Business Associate Agreement

This Business Associate Agreement (the "Agreement") is between the health care provider that accepts it at sign-up ("Covered Entity") and Rivius Health ("Business Associate" or "Rivius"). It takes effect on the date Covered Entity accepts it (the "Effective Date").

It forms part of, and applies to, the Rivius Client Service Agreement between the parties (the "Service Agreement").

1. Definitions

Catch-all definition. The following terms used in this Agreement have the same meaning as those terms in the HIPAA Rules: Breach, Data Aggregation, Designated Record Set, Disclosure, Health Care Operations, Individual, Minimum Necessary, Notice of Privacy Practices, Protected Health Information, Required By Law, Secretary, Security Incident, Subcontractor, Unsecured Protected Health Information, and Use.

Specific definitions.

• (a) Business Associate. "Business Associate" has the same meaning as the term "business associate" at 45 CFR 160.103, and in reference to the party to this Agreement means Rivius Health.
• (b) Covered Entity. "Covered Entity" has the same meaning as the term "covered entity" at 45 CFR 160.103, and in reference to the party to this Agreement means the health care provider named in the sign-up record: Practice legal name · Client completes, TIN TIN · Client completes.
• (c) HIPAA Rules. "HIPAA Rules" means the Privacy, Security, Breach Notification, and Enforcement Rules at 45 CFR Part 160 and Part 164.
• (d) PHI. "PHI" means Protected Health Information that Business Associate creates, receives, maintains or transmits on behalf of Covered Entity. (Rivius adaptation.)

2. Obligations and activities of Business Associate

Business Associate agrees to:

(a) Not use or disclose PHI other than as permitted or required by this Agreement or as Required By Law.

(b) Use appropriate safeguards, and comply with Subpart C of 45 CFR Part 164 with respect to electronic PHI, to prevent use or disclosure of PHI other than as provided for by this Agreement.

Rivius adaptation: specific safeguards. Without limiting (b), Business Associate will:

• encrypt electronic PHI in transit and at rest;
• store electronic PHI only in data centres located in the United States, with a cloud provider that has signed a business associate agreement with Business Associate;
• limit access to PHI to named workforce members and Subcontractors who need it for the Services, using unique user accounts, multi-factor authentication and access logs;
• not permit access to PHI from outside the United States; and
• comply with the federal IDR portal's rules of behavior, including not entering PHI in portal fields and redacting PHI from uploaded documents except where the Federal IDR process requires it.

(c) Report to Covered Entity any use or disclosure of PHI not provided for by this Agreement of which it becomes aware, including Breaches of Unsecured Protected Health Information as required at 45 CFR 164.410, and any Security Incident of which it becomes aware.

Rivius adaptation: timing and content. (The HHS sample invites the parties to add a stricter timeframe.)

• Business Associate will report a suspected Breach of Unsecured PHI, or a use or disclosure not provided for by this Agreement, to Covered Entity without unreasonable delay and no later than 5 business days after discovery (as "discovery" is defined in 45 CFR 164.410(a)(2)), and in any event within the 60 calendar days allowed by 45 CFR 164.410(b).
• The report will include, to the extent known, the information listed in 45 CFR 164.410(c), and Business Associate will supplement it as information becomes available.
• Unsuccessful Security Incidents: the parties agree that this section is notice of the ongoing existence of unsuccessful Security Incidents (such as pings, port scans, blocked log-in attempts and denial-of-service attempts that do not result in unauthorised access, use or disclosure), for which no further report is required.
• Notifications to Individuals, the Secretary and the media: Covered Entity will make them, and Business Associate will give it the information and help it needs to do so. Business Associate will reimburse Covered Entity’s reasonable, documented costs of notification required by law for a Breach caused by Business Associate, subject to the limits in the Service Agreement.

(d) In accordance with 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2), if applicable, ensure that any Subcontractors that create, receive, maintain, or transmit PHI on behalf of Business Associate agree to the same restrictions, conditions, and requirements that apply to Business Associate with respect to such information.

Rivius adaptation. Business Associate will keep a current list of Subcontractors that handle PHI (by category and name) and provide it to Covered Entity on request. The categories are: its cloud hosting provider; its email and secure file transfer provider; any artificial intelligence or software provider that processes PHI; and any US Operator engaged as a contractor.

(e) Make available PHI in a Designated Record Set to Covered Entity as necessary to satisfy Covered Entity's obligations under 45 CFR 164.524.

Rivius adaptation. Business Associate does not expect to maintain a Designated Record Set. If it does, it will provide the PHI to Covered Entity within 10 business days of Covered Entity's request. If an Individual asks Business Associate directly, Business Associate will forward the request to Covered Entity within 5 business days and will not respond to the Individual itself unless Covered Entity directs it to.

(f) Make any amendment(s) to PHI in a Designated Record Set as directed or agreed to by Covered Entity pursuant to 45 CFR 164.526, or take other measures as necessary to satisfy Covered Entity's obligations under 45 CFR 164.526. (Rivius adaptation: requests received directly from an Individual will be forwarded to Covered Entity within 5 business days.)

