<div style="padding:0 15px;font-family:sans-serif;font-size: 15px;text-align:justify;">
	<h2><strong>
			<center><u>BUSINESS ASSOCIATE AGREEMENT</u></center>
		</strong></h2>

	<p style="line-height:30px;"><b>THIS BUSINESS ASSOCIATE AGREEMENT</b> (the <b>"Agreement"</b>) is entered into between {Your Legal Name}
		(<b>“Covered Entity”</b>), and <b>{company.name}</b> (<b>“Business Associate”</b>), which shall be deemed effective
		{company_pro_document.created_at}, (the <b>“Effective Date”</b>).</p>

	<p style="line-height:30px;"><b>WHEREAS</b>, the U.S. Department of Health and Human Services issued regulations on “Standards for Privacy of
		Individually Identifiable Health Information” comprising 45 C.F.R. Parts 160 and 164, Subparts A and E (the
		<b>“Privacy Standards”</b>), “Security Standards for the Protection of Electronic Protected Health Information”
		comprising 45 C.F.R. Parts 160 and 164, Subpart C (the <b>“Security Standards”</b>), “Standards for Notification
		in the Case of Breach of Unsecured Protected Health Information” comprising 45 C.F.R. Parts 160 and 164, Subpart
		D (the <b>“Breach Notification Standards”</b>), and “Rules for Compliance and Investigations, Impositions of
		Civil Monetary Penalties, and Procedures for Hearings” comprising 45 C.F.R. Part 160, Subparts C, D, and E (“the
		<b>“Enforcement Rule”</b>) promulgated pursuant to the Health Insurance Portability and Accountability Act of
		1996 (<b>“HIPAA”</b>), the Health Information Technology for Economic and Clinical Health Act (<b>“HITECH
			Act”</b>), and the Genetic Information and Nondiscrimination Act of 2008 (<b>“GINA”</b>) (the Privacy
		Standards, the Security Standards, the Breach Notification Standards, and the Enforcement Rule are collectively
		referred to herein as the <b>“HIPAA Standards”</b>).</p>
	<p style="line-height:30px;"><b>WHEREAS</b>, in conformity with the HIPAA Standards, Business Associate has, and/or will create, receive,
		maintain, or transmit certain Protected Health Information (<b>“PHI”</b>) pursuant to the HCP Engagement Agreement (the
		<b>“Services Agreement”</b>).</p>
	<p style="line-height:30px;"><b>WHEREAS</b>, Covered Entity is required by the HIPAA Standards to obtain satisfactory assurances that Business
		Associate will appropriately safeguard all PHI created, received, maintained, or transmitted by Business
		Associate on behalf of Covered Entity.</p>
	<p style="line-height:30px;"><b>WHEREAS</b>, the parties hereto desire to enter into this Agreement to memorialize their obligations with
		respect to PHI pursuant to the requirements of the HIPAA Standards.</p>
	<p style="line-height:30px;"><b>NOW, THEREFORE</b>, Covered Entity and Business Associate agree as follows: </p>

