Business Associate Agreement

This Business Associate Agreement ("BAA") is entered into between the healthcare entity ("Covered Entity") and SignQuick ("Business Associate") pursuant to the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), as amended by the Health Information Technology for Economic and Clinical Health Act ("HITECH Act").

Protected Health Information (PHI) refers to individually identifiable health information transmitted or maintained in any form, including electronic PHI (ePHI), that is created, received, maintained, or transmitted by SignQuick on behalf of the Covered Entity.

Business Associate means SignQuick, which creates, receives, maintains, or transmits PHI on behalf of the Covered Entity for the purpose of electronic document signing and storage.

SignQuick agrees to:

• Not use or disclose PHI other than as permitted by this Agreement or as required by law
• Implement appropriate administrative, physical, and technical safeguards to prevent unauthorized use or disclosure of PHI
• Report to Covered Entity any use or disclosure of PHI not provided for by this Agreement, including any Security Incident or Breach
• Ensure that any subcontractors that create, receive, maintain, or transmit PHI agree to the same restrictions and conditions
• Make PHI available to Covered Entity as necessary to satisfy obligations under HIPAA Privacy Rule
• Make internal practices, records, and books relating to the use and disclosure of PHI available to the Secretary of HHS

SignQuick shall make PHI maintained in a Designated Record Set available to Covered Entity for inspection and copying within 15 business days of a request, to enable Covered Entity to fulfill its obligations under 45 CFR 164.524.

SignQuick shall incorporate any amendments to PHI as directed by the Covered Entity pursuant to 45 CFR 164.526.

Upon termination of this Agreement, SignQuick shall return or destroy all PHI received from the Covered Entity, or created or received on behalf of the Covered Entity, within 30 days. If return or destruction is not feasible, SignQuick shall extend the protections of this Agreement to such PHI and limit further uses and disclosures.

The Covered Entity may terminate this Agreement if it determines that SignQuick has violated a material term. SignQuick shall be given 30 days to cure the violation before termination takes effect.