Business Associate Agreement

Terms such as Business Associate, Covered Entity, Protected Health Information (PHI), Electronic PHI, Breach, Security Incident, Subcontractor and Required By Law have the meanings given in 45 CFR Parts 160 and 164 (the HIPAA Rules).

"Business Associate" means Wentzel Investments LLC, operating Humanome.AI. "Covered Entity" means the clinic that accepts an invitation to Humanome.AI.

Business Associate may use or disclose PHI only to perform the genomic variant analysis and related services the clinic requests, as the agreement permits, or as Required By Law.

Business Associate will not use or disclose PHI in a way that would violate the HIPAA Rules if done by the Covered Entity, except for its own proper management and administration or to provide data aggregation services relating to the Covered Entity.

Business Associate will not sell PHI and will not use it for marketing or to train models for other customers.

Business Associate will use appropriate safeguards and comply with Subpart C of 45 CFR Part 164 for Electronic PHI to prevent use or disclosure other than as this agreement provides.

Safeguards include encryption in transit and at rest, role-based access limited to clinic users, and application audit logging of access to PHI.

Business Associate will report to the Covered Entity any use or disclosure not provided for by this agreement, any Security Incident, and any Breach of Unsecured PHI, without unreasonable delay and no later than 5 business days after discovery.

A Breach report will include, to the extent known, the people affected, what happened, the PHI involved and the steps taken to contain it.

Business Associate will ensure that any Subcontractor that creates, receives, maintains or transmits PHI on its behalf agrees in writing to the same restrictions and conditions that apply to Business Associate.

Business Associate will make PHI available for access and amendment, and provide an accounting of disclosures, so the Covered Entity can meet 45 CFR 164.524, 164.526 and 164.528, within 15 days of a request.

Business Associate will make its internal practices, books and records on PHI available to the Secretary of HHS to determine compliance with the HIPAA Rules.

This agreement lasts as long as Business Associate holds PHI for the Covered Entity. The Covered Entity may terminate it, and the services, if Business Associate materially breaches it and does not cure within 30 days.

On termination Business Associate will return or destroy all PHI it still holds. If that is infeasible, it will extend these protections to the PHI and limit further use to the purposes that make return or destruction infeasible.

This agreement is governed by the HIPAA Rules and, to the extent they do not apply, the laws of the State of Florida. If the HIPAA Rules change, the parties will amend this agreement as needed to comply.

Where this agreement conflicts with the master service terms on PHI, this agreement controls. Related terms: the Data Processing Addendum at /legal/dpa.