Covered Entity within ten (10) business days of a written request.

(d) Requests to SpeakSOAP. If an Individual asks SpeakSOAP directly for access, amendment or an accounting, SpeakSOAP will forward the request to the Covered Entity within five (5) business days and will not respond itself unless Required By Law or directed by the Covered Entity.

(e) Restrictions. SpeakSOAP will comply with any restriction or confidential communication the Covered Entity has agreed to under 45 C.F.R. 164.522, to the extent the Covered Entity notifies SpeakSOAP of it.

9. The Covered Entity’s responsibilities

(a) The Covered Entity will notify SpeakSOAP of any limitation in its Notice of Privacy Practices, any change in or revocation of an Individual’s permission to use or disclose PHI, and any restriction it has agreed to, to the extent it may affect SpeakSOAP’s use or disclosure of PHI.

(b) The Covered Entity will not ask SpeakSOAP to use or disclose PHI in any manner that would not be permitted under Subpart E of 45 C.F.R. Part 164 if done by the Covered Entity, except as paragraph 3(b) allows.

(c) The Covered Entity will obtain any consent or authorization that law requires for its use of the Services, including any consent federal or state law requires before a visit is recorded, and will give Individuals any notice that law requires.

(d) The Covered Entity will give access to the Services only to workforce members who need it, remove access promptly when someone no longer needs it, and require its users to keep their sign-in credentials secret.

(e) The Covered Entity will not enter records protected by 42 C.F.R. Part 2 into the Services unless SpeakSOAP agrees in writing.

10. Access by the Secretary

SpeakSOAP will make its internal practices, books and records relating to the use and disclosure of PHI available to the Secretary for purposes of determining compliance with the HIPAA Rules.

11. Changes to this Agreement

(a) SpeakSOAP may publish a new version of this Agreement in the Services with at least thirty (30) days’ notice to the Covered Entity’s administrators. Each version says what changed.

(b) A version marked optional applies to the Covered Entity once accepted. Until then, the version the Covered Entity last accepted continues to apply.

(c) A version marked required, such as one made necessary by a change in law or a new Subcontractor, must be accepted by the deadline shown in the Services, which will be at least thirty (30) days after it is published. If it is not accepted by then, the Services become read-only for the Covered Entity until it is accepted: the Covered Entity can still view and export its records, but no PHI can be added or changed.

(d) If a required version is still not accepted sixty (60) days after its deadline, this Agreement and the Covered Entity’s use of the Services end, and Section 13 applies.

(e) The Covered Entity may instead stop using the Services at any time and export its records under Section 13.

(f) The parties will amend this Agreement as needed for either party to comply with changes to the HIPAA Rules. A version accepted later replaces earlier versions from the moment it is accepted.

12. Term and termination

(a) This Agreement starts on the Effective Date and continues until the Service Agreement ends and all PHI has been returned or destroyed under Section 13.

(b) If the Covered Entity determines that SpeakSOAP has violated a material term of this Agreement, it may give SpeakSOAP written notice and, if SpeakSOAP does not cure the violation within thirty (30) days, terminate this Agreement and the Service Agreement.

(c) If SpeakSOAP determines that the Covered Entity has violated a material term of this Agreement, it may give the Covered Entity written notice and, if the Covered Entity does not cure the violation within thirty (30) days, terminate this Agreement and the Service Agreement.

(d) This Agreement also ends as described in Section 11(d).

13. Return and destruction of PHI

(a) The Covered Entity’s administrators can export the Covered Entity’s records from the Services at any time until they are destroyed under paragraph (b), including while the Services are read-only and after this Agreement ends.

(b) Thirty (30) days after this Agreement ends, SpeakSOAP will destroy all PHI it maintains for the Covered Entity and will require its Subcontractors to do the same. Copies in backups and earlier versions of stored files are destroyed as they expire, within ninety (90) days, and remain protected by this Agreement until then.

(c) Where returning or destroying PHI is infeasible, including records SpeakSOAP must keep by law such as security audit logs, which SpeakSOAP keeps for seven (7) years in storage that cannot be altered or deleted, SpeakSOAP will extend the protections of this Agreement to that PHI and limit further uses and disclosures to the purposes that make return or destruction infeasible, for as long as it keeps the PHI.

14. General

(a) Regulatory references. A reference to a section of the HIPAA Rules means that section as in effect or as amended.

(b) Interpretation. Any ambiguity in this Agreement will be resolved to permit compliance with the HIPAA Rules.

(c) Conflicts. If this Agreement conflicts with the Service Agreement about PHI, this Agreement controls.

(d) No third-party beneficiaries. Nothing in this Agreement gives any right or remedy to anyone other than the parties.

(e) Relationship. SpeakSOAP is an independent contractor and not the Covered Entity’s agent.

(f) Governing law. This Agreement is governed by the laws of the State of Texas, except where federal law applies.

(g) Notices. Notices to SpeakSOAP go to hello@speaksoap.com. Notices to the Covered Entity go to its administrators’ email addresses in the Services and appear in the Services.

(h) Record of acceptance. SpeakSOAP keeps a record of each acceptance of this Agreement, showing who accepted it, when, from which IP address, the version, and a SHA-256 fingerprint of the text accepted, and makes a signed copy available to the Covered Entity in the Services.

(i) Survival. Sections 4, 6(d), 13 and 14 survive the end of this Agreement.