Business Associate Agreement

Capitalized terms not otherwise defined in this Agreement have the meanings ascribed to them in the Health Insurance Portability and Accountability Act of 1996, as amended by the Health Information Technology for Economic and Clinical Health Act ("HITECH"), and the regulations promulgated thereunder at 45 C.F.R. Parts 160 and 164 (together, "HIPAA"), including:

• Protected Health Information ("PHI") has the meaning set out at 45 C.F.R. § 160.103, limited to information created, received, maintained, or transmitted by Speekr on behalf of the Practice.
• Electronic PHI ("ePHI") has the meaning set out at 45 C.F.R. § 160.103.
• Breach, Security Incident, Use, Disclosure, Required by Law, Subcontractor, Unsecured PHI, and Designated Record Set have the meanings set out in HIPAA.
• Member means any clinician or other user who holds an active seat in the Practice's Speekr account, in the role of owner, admin, or member.

This Agreement is accepted once, on behalf of the Practice, by a practice owner during onboarding. It covers every Member of the Practice, including Members added after acceptance, and all patients and records that belong to the Practice. No patient can be added to the Practice's account until this Agreement has been accepted. Only practice owners and admins may manage this Agreement on the Practice's behalf.

Acceptance is recorded in Speekr's systems along with the identity of the signer, the signer's IP address, a timestamp, and the version of this Agreement that was accepted.

Speekr may Use and Disclose PHI only as permitted or required by this Agreement, the Terms of Service, or as Required by Law. Specifically, Speekr may Use and Disclose PHI:

• to perform services for the Practice, including receiving, storing, and processing patient records that Members upload or paste; extracting clinical information from those records; generating draft clinical documentation with AI for review, editing, and approval by a clinician; running automated validation checks on drafts; and scheduling reminders for upcoming documentation;
• for the proper management and administration of Speekr, or to carry out Speekr's legal responsibilities, provided that any Disclosure for those purposes is Required by Law or Speekr obtains reasonable written assurances from the person to whom the PHI is Disclosed that the PHI will be held confidentially and used or further disclosed only as Required by Law or for the purposes for which it was Disclosed, and the person notifies Speekr of any instances of which it becomes aware in which the confidentiality of the PHI has been breached, as permitted by 45 C.F.R. § 164.504(e)(4);
• to provide data aggregation services relating to the health care operations of the Practice, as permitted by 45 C.F.R. § 164.504(e)(2)(i)(B);
• to de-identify PHI, only in accordance with 45 C.F.R. § 164.514(a)-(c) and as otherwise permitted by HIPAA.

Speekr will not Use or Disclose PHI in a manner that would violate HIPAA if done by the Practice, except as expressly permitted above, and will limit its Uses and Disclosures of PHI to the minimum necessary in accordance with 45 C.F.R. § 164.502(b). Speekr will not sell PHI in violation of 45 C.F.R. § 164.502(a)(5)(ii) or Use or Disclose PHI for marketing in violation of 45 C.F.R. § 164.508(a)(3). Speekr does not use PHI to train or improve AI models.

Speekr agrees to:

• not Use or further Disclose PHI other than as permitted or required by this Agreement or as Required by Law;
• implement and maintain appropriate administrative, physical, and technical safeguards, and comply with Subpart C of 45 C.F.R. Part 164 (the Security Rule) with respect to ePHI, including encryption of ePHI at rest and in transit, access controls, isolation of each practice's data from other practices, and audit logging;
• mitigate, to the extent practicable, any harmful effect of a Use or Disclosure of PHI by Speekr in violation of this Agreement of which Speekr becomes aware;
• report to the Practice any Use or Disclosure of PHI not provided for by this Agreement, any Security Incident, and any Breach of Unsecured PHI, in accordance with Section 6 below;
• ensure that any Subcontractor that creates, receives, maintains, or transmits PHI on behalf of Speekr agrees in writing to the same restrictions, conditions, and requirements that apply to Speekr with respect to such PHI, as required by 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2);
• within fifteen (15) business days of a written request, make available to the Practice PHI in a Designated Record Set necessary to enable the Practice to satisfy its obligations under 45 C.F.R. § 164.524;
• within thirty (30) days of a written request, make available PHI in a Designated Record Set for amendment, and incorporate any amendments directed by the Practice, as required by 45 C.F.R. § 164.526;
• within thirty (30) days of a written request, make available to the Practice the information required to provide an accounting of Disclosures in accordance with 45 C.F.R. § 164.528;
• to the extent Speekr carries out an obligation of the Practice under Subpart E of 45 C.F.R. Part 164, comply with the requirements of Subpart E that apply to the Practice in the performance of that obligation;
• make its internal practices, books, and records relating to the Use and Disclosure of PHI available to the Secretary of the U.S. Department of Health and Human Services for purposes of determining the Practice's compliance with HIPAA.