	<p style="line-height:30px;"><u>Section 1. Definitions</u>. Except as otherwise specified herein, capitalized terms used but not defined in
		this Agreement shall have the same meaning as those terms in 45 C.F.R. Parts 160 and 164.</p>
	<ol style="list-style:lower-alpha">
		<li style="margin-bottom:10px;">
			<p style="line-height:30px;"><u>Breach</u>, as used in Section 2 of this Agreement, means the unauthorized acquisition, access, use,
				or disclosure of PHI which compromises the security or privacy of such information.</p>
		</li>
		<li style="margin-bottom:10px;">
			<p style="line-height:30px;"><u>C.F.R</u>. means the Code of Federal Regulations.</p>
		</li>
		<li style="margin-bottom:10px;">
			<p style="line-height:30px;"><u>ePHI</u> means any PHI that is received, maintained, transmitted or utilized for any purpose in
				electronic form by Business Associate on behalf of Covered Entity.</p>
		</li>
		<li style="margin-bottom:10px;">
			<p style="line-height:30px;"><u>GINA</u> means the Genetic Information and Nondiscrimination Act of 2008 (P.L. 110-233) and the
				regulations promulgated thereunder. </p>
		</li>
		<li style="margin-bottom:10px;">
			<p style="line-height:30px;"><u>HIPAA</u> means the Health Insurance Portability and Accountability Act of 1996 (P.L. 104-91) and any
				successor statutes, rules and regulations.</p>
		</li>
		<li style="margin-bottom:10px;">
			<p style="line-height:30px;"><u>HITECH Act</u> means the American Recovery and Reinvestment Act of 2009 (P.L. 111-5), Div. A, Title
				XIII and Div. B, Title IV, the Health Information Technology for Economic and Clinical Health Act and
				the regulations promulgated thereunder. </p>
		</li>
		<li style="margin-bottom:10px;">
			<p style="line-height:30px;"><u>Individual</u> has the same meaning as the term “individual” in 45 C.F.R. § 160.103 and shall include
				a person who qualifies as personal representative in accordance with 45 C.F.R. § 164.502(g). </p>
		</li>
		<li style="margin-bottom:10px;">
			<p style="line-height:30px;"><u>Protected Health Information</u> (<b>“PHI”</b>) has the same meaning as the term “protected health
				information” as defined in 45 C.F.R. § 160.103, which generally includes all Individually Identifiable
				Health Information regardless of form; limited, however, to the information that Business Associate
				creates, receives, maintains, or transmits on behalf of Covered Entity. PHI excludes Individually
				Identifiable Health Information regarding a person who has been deceased for more than fifty (50) years.
			</p>
		</li>
		<li style="margin-bottom:10px;">
			<p style="line-height:30px;"><u>Required by Law</u> has the same meaning as the term “required by law” in 45 C.F.R. § 164.103.</p>
		</li>
		<li style="margin-bottom:10px;">
			<p style="line-height:30px;"><u>Secretary</u> means the Secretary of the United States Department of Health and Human Services or
				his/her designee.</p>
		</li>
		<li style="margin-bottom:10px;">
			<p style="line-height:30px;"><u>Security Incident</u> means the attempted or successful unauthorized access, use, disclosure,
				modification, or destruction of information or interference with system operations in an information
				system.</p>
		</li>
		<li style="margin-bottom:10px;">
			<p style="line-height:30px;"><u>Standard Transaction</u> means a transaction that complies with an applicable standard adopted under
				45 C.F.R. Part 162.</p>
		</li>
	</ol>

