AuricWell Business Associate Agreement

DRAFT FOR LEGAL AND ORGANIZATIONAL REVIEW — NOT EXECUTED. Prepared October 5, 2026; scope updated October 14, 2026. Complete bracketed fields and the schedules before signature. Proposed duties below are contractual commitments, not a certification that a product has been audited or that all safeguards are already implemented.

Principal (Covered Entity): [practice legal entity].

Recipient (Business Associate): [Exact PlotTwistCo legal entity], operating AuricWell.

Use this model for a practice’s direct EHR/platform agreement with PlotTwistCo. Proposed scope: authorized practice administration, EHR storage and access, scheduling, billing functions, communications and specifically approved documentation features. An affiliated organization is not a party merely because it uses the same software. If another business associate delegates processing to Provider, identify the actual upstream relationship and execute the appropriate subcontractor agreement.

1. Purpose and covered information

The parties enter this Agreement in connection with the services in Schedule A. “PHI,” “Breach,” “Unsecured PHI,” “Security Incident,” “Designated Record Set,” “Required by Law,” and “Secretary” have their meanings under the HIPAA Rules, 45 CFR Parts 160 and 164. PHI here means PHI created, received, maintained or transmitted by Recipient on behalf of Principal for those services, including electronic PHI. This Agreement does not classify FERPA education records as PHI or authorize a disclosure that otherwise requires consent.

2. Permitted processing and limits

Recipient may use or disclose PHI only to perform Schedule A under Principal's documented, lawful instructions, fulfill this Agreement, or as Required by Law. Recipient shall not use or disclose PHI in a way that Principal could not lawfully authorize under HIPAA. Recipient shall apply the minimum-necessary standard where applicable and restrict access to authorized persons with a service-related need. Incidental access is not permission for independent use. Recipient shall notify Principal if an instruction appears unlawful and pause that processing pending resolution, except where law requires the processing.

The parties do not authorize sale of PHI, targeted advertising, independent fundraising, unrestricted cross-customer data aggregation, general-purpose AI/model training, or use of PHI to promote another entity's services. De-identification or analytics beyond performing the contracted service requires a separate written instruction and applicable safeguards. No vendor may independently reuse identifiable records under a general website license. Psychotherapy notes and specially protected substance-use records are excluded from routine school coordination; processing them requires a separately approved lawful scope and any additional required authorization or agreement. No recording or transcription is authorized merely by signing this Agreement.

3. Safeguards and Security Rule

Recipient shall comply with the Security Rule provisions applicable to business associates for electronic PHI and maintain appropriate administrative, physical and technical safeguards. It shall maintain a documented risk assessment and risk-management process; workforce confidentiality and training; individual accounts; access approval and timely termination; appropriate authentication; access and security logging; incident response; backup/recovery; and secure disposal. Schedule B records the agreed technical controls and any approved limitations. Encryption at rest and in transit and multi-factor authentication for privileged access are proposed contractual controls; the parties must verify implementation before live PHI access. Exceptions require written risk assessment and agreed compensating controls and cannot waive applicable law.

Recipient shall not weaken a material protection or materially expand locations, access or processing without informing Principal and resolving the change under the service agreement. It shall preserve evidence relevant to an incident and protect logs against inappropriate access. Requested audit evidence shall not expose other customers' data, credentials or security-sensitive materials beyond what is reasonably needed to assess compliance.

4. Incidents and breach reporting

Recipient shall notify Principal's designated incident contact without unreasonable delay and no later than 24 hours after discovery of a suspected or confirmed unauthorized access, use or disclosure affecting Principal's information, or a material Security Incident affecting its confidentiality, integrity or availability. A preliminary report may identify facts still under investigation. Recipient shall investigate promptly, mitigate harm where practicable, cooperate with containment and preserve relevant evidence.

For a Breach of Unsecured PHI, Recipient shall additionally provide the notice required by 45 CFR 164.410 without unreasonable delay and, under this proposed contract, no later than five business days after discovery. Neither investigation nor incomplete information permits Recipient to delay the initial notice. Supplement reports as information becomes available. Include known affected individuals, data categories, discovery/event dates, what occurred, containment and corrective actions, and a contact for further information. Applicable legal deadlines remain controlling if shorter; a contractual deadline never extends the HIPAA limit.

Routine unsuccessful scans or blocked attempts that do not result in unauthorized access or material impact may be reported in an agreed periodic summary, but only if Schedule B identifies those categories. This exception does not cover a suspected breach, compromised account or material service incident. Principal directs notices to individuals, regulators and schools unless law independently requires Recipient to notify them. Recipient shall coordinate and shall not obstruct any legally required report. Each party retains its direct legal duties.

5. Requests, amendments and accounting

Recipient shall assist Principal in satisfying individual access, amendment, restriction, confidential-communication and accounting obligations applicable to the services. Requests received directly shall be referred promptly to Principal unless law requires a direct response. Recipient shall provide available information or an export within ten business days of Principal's request, or sooner when reasonably necessary to meet a communicated legal deadline. It shall incorporate or make available required amendments as directed and keep the information needed for disclosure accountings. Record locations, formats and request contacts are specified in Schedule A. Principal decides the validity of a request unless a law independently imposes that decision on Recipient.

6. Delegated duties and regulatory access

To the extent Recipient performs a Privacy Rule obligation on Principal's behalf, Recipient shall comply with the requirements applicable to that obligation. Recipient shall make its relevant internal practices, books and records available to the Secretary as required to determine HIPAA compliance and cooperate with lawful regulatory inquiries. This Agreement does not prevent either party from communicating with a regulator.

