Hailo Business Associate Agreement

1. Definitions

Capitalized terms not defined here have the meanings in HIPAA: the Health Insurance Portability and Accountability Act of 1996, the HITECH Act, and their regulations at 45 CFR Parts 160 and 164. These include Breach, Data Aggregation, Designated Record Set, Health Care Operations, Individual, Required by Law, Secretary, Security Incident, Subcontractor and Unsecured PHI. "PHI" means Protected Health Information (including electronic PHI) that Hailo creates, receives, maintains or transmits for the Agency through the Hailo services.

2. What Hailo may do with PHI

2.1 To provide the services. Hailo may use and disclose PHI to provide the Hailo Agency services described in the Terms. Examples include scheduling, visit verification, care notes, billing and invoicing, family and caregiver messaging, documents and e-signature, reporting, and AI features the Agency turns on.

2.2 To run Hailo. Hailo may use PHI for its proper management and administration and to carry out its legal responsibilities. Hailo may disclose PHI for those purposes only if the disclosure is Required by Law, or if Hailo gets reasonable written assurance that the recipient will keep it confidential, use it only for the purpose disclosed, and report any breach of confidentiality to Hailo.

2.3 Data aggregation. Hailo may combine the Agency's PHI with PHI from other covered entities it serves, but only for the Health Care Operations of the covered entities involved. One example is quality and staffing benchmarks.

2.4 De-identification. Hailo may de-identify PHI under 45 CFR 164.514(a)–(c). De-identified information is not PHI and is not covered by this BAA. Hailo may use and disclose it for any lawful purpose, including improving and building products and services, analytics and benchmarks.

2.5 Minimum necessary. Hailo will limit uses, disclosures and requests of PHI to the minimum necessary, as HIPAA requires.

2.6 Nothing else. Hailo will not use or disclose PHI in any way that would violate HIPAA if the Agency did it, except as sections 2.2–2.4 allow. Hailo will not sell PHI, will not use it for marketing as HIPAA defines marketing, will not use one agency's identifiable PHI to solicit that agency's clients, and will not use PHI to train general AI models.

3. Safeguards

Hailo will use appropriate administrative, physical and technical safeguards to prevent unpermitted use or disclosure of PHI, and will comply with the HIPAA Security Rule (45 CFR Part 164, Subpart C) for electronic PHI. These safeguards include encryption in transit and at rest, role-based access, segregated health records, and audit logging of health-record access. Hailo will keep written security policies, train its workforce who handle PHI, and name a security official responsible for them.

4. Subcontractors

Hailo will make sure that every Subcontractor that creates, receives, maintains or transmits PHI for Hailo agrees in writing to the same restrictions, conditions and requirements that apply to Hailo under this BAA (45 CFR 164.502(e)(1)(ii) and 164.308(b)(2)). Hailo will not send PHI to a Subcontractor before that written agreement is in place. Hailo will give the Agency its current list of PHI subcontractors on request.

5. Reporting incidents and breaches

5.1 What Hailo reports. Hailo will report to the Agency (a) any use or disclosure of PHI not allowed by this BAA, (b) any Security Incident, and (c) any Breach of Unsecured PHI.

5.2 Timing. Hailo will report a Breach of Unsecured PHI without unreasonable delay. The report will come no later than 10 business days after Hailo discovers it, and in every case within 60 calendar days. As more information becomes available, the report will include the Individuals affected and the other information the Agency needs for its own notices under 45 CFR 164.410. Reports go to the Agency owner's email on file and in the app.

5.3 Unsuccessful incidents. This section is Hailo's notice to the Agency of unsuccessful Security Incidents that happen routinely, and the Agency needs no further notice of them. Examples are pings, port scans, blocked log-in attempts, denial-of-service attempts, and malware that doesn't result in unauthorized access, use or disclosure of PHI.

5.4 Mitigation and cost. Hailo will mitigate harmful effects it knows of, as far as practicable. If a Breach is caused by Hailo or its Subcontractor, Hailo will reimburse the Agency's reasonable, documented costs of the notices the law requires, and of credit monitoring where the law or a regulator requires it. To the fullest extent the law allows, Hailo's total liability for all Breaches and all other claims under this BAA, combined, including those costs, is limited to the fees the Agency paid Hailo for the Agency Services in the 12 months before the Breach. Hailo is never liable under this BAA for indirect, consequential, special or punitive damages, lost profits, or fines and penalties assessed against the Agency for the Agency's own conduct. Otherwise the Terms' limitation of liability applies.

5.5 Who notifies. Unless the parties agree otherwise in writing, the Agency decides on and sends notices to Individuals, regulators and the media.

