BUSINESS ASSOCIATE AGREEMENT

This Business Associate Agreement ("Agreement") is entered into by and between STRAVUS LLC (dba FaxLock) ("Business Associate") and _____________________ ("Covered Entity").

1. Purpose

This Agreement is entered into to comply with the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), the Health Information Technology for Economic and Clinical Health Act ("HITECH"), and their implementing regulations (45 C.F.R. Parts 160 and 164), which require Covered Entity to obtain satisfactory assurances that Business Associate will appropriately safeguard Protected Health Information ("PHI").

2. Obligations of Business Associate

Business Associate agrees to:

• Not use or disclose PHI other than as permitted or required by this Agreement or as required by law.
• Use appropriate administrative, physical, and technical safeguards to prevent the use or disclosure of PHI other than as provided for by this Agreement. FaxLock utilizes AES-256 encryption at rest and TLS 1.2+ in transit.
• Report to Covered Entity any use or disclosure of PHI not provided for by this Agreement, including any Security Incident or Breach of Unsecured PHI, within 24 hours of discovery.
• Ensure that any subcontractors that create, receive, maintain, or transmit PHI on behalf of Business Associate agree to the same restrictions and conditions that apply to Business Associate.
• Make available PHI in a designated record set to the Covered Entity as necessary to satisfy Covered Entity's obligations under 45 C.F.R. § 164.524.

3. Permitted Uses and Disclosures

Business Associate may use or disclose PHI to perform functions, activities, or services for, or on behalf of, Covered Entity as specified in the underlying service agreement, provided that such use or disclosure would not violate HIPAA if done by Covered Entity.

4. Term and Termination

This Agreement shall be effective as of the date of signature below and shall terminate when all PHI provided by Covered Entity to Business Associate is destroyed or returned to Covered Entity, or if it is infeasible to return or destroy PHI, protections are extended to such information.

5. Data Deletion and Retention

Upon termination of the underlying service agreement, Business Associate will permanently delete all PHI received from Covered Entity within 72 hours, in accordance with FaxLock's automated data retention policies.