Business Associate Agreement (BAA)
Pursuant to 45 CFR §§ 164.502(e) & 164.504(e) | Effective October 26, 2026
Automatic Execution with Practice Subscription
This Business Associate Agreement is legally binding between BxOps Technologies LLC (d/b/a BehaviorOps)(“Business Associate”) and the healthcare entity subscribing to the BehaviorOps platform (“Covered Entity”). This agreement enters into force automatically upon account activation, trial registration, or signed execution in the BehaviorOps Subscription Portal.
HIPAA Compliant (with signed BAA), hosted exclusively in 100% U.S. Sovereign Data Centers (us-east1) on SOC 2 Type II & ISO 27001 Certified Infrastructure (Google Cloud Platform & Stripe), and architected to AICPA SOC 2 Trust Services Criteria (CC6–CC8)with FIPS 140-2 AES-256 & AES-256-GCM encryption at rest, TLS 1.3 & mTLS in transit, HMAC-SHA256 integrity attestation, and immutable 365-day cloud audit logging.
Recitals
WHEREAS,Covered Entity is a healthcare provider subject to the administrative simplification provisions of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and the Health Information Technology for Economic and Clinical Health (“HITECH”) Act; and
WHEREAS,Business Associate provides cloud-based and mobile Electronic Health Record (EHR), session data tracking, Electronic Visit Verification (EVV), practice management, and claims management services that involve the creation, receipt, maintenance, or transmission of electronic Protected Health Information (“ePHI”) on behalf of Covered Entity;
NOW, THEREFORE, the parties agree to the following terms:
1Definitions
- “Breach” shall have the same meaning given the term at 45 CFR § 164.402.
- “Electronic Protected Health Information” (ePHI) shall have the meaning given the term at 45 CFR § 160.103, limited to information created, received, maintained, or transmitted by Business Associate on behalf of Covered Entity.
- “HIPAA Rules” shall mean the Privacy, Security, Breach Notification, and Enforcement Rules at 45 CFR Part 160 and Part 164.
- “Security Incident” shall have the meaning given the term at 45 CFR § 164.304.
2Obligations & Activities of Business Associate
(a) Limitation on Uses and Disclosures: Business Associate agrees not to use or disclose ePHI other than as permitted or required by this Agreement or as Required By Law.
(b) Appropriate Safeguards, U.S. Data Residency & Encryption: Business Associate shall implement and maintain administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of the ePHI that it creates, receives, maintains, or transmits on behalf of Covered Entity, complying with Subpart C of 45 CFR Part 164. All cloud databases, storage volumes, and backups shall reside exclusively within United States sovereign data centers (Google Cloud Platform US-East / us-east1) and be encrypted at rest using FIPS 140-2 validated AES-256 and application-layer AES-256-GCM field encryption. Mobile offline session data cached temporarily on clinician devices shall be encrypted at rest in an isolated SQLite database using AES-256 with keys stored in hardware-backed iOS Keychain / Android Keystore. All data in transit shall be encrypted with TLS 1.3 (HTTPS/HSTS) and mutual TLS (mTLS).
(c) Reporting of Unauthorized Uses, Disclosures, or Security Incidents: Business Associate shall report to Covered Entity any use or disclosure of ePHI not provided for by this Agreement of which it becomes aware, including Security Incidents and Breaches of Unsecured Protected Health Information without unreasonable delay and in no case later than five (5) business days after discovery.
(d) Subcontractors & BAA-Covered AI Processing: In accordance with 45 CFR §§ 164.502(e)(1)(ii) and 164.308(b)(2), Business Associate shall ensure that any subcontractors (including cloud infrastructure provider Google Cloud Platform, BAA-covered Google Cloud Vertex AI in us-east1, and payment processor Stripe) that create, receive, maintain, or transmit ePHI on behalf of Business Associate agree to the same restrictions and conditions that apply to Business Associate with respect to such information. For optional AI-assisted clinical note drafting and compliance auditing, Business Associate shall scrub and tokenize direct patient/provider identifiers prior to transmission to BAA-covered Google Cloud Vertex AI and ensure zero ePHI is used to train foundation models.
(e) Access to Books and Records: Business Associate shall make its internal practices, books, and records relating to the use and disclosure of ePHI available to the Secretary of Health and Human Services (HHS) for purposes of determining compliance with the HIPAA Rules.
(f) Minimum Necessary: Business Associate shall make reasonable efforts to limit ePHI to the Minimum Necessary to accomplish the intended purpose of the use, disclosure, or request.
3Permitted Uses & Disclosures by Business Associate
Business Associate may use or disclose ePHI only as necessary to perform the services set forth in the Service Agreement, including clinical note documentation, treatment plan tracking, scheduling, EVV verification, and EDI billing generation.
Business Associate may use ePHI for the proper management and administration of Business Associate or to carry out the legal responsibilities of Business Associate, provided that disclosures are Required By Law or Business Associate obtains reasonable assurances from the recipient that it will remain confidential.
4Term & Termination
(a) Term:This Agreement shall become effective on the date Covered Entity accepts these terms or accesses the services, and shall terminate upon termination of Covered Entity’s subscription.
(b) Termination for Cause:Upon Covered Entity’s knowledge of a material breach by Business Associate, Covered Entity shall provide thirty (30) days for Business Associate to cure the breach, or immediately terminate if cure is not feasible.
(c) Effect of Termination: Upon termination of the Service Agreement, Business Associate shall, if feasible, return or destroy all ePHI received from, or created or received by Business Associate on behalf of, Covered Entity. If return or destruction is infeasible (such as maintaining automated backups or complying with medical record retention mandates), Business Associate shall extend the protections of this Agreement to such ePHI and limit further uses and disclosures to those purposes that make the return or destruction infeasible.
Electronic Execution & Verification
For Business Associate:
BxOps Technologies LLC (d/b/a BehaviorOps)
7411 Bradbury Cir, Wesley Chapel, FL 33545
Digital Execution: Authorized Corporate Officer
Title: Compliance & Regulatory Officer
Date: Effective with active platform subscription
For Covered Entity (Healthcare Practice):
Executed digitally upon registration, account setup, or signature confirmation in the Clinic Subscription Portal.