	<p style="line-height:30px;"><u>Section 2. Obligations and Activities of Business Associate.</u></p>
	<ol style="list-style:lower-alpha">
		<li style="margin-bottom:10px;">
			<p style="line-height:30px;">Business Associate agrees to not use or further disclose PHI other than as permitted or required by this
				Agreement or as Required by Law. Business Associate shall also comply with any further limitations on
				uses and disclosures of PHI by Covered Entity in accordance with 45 C.F.R. § 164.522, provided that
				Covered Entity communicates such limitations to Business Associate. </p>
		</li>
		<li style="margin-bottom:10px;">
			<p style="line-height:30px;">Business Associate agrees to use appropriate safeguards to prevent use or disclosure of PHI other than as
				provided for by this Agreement. </p>
		</li>
		<li style="margin-bottom:10px;">
			<p style="line-height:30px;">Business Associate shall use appropriate safeguards and comply with 45 C.F.R. Part 164, Subpart C with
				respect to ePHI that it creates, receives, maintains or transmits on behalf of Covered Entity. </p>
		</li>
		<li style="margin-bottom:10px;">
			<p style="line-height:30px;">Business Associate agrees to report immediately to Covered Entity any use or disclosure of PHI not
				provided for by this Agreement of which Business Associate becomes aware. Additionally, Business
				Associate shall report immediately to Covered Entity any Security Incident of which Business Associate
				becomes aware. At the request of Covered Entity, Business Associate shall identify the date, nature, and
				scope of the Security Incident, Business Associate’s response to the Security Incident, and the
				identification of the party responsible for causing the Security Incident, if known.</p>
		</li>
		<li style="margin-bottom:10px;">
			<p style="line-height:30px;">Business Associate shall notify Covered Entity immediately, upon discovery of any Breach of Unsecured
				Protected Health Information. Without undue delay and within seven (7) days, Business Associate shall
				provide such information to Covered Entity as required by the Breach Notification Standards. Business
				Associate shall cooperate and assist Covered Entity at no cost to Covered Entity in making the
				notification to third parties Required by Law in the event of a Breach due to Business Associate. In
				addition, Business Associate shall reimburse Covered Entity for any reasonable expenses Covered Entity
				incurs in mitigating harm to those Individuals. Business Associate shall also defend, hold harmless and
				indemnify Covered Entity and its employees, agents, officers, directors, shareholders, members,
				contractors, parents, and subsidiary and affiliate entities from and against any claims, losses,
				obligations, including attorney’s fees, which Covered Entity may incur due to a Breach caused by
				Business Associate or Business Associate’s subcontractors or agents. </p>
		</li>
		<li style="margin-bottom:10px;">
			<p style="line-height:30px;">Business Associate shall obtain and maintain an agreement with each agent or subcontractor that creates,
				receives, maintains, or transmits Covered Entity’s PHI on behalf of Business Associate. Under the
				agreement, such agent or subcontractor shall agree to the same restrictions and conditions that apply to
				Business Associate pursuant to this Agreement with respect to such PHI. </p>
		</li>
		<li style="margin-bottom:10px;">
			<p style="line-height:30px;">Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to
				Business Associate of a use or disclosure of PHI by Business Associate in violation of the requirements
				of this Agreement or the HIPAA Standards. </p>
		</li>
		<li style="margin-bottom:10px;">
			<p style="line-height:30px;">Upon request of Covered Entity, Business Associate agrees to provide access to PHI in a Designated Record
				Set, as defined in 45 C.F.R. § 164.501, to an Individual in order for Covered Entity to comply with the
				requirements under 45 C.F.R. § 164.524. Further, if the PHI that is the subject of a request for access
				is maintained in one or more Designated Record Sets electronically and if the Individual requests an
				electronic copy of such information, Business Associate shall provide access to the PHI in the
				electronic form and format requested, if it is readily producible in such form and format; or, if not,
				in a readable electronic form and format as agreed to by Covered Entity and the Individual. Business
				Associate further agrees to make available PHI for amendment and incorporate any amendments to PHI in a
				Designated Record Set in order for Covered Entity to comply with 45 C.F.R. § 164.526. If Business
				Associate provides copies or summaries of PHI to an Individual, it may impose a reasonable, cost-based
				fee in accordance with 45 C.F.R. § 164.524(c)(4), provided that the fee includes only the cost of labor
				for copying the PHI requested by the Individual, whether in paper or electronic form, and supplies for
				creating the paper copy or electronic media if the Individual requests that the electronic copy be
				provided on portable media. </p>
		</li>
		<li style="margin-bottom:10px;">
			<p style="line-height:30px;">Business Associate agrees to make its internal practices, books, and records, including policies and
				procedures and PHI relating to the use and disclosure of PHI received from, or created or received by
				Business Associate on behalf of Covered Entity, available to Covered Entity, or at the request of the
				Secretary, for purposes of the Secretary determining Covered Entity's compliance with the Privacy
				Standards. In the event Business Associate receives a request from the Secretary, or any agency on
				behalf of the Secretary, Business Associate shall immediately notify Covered Entity. </p>
		</li>
		<li style="margin-bottom:10px;">
			<p style="line-height:30px;">Business Associate agrees to document those disclosures of PHI, and information related to such
				disclosures, as required to respond to a request by an Individual for an accounting of disclosures of
				PHI in accordance with 45 C.F.R. § 164.528 and the HITECH Act. Business Associate further agrees to
				provide Covered Entity such information upon request to permit Covered Entity to respond to a request by
				an Individual for an accounting of disclosures of PHI, in accordance with 45 C.F.R. § 164.528, or, if
				required by the HITECH Act, to provide an Individual an accounting of disclosures of PHI upon request
				made by the Individual directly to Business Associate. </p>
		</li>
		<li style="margin-bottom:10px;">
			<p style="line-height:30px;">In the event that Covered Entity uses or maintains an electronic health record with respect to PHI,
				Business Associate shall provide an accounting of disclosures of such PHI to an Individual during the
				three (3) years prior to the date of the request within sixty (60) days after Business Associate’s
				receipt of such a request.</p>
		</li>
		<li style="margin-bottom:10px;">
			<p style="line-height:30px;">Business Associate acknowledges that it shall limit the use, disclosure or request of PHI to perform or
				fulfill a specific function required or permitted hereunder to the Minimum Necessary, as defined by
				HIPAA Standards and relevant guidance, to accomplish the intended purpose of such use, disclosure or
				request.</p>
		</li>
		<li style="margin-bottom:10px;">
			<p style="line-height:30px;">If Business Associate conducts any Standard Transactions on behalf of Covered Entity, Business Associate
				shall comply with the applicable requirements of 45 C.F.R. Part 162. </p>
		</li>
		<li style="margin-bottom:10px;">
			<p style="line-height:30px;">If Business Associate agrees to carry out an obligation of Covered Entity under 45 C.F.R. Part 164,
				Subpart E, Business Associate shall comply with the requirements of 45 C.F.R. Part 164, Subpart E that
				apply to Covered Entity in the performance of such obligations. </p>
		</li>
		<li style="margin-bottom:10px;">
			<p style="line-height:30px;">Except as otherwise permitted by law, Business Associate shall not directly or indirectly receive
				remuneration in exchange for a disclosure of PHI without the Individual’s authorization.</p>
		</li>
	</ol>