5.6 How the Agency reports to Hailo. The Agency reports suspected incidents involving the Hailo services to support@hailocare.com.

6. Individuals' rights

If Hailo holds PHI in a Designated Record Set, then within 15 business days of the Agency's request, Hailo will:

• make the PHI available to the Agency so it can answer an Individual's request for access (45 CFR 164.524), including in electronic form;
• make amendments the Agency directs (164.526);
• give the Agency the information it needs for an accounting of disclosures (164.528). Hailo will document disclosures as that rule requires.

If an Individual contacts Hailo directly, Hailo will forward the request to the Agency within 10 business days. Hailo does not answer the Individual itself unless the Agency tells it to.

The Agency can usually do all of this itself in the Hailo app (client record export, editing, and access logs).

7. Agency's responsibilities

The Agency will:

• tell Hailo about any limits in its Notice of Privacy Practices, any restriction it agrees to, and any revoked authorization that affects Hailo's use of PHI;
• not ask Hailo to use or disclose PHI in a way HIPAA wouldn't allow the Agency to;
• use the Hailo services as designed. For example, it won't put PHI in fields, AI prompts, campaign scripts or SMS templates that the Terms or product say must not hold PHI;
• control its own users' accounts and permissions, and remove access promptly when someone leaves.

8. HHS access

Hailo will make its internal practices, books and records relating to PHI available to the Secretary of HHS to determine compliance with HIPAA.

9. Agency's obligations Hailo carries out

Where Hailo carries out an Agency obligation under the HIPAA Privacy Rule, Hailo will follow the Privacy Rule requirements that apply to the Agency when it does so.

10. Term and termination

10.1 Term. This BAA starts when the Agency accepts it. It lasts as long as Hailo holds PHI for the Agency.

10.2 Termination for breach. If either party learns that the other has materially breached this BAA, it may give written notice and 30 days to cure. If the breach isn't cured, it may terminate this BAA and the affected services.

10.3 Return or destruction. When the Terms end, the Agency may export its data for the export period in the Terms (60 days). After that, Hailo will return or destroy the PHI and keep no copies. If return or destruction is not feasible, Hailo will extend this BAA's protections to that PHI and limit further use and disclosure to the purposes that make return or destruction infeasible, for as long as Hailo keeps it. Examples are records Hailo must keep by law, immutable audit logs, signature, consent and acceptance evidence, and backups waiting to roll off on their normal schedule.

10.4 Survival. Section 10.3 and any obligation that by its nature should continue survive termination.

11. Ownership

This BAA does not transfer ownership of PHI. Between the parties, the Agency keeps the rights in its PHI that HIPAA and applicable law give it. Hailo keeps ownership of the Hailo platform, de-identified data, aggregated statistics, and data that isn't PHI under the Terms. That includes Hailo account and identity data that caregivers and clients provide to Hailo directly.

12. Order of precedence

On any matter involving PHI, this BAA controls over the Terms and any other agreement between the parties. On everything else, the Terms control. Hailo's standard BAA governs, and a BAA drafted by the Agency is binding only if Hailo signs it in writing.

13. Changes in law

If HIPAA changes in a way that affects this BAA, the parties agree to amend it as needed to comply. Hailo may update this BAA to reflect changes in law by giving 30 days' notice in the app or by email; an owner or administrator is then asked to accept the new version at their next sign-in. Any ambiguity will be read to allow compliance with HIPAA.

14. Electronic acceptance and records

The Agency accepts this BAA electronically when an owner or administrator checks the box or clicks the button that says they agree, at signup or later in the app. That acceptance has the same force as a signature under the E-SIGN Act and UETA. The person accepting confirms they are authorized to bind the Agency. Hailo keeps a tamper-evident record of each acceptance and gives the Agency a copy on request. The record includes the accepting user and their role, the agency, the BAA version and its fingerprint (SHA-256 hash), the words of the statement they agreed to, the time, the IP address and the device. Hailo keeps acceptance records for at least 6 years after this BAA ends (45 CFR 164.316(b)(2)), and in practice for the 7 years set in the Terms.

15. Miscellaneous

15.1 Independent contractor. Hailo acts as an independent contractor and not as the Agency's agent. Nothing in this BAA gives the Agency the right to control how Hailo performs its services.

15.2 No third-party beneficiaries. Nothing in this BAA gives any right to anyone other than the parties.

15.3 Notices and law. Notices go to the addresses in the Terms; for Hailo that is Hailo LLC, Attn: Legal, 25283 Cabot Rd, Ste 212, Laguna Hills, CA 92653 and info@hailocare.com. The Terms' governing law and dispute terms apply, except where HIPAA preempts them.

15.4 Interpretation. References to a HIPAA section mean that section as amended and in effect.