(g) Maintain and make available the information required to provide an accounting of disclosures to Covered Entity as necessary to satisfy Covered Entity's obligations under 45 CFR 164.528. (Rivius adaptation: within 15 business days of a request; requests received directly from an Individual will be forwarded to Covered Entity within 5 business days.)

(h) To the extent Business Associate is to carry out one or more of Covered Entity's obligation(s) under Subpart E of 45 CFR Part 164, comply with the requirements of Subpart E that apply to Covered Entity in the performance of such obligation(s).

(i) Make its internal practices, books, and records available to the Secretary for purposes of determining compliance with the HIPAA Rules.

3. Permitted uses and disclosures by Business Associate

(a) Business Associate may only use or disclose PHI as necessary to perform the services set forth in the Service Agreement (HHS sample Option 2), which include:

• receiving and analysing remittance advice (835 files), explanations of benefits and related claim information;
• identifying claims eligible for the federal independent dispute resolution ("IDR") process, and sending open negotiation notices to health plans and issuers;
• submitting notices, offers and supporting information to the Departments through the federal IDR portal and to certified IDR entities, and communicating with the non-initiating party, in each case only to the extent the Federal IDR process requires;
• following up with health plans and issuers on unpaid IDR payment determinations, and submitting complaints to the Centers for Medicare & Medicaid Services, the U.S. Department of Labor, the Office of Personnel Management or state insurance regulators;
• preparing and submitting corrected claims, reconsideration requests and appeals to health plans and issuers; and
• providing Covered Entity with dashboards, reports and data exports.

Rivius adaptation: these activities are "payment" activities of Covered Entity. The parties understand these services to support Covered Entity's payment activities (as defined at 45 CFR 164.501).

De-identification. Business Associate may use PHI to create de-identified information in accordance with 45 CFR 164.514(a)-(c), de-identifying it with the safe harbor method at 45 CFR 164.514(b)(2), and may use de-identified information only to improve its services and to publish aggregate market statistics that do not identify Covered Entity or any Individual. (The HHS sample says the parties "should specify" this.)

(b) Business Associate may use or disclose PHI as Required By Law.

(c) Business Associate agrees to make uses and disclosures and requests for PHI subject to the following minimum necessary requirements (HHS sample Option 2): Business Associate will request from Covered Entity only the claim, remittance and clinical information needed for the Services; will include in any IDR submission, complaint or appeal only the PHI that submission requires; and will follow the federal IDR portal's instructions not to include PHI in dispute submissions unless specifically requested.

(d) Business Associate may not use or disclose PHI in a manner that would violate Subpart E of 45 CFR Part 164 if done by Covered Entity, except for the specific uses and disclosures set forth in (e) and (f) below.

(e) Business Associate may use PHI for the proper management and administration of Business Associate or to carry out the legal responsibilities of Business Associate.

(f) Business Associate may disclose PHI for the proper management and administration of Business Associate or to carry out the legal responsibilities of Business Associate, provided the disclosures are Required By Law, or Business Associate obtains reasonable assurances from the person to whom the information is disclosed that the information will remain confidential and used or further disclosed only as Required By Law or for the purposes for which it was disclosed to the person, and the person notifies Business Associate of any instances of which it is aware in which the confidentiality of the information has been breached.

(g) Not used. The HHS sample's optional data aggregation provision is not included: Business Associate will not provide data aggregation services with Covered Entity's PHI.

Rivius adaptation: things Business Associate will not do. Business Associate will not sell PHI, will not use PHI for marketing, will not contact Covered Entity's patients, and will not use PHI to train artificial intelligence models. Any artificial intelligence provider that receives PHI does so as a Subcontractor under a business associate agreement, and may not retain PHI or train on it.

4. Provisions for Covered Entity to inform Business Associate of privacy practices and restrictions

(a) Covered Entity shall notify Business Associate of any limitation(s) in the notice of privacy practices of Covered Entity under 45 CFR 164.520, to the extent that such limitation may affect Business Associate's use or disclosure of PHI.

(b) Covered Entity shall notify Business Associate of any changes in, or revocation of, the permission by an Individual to use or disclose his or her PHI, to the extent that such changes may affect Business Associate's use or disclosure of PHI.

(c) Covered Entity shall notify Business Associate of any restriction on the use or disclosure of PHI that Covered Entity has agreed to or is required to abide by under 45 CFR 164.522, to the extent that such restriction may affect Business Associate's use or disclosure of PHI.

Rivius adaptation. Covered Entity will not send Business Associate records protected by 42 CFR Part 2 (substance use disorder treatment records) or psychotherapy notes unless the parties first agree in writing on how they will be handled.

5. Permissible requests by Covered Entity

Covered Entity shall not request Business Associate to use or disclose PHI in any manner that would not be permissible under Subpart E of 45 CFR Part 164 if done by Covered Entity, except for the uses and disclosures for management and administration and legal responsibilities in section 3(e) and (f).