	<p style="line-height:30px;"><u>Section 3. Permitted Uses and Disclosures of PHI by Business Associate.</u></p>
	<ol style="list-style:lower-alpha">
		<li style="margin-bottom:10px;">
			<p style="line-height:30px;"><u>General Use and Disclosure Provisions</u>. Except as otherwise limited in this Agreement, Business
				Associate may use or disclose PHI to perform functions, activities, or services for, or on behalf of,
				Covered Entity pursuant to the Services Agreement between the parties, provided that such use or
				disclosure would not violate the Privacy Standards if done by Covered Entity.</p>
		</li>
		<li style="margin-bottom:10px;">
			<p style="line-height:30px;"><u>Specific Use and Disclosure Provisions.</u></p>
			<ol>
				<li style="margin-bottom:10px;">
					<p style="line-height:30px;">Except as otherwise limited in this Agreement, Business Associate may use PHI for the proper
						management and administration of Business Associate, or to carry out the legal responsibilities
						of Business Associate. Except as otherwise limited in this Agreement, Business Associate may
						disclose PHI (i) for the proper management and administration of Business Associate, or (ii) to
						carry out Business Associate’s legal responsibilities if (a) the disclosure is Required by Law,
						or (b) Business Associate obtains reasonable assurances from the person to whom the information
						is disclosed that the information will remain confidential and used or further disclosed only as
						Required by Law or for the purpose for which it was disclosed to the person, and the person
						notifies Business Associate of any instances of which it is aware in which the confidentiality
						of the information has been breached. </p>
				</li>
				<li style="margin-bottom:10px;">
					<p style="line-height:30px;">Except as otherwise limited in this Agreement, Business Associate may use PHI to provide Data
						Aggregation services to Covered Entity as permitted by 45 C.F.R. § 164.504(e)(2)(i)(B).</p>
				</li>
			</ol>
		</li>
	</ol>

	<p style="line-height:30px;"><u>Section 4. Term and Termination.</u></p>
	<ol style="list-style:lower-alpha">
		<li style="margin-bottom:10px;">
			<p style="line-height:30px;"><u>Term</u>. The provisions of this Agreement shall commence on the Effective Date and, unless earlier
				terminated in accordance with the provisions of this Section, shall terminate when all of the PHI
				provided by Covered Entity to Business Associate, or created or received by Business Associate on behalf
				of Covered Entity, is destroyed or returned to Covered Entity.</p>
		</li>
		<li style="margin-bottom:10px;">
			<p style="line-height:30px;"><u>Termination for Cause</u>. Without limiting the termination rights of the parties pursuant to this
				Agreement and upon Covered Entity’s knowledge of a material breach of this Agreement by Business
				Associate, Covered Entity shall either:</p>
			<ol>
				<li style="margin-bottom:10px;">
					<p style="line-height:30px;">Provide an opportunity for Business Associate to cure the breach or end the violation and, if
						Business Associate does not cure the breach or end the violation within the time specified by
						Covered Entity, terminate this Agreement, if feasible; or</p>
				</li>
				<li style="margin-bottom:10px;">
					<p style="line-height:30px;">Immediately terminate this Agreement if cure is not possible, if feasible.</p></li>
			</ol>
		</li>
		<li style="margin-bottom:10px;">
			<p style="line-height:30px;"><u>Effect of Termination.</u></p>
			<ol>
				<li style="margin-bottom:10px;">
					<p style="line-height:30px;">Except as provided in paragraph (2) of this Section 4(c), upon termination of this Agreement for
						any reason, Business Associate shall promptly return or destroy all PHI received from, or
						created or received by Business Associate on behalf of, Covered Entity that Business Associate
						maintains in any form and retain no copies. This provision shall apply to PHI that is in the
						possession of subcontractors or agents of Business Associate. </p>
				</li>
				<li style="margin-bottom:10px;">
					<p style="line-height:30px;">In the event that Business Associate reasonably believes that returning or destroying the PHI is
						infeasible, Business Associate shall provide to Covered Entity prompt notification of the
						conditions that make return or destruction infeasible. Upon mutual agreement of the parties that
						return or destruction of PHI is infeasible, Business Associate shall extend the protections of
						this Agreement to such PHI and limit further uses and disclosures of such PHI to those purposes
						that make the return or destruction infeasible, for so long as Business Associate maintains such
						PHI.</p>
				</li>
			</ol>
		</li>
	</ol>

