Business Associate Agreement

Business Associate ("BA"): CaseNote Vault™, operated by AgencyVault OS.

Covered Entity ("CE"): The organization or entity that has entered into a subscription agreement with CaseNote Vault and is a Covered Entity or Business Associate under HIPAA.

Protected Health Information ("PHI"): Has the meaning given in 45 CFR § 160.103, limited to PHI created, received, maintained, or transmitted by CaseNote Vault on behalf of the Covered Entity.

Required by Law: Has the meaning given in 45 CFR § 164.103.

All other capitalized terms not defined herein have the meanings given in HIPAA (45 CFR Parts 160 and 164).

CaseNote Vault may use and disclose PHI only as necessary to:

• Provide the platform services described in the Terms of Service on behalf of the Covered Entity
• Perform data management, hosting, backup, and security operations necessary for service delivery
• Report violations of law to appropriate government authorities
• Comply with valid legal process, court orders, or regulatory requirements

CaseNote Vault will not use or disclose PHI for any purpose other than as permitted or required by this BAA, the Terms of Service, or as Required by Law. CaseNote Vault will not use or disclose PHI in a manner that would violate HIPAA if done by the Covered Entity.

CaseNote Vault agrees to implement and maintain appropriate administrative, physical, and technical safeguards to protect PHI, as required by the HIPAA Security Rule (45 CFR Part 164, Subpart C), including:

• Encryption of PHI at rest (AES-256) and in transit (TLS 1.2+)
• Role-based access controls limiting PHI access to authorized personnel only
• Comprehensive audit logging of all PHI access and modification events
• Regular risk assessments and security reviews
• Security incident response procedures
• Workforce training and confidentiality requirements for all personnel with PHI access
• Organization-level data isolation preventing cross-tenant PHI access

Security Incidents: CaseNote Vault will report to the Covered Entity any Security Incident (as defined in 45 CFR § 164.304) of which it becomes aware, within 72 hours of discovery, to the extent required by applicable law.

Breaches of Unsecured PHI: CaseNote Vault will notify the Covered Entity of any Breach of Unsecured PHI without unreasonable delay, and in no case later than 60 days following discovery of the Breach, as required by 45 CFR § 164.410.

Notifications will be sent to the primary contact email address on file for the organization's account.

CaseNote Vault may engage Subcontractors (third-party service providers) to assist in providing platform services. CaseNote Vault will enter into a written agreement with each Subcontractor that imposes obligations substantially similar to those in this BAA with respect to PHI handled by that Subcontractor.

CaseNote Vault remains responsible for the acts and omissions of its Subcontractors with respect to PHI to the same extent CaseNote Vault would be responsible if performing the services directly.

Current subcontractors with potential PHI access include: cloud infrastructure provider (hosting and storage) and security monitoring services. A current list is available upon written request.

To the extent required by HIPAA, upon written request from the Covered Entity, CaseNote Vault will assist the Covered Entity in responding to individuals' requests to:

• Access their PHI (45 CFR § 164.524)
• Amend their PHI (45 CFR § 164.526)
• Receive an accounting of disclosures (45 CFR § 164.528)

The platform provides data export tools that the Covered Entity may use directly to fulfill many of these requests.

CaseNote Vault will make its internal practices, books, and records relating to the use and disclosure of PHI available to the Secretary of the U.S. Department of Health and Human Services for purposes of determining the Covered Entity's and CaseNote Vault's compliance with HIPAA.

Term: This BAA is effective as of the date your organization first uses CaseNote Vault to store or process PHI and remains in effect for as long as your subscription is active.

Termination for Cause: Either party may terminate this BAA if the other party materially breaches a provision and fails to cure the breach within 30 days of written notice.

Effect of Termination: Upon termination, if feasible, CaseNote Vault will return or destroy all PHI it maintains on behalf of the Covered Entity. If return or destruction is not feasible, CaseNote Vault will continue to apply the protections of this BAA to the PHI for as long as it is retained.

Upon termination of services or written request by the Covered Entity, CaseNote Vault will:

• Provide a complete data export of all PHI in a structured format within 30 days
• After confirmation of successful export, permanently and irreversibly delete all PHI from production systems within 60 days
• Certify in writing that destruction has been completed upon request

Amendment: This BAA may only be amended by mutual written agreement. Changes to HIPAA regulations that require modification of this BAA will be implemented upon 30 days' notice.

Interpretation: Any ambiguity in this BAA shall be resolved in a manner that permits the Covered Entity to comply with HIPAA.

Governing Law: This BAA shall be governed by the laws of the Commonwealth of Pennsylvania and applicable federal law.

Contact for BAA matters: compliance@casenotevault.com