7. Subcontractors

Before a subcontractor creates, receives, maintains or transmits PHI on Recipient's behalf, Recipient shall bind it by a written agreement imposing the applicable restrictions, conditions and safeguards at least as protective as this Agreement, including Security Rule obligations for electronic PHI. Recipient remains responsible for its subcontractor commitments. Maintain an inventory of the relevant providers, functions and processing locations; make it available to Principal and notify it of material changes. No live PHI may be enabled with a vendor merely because a vendor's product description says it is HIPAA-compatible. Required agreements, account settings and actual usage must be verified.

8. Principal's responsibilities

Principal shall supply lawful instructions, identify restrictions or changes in permissions that affect processing, and limit information sent to the agreed scope. Principal retains its own notices, authorizations, disclosure decisions and workforce-access responsibilities. Neither school affiliation nor a shared owner constitutes an authorization to release records. Each party shall promptly notify the other of changes needed to keep instructions lawful.

9. Term, suspension and termination

This Agreement takes effect on the last authorized signature and remains in force while Recipient holds PHI under the services. Principal may suspend affected processing immediately where reasonably needed to protect information. Principal may terminate this Agreement and the affected services for a material violation. Where cure is appropriate, Principal may allow a written cure period of up to 30 days; it need not permit continued unsafe processing. The right to terminate for material breach is not restricted by an inconsistent general service term. Transition assistance shall preserve lawful record access and confidentiality.

10. Return, destruction and retained information

On termination or at Principal's instruction where applicable, Recipient shall return or destroy PHI, including copies held by subcontractors, if feasible. Proposed operational schedule: export within 30 days and remove active-service copies within 30 days after Principal confirms receipt; protected backups expire within 90 days unless a different schedule is completed in Schedule B. These periods must be verified and agreed before signing.

If return or destruction is infeasible or retention is Required by Law, Recipient shall identify the affected information, reason, retention period and access restrictions in writing. Protections continue for retained information; uses and disclosures are limited to the reason making return or destruction infeasible or legally required. Retained copies are not available for ordinary product, marketing or analytics use. Provide a completion/exception certificate on request. Record retention duties cannot be evaded by closing an account.

11. Relationship to other agreements and changes

This Agreement supplements the identified service agreement and controls a conflict concerning PHI protection. It does not itself authorize fees, create a treatment relationship, appoint an employee, waive individual rights, or give a school general clinical-record access. Amendments require authorized written agreement, except that mandatory law controls immediately. The parties shall work in good faith to implement necessary legal updates. No website change silently amends this signed Agreement. No third party is made an intended contract beneficiary except to the extent required by law. Counterparts and lawful electronic signatures are permitted. Governing law and forum: [complete applicable state and forum with counsel, subject to federal law]. No contractual limitation excuses duties owed directly under law.

Schedule A — complete the service and data scope

• Service agreement title/date: [complete].
• Approved functions and features: [select only enabled services]: clinical records; documentation and required signing/cosigning; client enrollment and desired-provider/waitlist coordination; appointment and office scheduling; consent-based notifications; individual/group supervision scheduling, attendance, hours, agendas and presentations; admitted-guest video; authorized clearinghouse claim submission, remittance and eligibility workflows.
• Plan and feature scope: [record selected plan and separate add-ons]. Supervision meeting management starts with Premium; required note signing remains available in Basic. Plan limits never reduce the BAA's safeguards or individual-rights duties.
• Video and presentations: [identify approved vendor/account, admission controls, screen-sharing/presentation permissions, data locations and retention]. Recording/transcription remains disabled unless separately authorized with applicable acknowledgements and consent.
• Communications: [identify permitted channels, minimum necessary notification content, recipient/consent preferences and authenticated-link rules]. Ordinary SMS must not be represented as a secure clinical record channel.
• Clearinghouse: [identify approved Claim.MD account, covered practices/tax IDs, permitted claims/ERA/eligibility data, agreements and enrollment responsibilities]. Payer and clinical billing rules remain Customer responsibilities.
• Metering: billing records use practice identifiers, transaction references and minimum necessary quantities; do not include clinical notes, diagnoses, presentation contents or client names in ordinary billing descriptions. Access and retention for metering evidence: [complete].
• Data categories and recipients: [enumerate minimum required information].
• Record systems and designated-record-set responsibilities: [identify].
• Excluded information and disabled features: [list].
• Principal privacy/incident contact and monitored escalation number: [complete].
• Recipient privacy/incident contact and monitored escalation number: [complete].
• Approved subcontractors, functions, agreements and processing locations: [attach current register].
• Authorized disclosure instructions, applicable permissions and release workflow: [attach].
• Export format, access/amendment/accounting request process and contacts: [complete].

Schedule B — verify before access

• Security control inventory and verification date: [attach].
• Incident contacts and 24-hour reporting capability: [verify].
• Accepted categories/period for routine unsuccessful-incident reporting, if any: [complete; otherwise report under Section 4].
• Active-record retention, export, deletion and backup expiration: [confirm or replace the proposed periods].
• Approved locations, subprocessors and change-notice process: [complete].
• Data-return test and recovery test evidence: [identify].

Authorized signatures

Principal legal name: [complete]

Signer / title: [complete]

Signature: ____________________ Date: ____________________

Recipient legal name: [complete]

Signer / title: [complete]

Signature: ____________________ Date: ____________________