	<p style="line-height:30px;"><u>Section 5. Notices</u>. Any notices or communications to be given pursuant to this Agreement shall be made to
		the addresses given below:</p>
	<p style="line-height:30px;">If to Business Associate, to: <br>
		{company.name}
		<br>
		133 Rollins Ave, STE 3, Rockville, MD 20852
	</p>
	<p style="line-height:30px;">If to Covered Entity, to: <br>
		{Your Legal Name}
		<br>
		{Your Mailing Address}
	</p>

	<p style="line-height:30px;"><u>Section 6. Miscellaneous.</u></p>
	<ol>
		<li style="margin-bottom:10px;">
			<p style="line-height:30px;"><u>Regulatory References.</u> A reference in this Agreement to a section in the HIPAA Standards means the
				section then in effect.</p>
		</li>
		<li style="margin-bottom:10px;">
			<p style="line-height:30px;"><u>Amendment.</u> The parties agree to take such action as may be necessary to amend this Agreement from
				time to time to ensure the parties comply with the requirements of the HIPAA Standards and any other
				applicable law or regulation. Any amendment to this Agreement proposed by either party shall not be
				effective unless mutually agreed to in writing by both parties. </p>
		</li>
		<li style="margin-bottom:10px;">
			<p style="line-height:30px;"><u>Survival.</u> The respective rights and obligations of Business Associate under Section 4(c) of this
				Agreement shall survive the termination of this Agreement.</p>
		</li>
		<li style="margin-bottom:10px;">
			<p style="line-height:30px;"><u>Interpretation.</u> Any ambiguity in this Agreement shall be resolved to permit the parties to comply
				with the HIPAA Standards. In the event of any inconsistency or conflict between this Agreement and the
				Services Agreement, the terms and conditions of this Agreement shall govern and control.</p>
		</li>
		<li style="margin-bottom:10px;">
			<p style="line-height:30px;"><u>No Third Party Beneficiary.</u> Nothing express or implied in this Agreement or in the Services
				Agreement is intended to confer, nor shall anything herein confer, upon any person other than the
				parties and the respective successors or assigns of the parties, any rights, remedies, obligations, or
				liabilities whatsoever. </p>
		</li>
		<li style="margin-bottom:10px;">
			<p style="line-height:30px;"><u>Governing Law.</u> This Agreement shall be governed by and construed in accordance with the internal
				laws of Maryland, without giving effect to its conflict of laws provisions.</p>
		</li>
		<li style="margin-bottom:10px;">
			<p style="line-height:30px;"><u>Multiple Counterparts.</u> This Agreement may be executed in multiple counterparts all of which shall
				be considered an original Agreement.</p>
		</li>
	</ol>
	<br>
	<br>
	<p style="text-align: center"><b>IN WITNESS WHEREOF</b>, the parties hereto have executed this Agreement as of the
		Effective Date.</p>
	<br>

	<table style="page-break-before: always;" border="0" cellpadding="5" width="100%">
		<tr>
			<td width="50%"><b>COVERED ENTITY</b></td>
			<td width="50%"><b>BUSINESS ASSOCIATE</b></td>
		</tr>
		<tr>
			<td colspan="2"></td>
		</tr>
		<tr>
            <td width="50%">
                <div>
                    <p style="margin-bottom:4px;">By:</p> <img src="{*company.authorized_signer_signature_base64}" style="max-height: 60px" onerror="this.style.display = 'none'">
                </div>
            </td>
            <td width="50%">
				<div>
					<p style="margin-bottom:4px;">By:</p> <img src="{company_pro_document.pro_signatures}" style="max-height: 60px">
				</div>
			</td>
		</tr>
		<tr>
            <td width="50%">Name: {*company.authorized_signer_name}</td>
            <td width="50%">Name: {Your Legal Name}</td>
		</tr>
		<tr>
            <td width="50%">Title: {*company.authorized_signer_title}</td>
            <td width="50%">Title: {Your Title / Credential}</td>
		</tr>
		<tr>
            <td width="50%">Date: {*company_pro_document.hrm_pro_counter_signed_at}</td>
            <td width="50%">Date: {company_pro_document.pro_signed_at}</td>
		</tr>
	</table>

</div>
