Not for emergencies. If you are experiencing a medical emergency, please call 911 (or local emergency services) immediately.

Business Associate Agreement

Version 1 ยท Last updated: November 6, 2026

This Business Associate Agreement ("BAA") is entered into by and between Careory ("Business Associate") and the healthcare provider or entity using the Careory platform ("Covered Entity"), effective as of the date the Covered Entity accepts it electronically. It forms part of the Careory practice subscription agreement (the "Service Agreement").

1. Definitions

Terms used, but not otherwise defined, in this BAA have the same meaning as those terms in the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), the Health Information Technology for Economic and Clinical Health (HITECH) Act, and their implementing regulations at 45 CFR Parts 160 and 164 (the "HIPAA Rules"), including Breach, Protected Health Information ("PHI"), Required by Law, Security Incident, Subcontractor and Unsecured PHI.

2. Obligations of Business Associate

  1. Use and disclosure. Business Associate agrees not to use or disclose PHI other than as permitted or required by this BAA or as Required by Law.
  2. Safeguards. Business Associate agrees to use appropriate administrative, physical and technical safeguards, and to comply with Subpart C of 45 CFR Part 164 (the Security Rule) with respect to electronic PHI, to prevent use or disclosure of PHI other than as provided for by this BAA.
  3. Reporting. Business Associate shall report to Covered Entity any use or disclosure of PHI not provided for by this BAA of which it becomes aware, including Breaches of Unsecured PHI as required by 45 CFR 164.410, and any Security Incident of which it becomes aware. Breaches of Unsecured PHI will be reported without unreasonable delay and in no case later than 60 calendar days after discovery. Unsuccessful attempts that do not result in unauthorized access, use or disclosure (such as pings, port scans and blocked log-in attempts) are hereby reported and need no further notice.
  4. Subcontractors. In accordance with 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2), Business Associate will ensure that any Subcontractors that create, receive, maintain or transmit PHI on its behalf agree in writing to the same restrictions, conditions and requirements that apply to Business Associate.
  5. Access. Business Associate will make PHI in a Designated Record Set available to Covered Entity as necessary for Covered Entity to meet its obligations under 45 CFR 164.524.
  6. Amendment. Business Associate will make amendments to PHI in a Designated Record Set as directed or agreed to by Covered Entity under 45 CFR 164.526, or take other measures necessary to satisfy Covered Entity's obligations under that section.
  7. Accounting of disclosures. Business Associate will maintain and make available the information required for Covered Entity to provide an accounting of disclosures under 45 CFR 164.528.
  8. Covered Entity's obligations. To the extent Business Associate carries out any of Covered Entity's obligations under Subpart E of 45 CFR Part 164, Business Associate will comply with the requirements of Subpart E that apply to Covered Entity in performing those obligations.
  9. Books and records. Business Associate will make its internal practices, books and records relating to PHI available to the Secretary of Health and Human Services for purposes of determining compliance with the HIPAA Rules.
  10. Minimum necessary. Business Associate will request, use and disclose only the minimum necessary PHI to accomplish the intended purpose.

3. Permitted uses and disclosures

  1. Business Associate may use and disclose PHI as necessary to perform the services described in the Service Agreement, which is operating the Careory telehealth software for Covered Entity.
  2. Business Associate may use PHI for its proper management and administration or to carry out its legal responsibilities, and may disclose PHI for those purposes if the disclosure is Required by Law, or if Business Associate obtains reasonable assurances from the recipient that the PHI will be held confidentially, used or further disclosed only as Required by Law or for the purpose for which it was disclosed, and that the recipient will notify Business Associate of any instances in which the confidentiality of the PHI has been breached.
  3. Business Associate will not sell PHI or use it for marketing.
  4. Business Associate will not use or disclose PHI in a manner that would violate Subpart E of 45 CFR Part 164 if done by Covered Entity, except as permitted in paragraph (b).

4. Obligations of Covered Entity

  1. Covered Entity will notify Business Associate of any limitation in its Notice of Privacy Practices, any change in or revocation of an individual's permission, and any restriction on the use or disclosure of PHI that Covered Entity has agreed to, to the extent it affects Business Associate's use or disclosure of PHI.
  2. Covered Entity will not ask Business Associate to use or disclose PHI in any manner that would not be permissible under the HIPAA Rules if done by Covered Entity.

5. Term and termination

  1. Term. This BAA remains in effect for as long as Business Associate creates, receives, maintains or transmits PHI for Covered Entity under the Service Agreement.
  2. Termination for cause. If either party determines that the other has materially breached this BAA, it will give written notice and an opportunity to cure the breach within 30 days. If the breach is not cured, the non-breaching party may terminate this BAA and the Service Agreement.
  3. Return or destruction. Upon termination of the Service Agreement, Business Associate shall return or destroy all PHI received from Covered Entity, or created or received by Business Associate on behalf of Covered Entity, after the 30-day export period described in the Service Agreement. If return or destruction is infeasible, Business Associate will extend the protections of this BAA to that PHI and limit further uses and disclosures to the purposes that make return or destruction infeasible, for as long as Business Associate keeps it.

6. Miscellaneous

  1. Regulatory references. A reference in this BAA to a section of the HIPAA Rules means the section as in effect or as amended.
  2. Amendment. The parties will amend this BAA as necessary to comply with changes to the HIPAA Rules.
  3. Interpretation. Any ambiguity in this BAA will be resolved to permit compliance with the HIPAA Rules.
  4. No third-party beneficiaries. Nothing in this BAA confers any rights or remedies on any person other than the parties.
  5. Governing law. This BAA is governed by the laws of the State of Delaware, USA, except where federal law applies.

Questions about this agreement? Email privacy@careory.com.