Speekr engages the following Subcontractor to create, receive, maintain, or transmit PHI on its behalf. Speekr has executed a written business associate agreement with it and will maintain one with any future Subcontractor that creates, receives, maintains, or transmits PHI on Speekr's behalf:

• Amazon Web Services, Inc. — hosting, database and file storage, background processing, sign-in, text extraction, and AI model inference (Amazon Bedrock and Amazon Textract). PHI is stored and processed in the United States.

Stripe, Inc. provides subscription billing and receives account and billing information only. Stripe receives no PHI and is not a Subcontractor under this Agreement.

A current list of subprocessors is maintained on Speekr's Privacy Policy page. Speekr will provide the Practice at least thirty (30) days' prior written notice of any new Subcontractor that will process PHI, and the Practice may object by terminating this Agreement in accordance with Section 9.

Speekr will report to the Practice in writing any Breach of Unsecured PHI, as required by 45 C.F.R. § 164.410, without unreasonable delay and in no event later than thirty (30) calendar days after Speekr discovers the Breach. The report will include, to the extent known at the time of the report: the identification of each individual whose Unsecured PHI has been, or is reasonably believed to have been, accessed, acquired, Used, or Disclosed during the Breach; a description of the nature of the Breach; the date of the Breach and the date of discovery; the types of PHI involved; and the steps Speekr has taken to investigate, mitigate harm, and prevent recurrence. Speekr will supplement the report as additional information becomes available.

Speekr will also report any Security Incident of which it becomes aware, as required by 45 C.F.R. § 164.314(a)(2)(i)(C). The parties agree that unsuccessful attempts at unauthorized access (such as routine scans, pings, and port probes) that do not result in actual unauthorized access to PHI are deemed to be reported by this general notification and need not be separately reported.

If a patient or other individual contacts Speekr directly with a request relating to their PHI (access, amendment, accounting, or restriction), Speekr will forward the request to the Practice within ten (10) business days and will cooperate with the Practice in responding. The Practice is responsible for fulfilling all individual-rights obligations under HIPAA.

The Practice agrees to:

• not request that Speekr Use or Disclose PHI in any manner that would not be permissible under HIPAA if done by the Practice;
• notify Speekr of any limitation in its notice of privacy practices, any change in or revocation of an individual's permission, and any restriction on the Use or Disclosure of PHI that it has agreed to, to the extent it may affect Speekr's Use or Disclosure of PHI;
• manage which clinicians are Members of the Practice, and revoke access promptly when a Member should no longer have it. Every active Member can view and work on every patient of the Practice;
• review every AI-generated draft before approving it. Clinical approval of documentation remains the responsibility of the Practice's clinicians.

This Agreement takes effect on the date a practice owner accepts it and remains in effect until terminated. Either party may terminate this Agreement, and the underlying Terms of Service, upon thirty (30) days' written notice to the other party, or immediately upon written notice if the other party has materially breached an obligation under this Agreement and failed to cure the breach within thirty (30) days after written notice.

Before canceling, the Practice may export its records from the Service, subject to applicable retention and deletion requirements. Upon termination of this Agreement for any reason, Speekr will return to the Practice or destroy all PHI in Speekr's possession and retain no copies, except for backup or archival copies that cannot feasibly be isolated. If return or destruction is infeasible, Speekr will extend the protections of this Agreement to such PHI and limit further Use and Disclosure of such PHI to the purposes that make return or destruction infeasible, for as long as Speekr maintains such PHI.

Amendment. The parties agree to take such action as is necessary to amend this Agreement from time to time as is necessary for compliance with HIPAA and other applicable laws.

No Third-Party Beneficiaries. Nothing in this Agreement confers any rights or remedies upon any person other than the parties.

Interpretation. Any ambiguity in this Agreement will be resolved in favor of a meaning that permits the parties to comply with HIPAA.

Survival. Sections 4, 6, 9, and 10 survive termination for as long as Speekr maintains any PHI.

Governing Law. This Agreement is governed by the laws of the State of Delaware, without regard to its conflict-of-laws principles, except to the extent preempted by federal law.

Notices. Notices to Speekr under this Agreement must be sent to raj@speekr.app. Notices to the Practice will be sent to the email address on file for the Practice's owner.