6. Term and termination

(a) Term. This Agreement is effective as of the Effective Date and terminates when the Service Agreement ends and all PHI has been returned or destroyed under section 6(c), or on the date Covered Entity terminates for cause under section 6(b), whichever is sooner. (Rivius adaptation: because Business Associate finishes Filed Matters after the Service Agreement ends, this Agreement continues to apply to the PHI needed for them until they close.)

(b) Termination for cause. Business Associate authorizes termination of this Agreement by Covered Entity if Covered Entity determines Business Associate has violated a material term of this Agreement and Business Associate has not cured the breach or ended the violation within 30 days after written notice from Covered Entity. Termination of this Agreement also terminates the Service Agreement.

(c) Obligations of Business Associate upon termination (HHS sample Option 2, with Rivius adaptations). Upon termination of this Agreement for any reason, Business Associate, with respect to PHI received from Covered Entity, or created, maintained, or received by Business Associate on behalf of Covered Entity, shall:

1. Retain only that PHI which is necessary for Business Associate to continue its proper management and administration, to carry out its legal responsibilities, or to finish Filed Matters under the Service Agreement;
2. First make a complete export of Covered Entity's data available to Covered Entity under the Service Agreement, and then return to Covered Entity or, if Covered Entity agrees, destroy the remaining PHI that Business Associate still maintains in any form, within 60 days;
3. Continue to use appropriate safeguards and comply with Subpart C of 45 CFR Part 164 with respect to electronic PHI to prevent use or disclosure of the PHI, other than as provided for in this section, for as long as Business Associate retains the PHI;
4. Not use or disclose the PHI retained by Business Associate other than for the purposes for which such PHI was retained and subject to the same conditions set out at section 3(e) and (f) which applied prior to termination; and
5. Return to Covered Entity or, if Covered Entity agrees, destroy the PHI retained by Business Associate when it is no longer needed by Business Associate for its proper management and administration, to carry out its legal responsibilities, or to finish Filed Matters.

Business Associate will obtain or ensure the destruction of PHI held by its Subcontractors on the same terms, and will confirm destruction to Covered Entity in writing on request. If return or destruction is not feasible (for example, for PHI in backups that are overwritten on a schedule), Business Associate will tell Covered Entity and will extend the protections of this Agreement to that PHI for as long as it is kept. Encrypted backups are overwritten on a 35-day cycle.

(d) Survival. The obligations of Business Associate under this section 6 shall survive the termination of this Agreement.

7. Miscellaneous

(a) Regulatory references. A reference in this Agreement to a section in the HIPAA Rules means the section as in effect or as amended.

(b) Amendment. The parties agree to take such action as is necessary to amend this Agreement from time to time as is necessary for compliance with the requirements of the HIPAA Rules and any other applicable law.

(c) Interpretation. Any ambiguity in this Agreement shall be interpreted to permit compliance with the HIPAA Rules.

Rivius adaptations (not in the HHS sample):

• (d) Precedence. If this Agreement conflicts with the Service Agreement about PHI, this Agreement controls.
• (e) No third-party beneficiaries. Nothing in this Agreement gives any right to anyone other than the parties.
• (f) State law. Where state law gives PHI more protection than HIPAA and applies to Business Associate, Business Associate will comply with it. In particular, Business Associate will keep electronic records containing patient information physically in the United States, as Texas Health & Safety Code 183.002(a) requires of Texas "covered entities" (a term that, under Section 181.001(b)(2), includes business associates) for records stored on or after January 1, 2026 (Texas SB 1188, 2025).
• (g) Liability. Each party's liability under this Agreement is subject to the limits in the Service Agreement, except where the law does not allow limitation.
• (h) Governing law. This Agreement is governed by the HIPAA Rules and, to the extent not preempted, the laws of the State of Delaware.
• (i) Independent contractor. Business Associate acts as an independent contractor and not as Covered Entity's agent for purposes of federal common law of agency.
• (j) Notices. Notices under this Agreement go to the email addresses in Covered Entity's account and to support@riviushealth.com for Business Associate.

How this Agreement is accepted

Covered Entity accepts this Agreement online at sign-up, before Business Associate receives any PHI:

• The full text is shown with a PDF to download, before the payment step.
• The signer enters their name and title and ticks: "☐ I have read the Business Associate Agreement, and I am authorised to accept it for Practice legal name · Client completes." The button reads "Accept Business Associate Agreement".
• Business Associate records, and keeps for at least 6 years (see 45 CFR 164.316(b)(2)), the document version and hash, the signer’s name, title and email, the practice’s name and TIN, the date and time (UTC), the IP address and the browser used.
• Business Associate emails the signer a PDF of the accepted version immediately.
• Business Associate accepts no PHI, and no upload or clearinghouse connection is opened, until the acceptance is recorded.

Accepted by Covered Entity

Accepted by Business Associate: Rivius Health, by its authorised officer · Method: pre-applied electronic signature, shown on the accepted copy