HIPAA BUSINESS ASSOCIATE AGREEMENT

This HIPAA Business Associate Agreement (“Agreement” or “BAA”) is entered into by and between:

Covered Entity: The healthcare practice or covered entity electronically accepting this Agreement (“Covered Entity”), and

Business Associate: Crescendo Operations LLC, d/b/a Harmony Ops Health (“Business Associate”).

This Agreement becomes effective on the date the Covered Entity electronically accepts this BAA through the Harmony Ops platform (“Effective Date”).

1. RELATIONSHIP TO MASTER SERVICES AGREEMENT

This BAA is executed pursuant to the Master Services Agreement (“MSA”) between Covered Entity and Business Associate governing use of the Harmony Ops platform and services.

All indemnification obligations, limitations of liability, damages caps, arbitration provisions, suspension rights, governing law provisions, and remedies contained in the MSA are incorporated into this BAA by reference and shall apply to this BAA as if fully stated herein.

In the event of conflict, the HIPAA-required provisions of this BAA shall control solely as required by law, and all other matters shall be governed by the MSA.

2. DEFINITIONS

Terms used but not otherwise defined in this Agreement shall have the same meaning as those terms in HIPAA, including the Health Insurance Portability and Accountability Act of 1996 and the implementing regulations at 45 C.F.R. Parts 160–164 (the “Privacy Rule,” “Security Rule,” and “Breach Notification Rule”).

3. PERMITTED USES AND DISCLOSURES

Business Associate may use and disclose Protected Health Information (“PHI”) solely as necessary to perform services for Covered Entity under the MSA and as permitted by HIPAA.

Business Associate may use PHI for:

• Platform hosting and technical enablement

• Customer support and troubleshooting

• Compliance support and audit cooperation

• Data backup and system security maintenance

Business Associate shall not use or disclose PHI except as allowed by this Agreement or required by law.

4. SAFEGUARDS

Business Associate shall implement administrative, physical, and technical safeguards designed to protect the confidentiality, integrity, and availability of PHI in accordance with 45 C.F.R. §164.308, §164.310, and §164.312.

5. BREACH AND SECURITY INCIDENT REPORTING

Business Associate shall notify Covered Entity without unreasonable delay and in no event later than sixty (60) days after discovery of any Breach or unsecured PHI as defined by HIPAA.

Any such notice will include:

• Description of the incident

• Type of PHI involved

• Date of breach discovery

• Known mitigation actions
  

6. SUBCONTRACTORS

Business Associate may use subcontractors to provide services under the MSA. Business Associate shall ensure any such subcontractor that creates, receives, maintains, or transmits PHI on its behalf signs an agreement requiring HIPAA protections consistent with this BAA.

7. ACCESS, AMENDMENT, AND ACCOUNTING

Business Associate shall:

• Provide PHI access to Covered Entity or individuals as required by 45 C.F.R. §164.524

• Incorporate amendments to PHI as required by 45 C.F.R. §164.526

• Provide accounting of disclosures as required by 45 C.F.R. §164.528
  

8. TERMINATION

This Agreement may be terminated as provided under the MSA.

Upon termination of services:

• Business Associate shall return or destroy PHI if feasible.

• If return or destruction is not feasible, Business Associate shall

  continue to safeguard PHI and limit further uses or disclosures.
  

9. NO MEDICAL OR CLINICAL SERVICES

Business Associate does not provide medical care, diagnosis, treatment, or clinical services and does not interact directly with patients except as permitted by Covered Entity workflows.

All clinical decisions, communications, consent management, and regulatory compliance obligations remain the sole responsibility of Covered Entity.

10. INDEMNIFICATION & LIABILITY

Each party agrees to indemnify and hold harmless the other solely for violations of HIPAA caused by its own acts or omissions.

All other indemnification obligations, liability caps, remedies, arbitration procedures, dispute resolution requirements, and damages limitations are governed by the MSA and incorporated into this BAA by reference.

11. NO THIRD-PARTY BENEFICIARIES

Nothing in this Agreement creates any rights for any third party, including patients or governmental agencies.

12. REGULATORY COOPERATION

Business Associate shall make its internal practices, books, and records related to PHI available to the Secretary of the U.S. Department of Health and Human Services as required for HIPAA compliance.

13. GOVERNING LAW

This Agreement shall be governed by and construed under the laws of the State of North Carolina, without regard to conflict-of-law rules.

14. SURVIVAL

The obligations of Business Associate related to PHI protections, reporting, confidentiality, and restrictions shall survive termination of this Agreement.

15. ENTIRE AGREEMENT

This Agreement, together with the MSA, constitutes the entire agreement of the parties regarding PHI handling and HIPAA compliance.

ELECTRONIC EXECUTION

By clicking “I Agree & Activate HIPAA Features,” I confirm that I have reviewed and agree to the terms of this Business Associate Agreement, that I am authorized to accept this Agreement on behalf of the Covered Entity, and that this electronic acceptance constitutes a legally binding and enforceable agreement.