Data Hippo Business Associate Agreement

1. Effectiveness, scope, and definitions

This BAA takes effect when signed by both parties or expressly incorporated into their signed Services Agreement, not through publication or use of services alone. Before PHI processing, Data Hippo must confirm eligibility in writing and the execution schedule must identify the approved services, deployment, and data flows ("Covered Services"). Approval is limited to that scope and does not extend to other services, integrations, models, or deployments. Neither eligibility nor execution status excuses duties arising from actual activities under law.

"HIPAA Rules" means 45 CFR Parts 160 and 164, including applicable HITECH requirements, as amended. Undefined HIPAA terms have their meanings under those rules. "PHI" means Protected Health Information under 45 CFR Section 160.103 that Data Hippo creates, receives, maintains, or transmits for Customer. If PHI arrives outside the approved scope or channels, Data Hippo will safeguard it, restrict access, notify Customer promptly, and coordinate secure return or destruction and any required response. Receipt does not expand the Covered Services.

2. Permitted uses and disclosures

"Customer data" includes information provided by or processed on behalf of Customer, including PHI, personally identifiable information ("PII"), and de-identified, aggregated, synthetic, or other derivatives. Removing identifiers does not change its status as Customer data or remove the applicable confidentiality and use restrictions.

Data Hippo may use or disclose PHI only for the Covered Services, as expressly permitted here, or as Required By Law. Except for the management and administration permissions below, it may not act in a way that would violate the Privacy Rule if done by the relevant Covered Entity. Uses, disclosures, and requests must meet applicable minimum-necessary requirements and relevant Customer policies communicated to Data Hippo.

Data Hippo may use PHI for proper management and administration or legal responsibilities. Disclosure for those purposes requires either a legal requirement or the recipient's reasonable assurances of confidentiality, use or further disclosure only for the disclosed purpose or as required by law, and notice to Data Hippo of any known breach of confidentiality. Section 5 governs resulting reportable events.

Data Hippo may de-identify PII and use the resulting Customer data for internal development, testing, and validation for Customer's agreed services. Where PII is also PHI, the following PHI requirements apply. De-identifying PHI or providing PHI data aggregation requires express authorization in the execution schedule or a signed statement of work. PHI de-identification must meet 45 CFR Section 164.514; PHI aggregation must support the Health Care Operations under Section 164.501 of the identified Covered Entities and be permitted by their applicable agreements and HIPAA.

By default, Data Hippo will not sell PHI or use it for advertising, marketing, or fundraising; pool Customer data across unrelated customers or use it for cross-customer benchmarking; or use, commercialize, or disclose Customer data for another customer's services or unrelated product development or purposes. De-identification or aggregation alone grants no additional use rights. These defaults do not prohibit the management, administration, or legally required uses expressly permitted above.

Express Opt-In. The contractual defaults in Sections 2 and 3 may be varied only by a separate Services Agreement, statement of work, or amendment signed by both parties that identifies the restriction and authorized data, purpose, recipients/models, scope, duration, and retention/reuse rights (an "Express Opt-In"). It overrides only the identified restriction within that scope. Silence, general service language, and signing this BAA are not consent. All required individual, other-customer, upstream, and rights-holder permissions, service/provider approvals, and downstream agreements must precede exceptional use. An Express Opt-In cannot waive applicable law, mandatory safeguards, reporting, individual-rights assistance, or PHI return/destruction duties; change Customer-data classification or IP ownership; or grant rights Customer lacks.

3. Customer-specific models and AI services

The model-use restrictions in this paragraph are defaults subject to the Express Opt-In rule in Section 2. Customer-specific model training, testing, fine-tuning, and use require express authorization in the execution schedule or a signed statement of work. Models must be segregated for Customer. Neither Customer data nor resulting weights, checkpoints, embeddings, training artifacts, or learned parameters may be repurposed, combined, or transferred for another customer's use; used to train, fine-tune, or improve shared, cross-customer, or general-purpose models; or used to evaluate such models for another customer or unrelated development. These restrictions include provider training, de-identified, aggregated, or synthetic derivatives, and indirect methods such as distillation.

PHI may go to an external AI provider only after the execution schedule or a signed amendment approves the provider, organization/account, eligible service and feature, retention settings, region, and data flow, with required downstream agreements in place. Feature availability or a provider's general BAA is not approval. Provider training must also be permitted by the approved provider terms. Expanded PHI recipients or uses require prior written approval. Approved pre-existing models may perform inference or output evaluation solely for Customer's Covered Services without constituting shared-model training, subject to the same approvals, confidentiality, and default use restrictions.

Pre-existing or independently developed code, untrained architectures, and general methods remain reusable if they contain no Customer data or customer-specific learned parameters and do not disclose or reproduce Customer confidential information. Ownership and deliverable rights follow the Services Agreement; an ownership grant alone is not an Express Opt-In. Customer-specific models and artifacts are Customer confidential information, with offboarding governed by Section 7.

4. Safeguards, subcontractors, and assistance

Data Hippo will:

• Apply appropriate administrative, physical, and technical safeguards and comply with the Security Rule for electronic PHI, protecting confidentiality, integrity, and availability, including access controls, workforce security and training, transmission security, risk analysis, and appropriate remediation.
• Encrypt electronic PHI in transit and at rest in Data Hippo-controlled systems, including logs and backups. Customer-managed responsibilities in the execution schedule do not reduce Data Hippo's legal duties.
• Before a subcontractor handles PHI, obtain a written agreement imposing the same applicable restrictions, conditions, and Security Rule requirements under 45 CFR Sections 164.502(e), 164.308(b), and 164.314(a). Take reasonable steps to cure known material violations or end them; if unsuccessful, terminate the arrangement if feasible.
• Provide access to PHI in a Designated Record Set, amendments and their incorporation, and accounting information under Sections 164.524, 164.526, and 164.528 as necessary for Customer's applicable obligations and deadlines. Forward individual requests to Customer in time for that compliance unless Customer directs a lawful direct response.
• Comply with applicable Privacy Rule requirements when performing Customer's delegated obligations, and make internal practices, books, and records available to the Secretary as required for HIPAA compliance review.

The execution schedule allocates deployment and security responsibilities. PHI must not enter unapproved email, chat, support tickets, repositories, screenshots, or AI tools. Lawful reporting through an approved secure incident channel remains permitted.

5. Incident and breach reporting

Data Hippo will report impermissible PHI uses or disclosures and Security Incidents of which it becomes aware, including Breaches of Unsecured PHI, to Customer's designated security contact as required by the HIPAA Rules. Breach notice must be given without unreasonable delay and no later than 60 calendar days after discovery under 45 CFR Section 164.410, subject to shorter applicable legal or expressly agreed schedule deadlines. Other reports follow applicable law. Discovery includes what reasonable diligence would reveal; investigation or final risk assessment cannot postpone required notice. Lawful delays under Section 164.412 apply.

Initial notice and prompt supplements will provide available information required by Section 164.410(c) and needed for Customer's notices, including affected individuals, event and discovery dates, PHI categories, known effects, response measures, and a contact. Data Hippo will preserve relevant evidence, mitigate known harmful effects where practicable, and reasonably cooperate in the response.

Routine unsuccessful attempts with no unauthorized access, use, disclosure, modification, destruction, or material interference are deemed reported here, including blocked scans, denied firewall traffic, and failed logins. This standing notice excludes successful or service-affecting events and reasonably suspected Breaches. Reasonable aggregate information is available on request.

Customer handles individual, regulator, and media notices unless delegated in writing or law independently requires Data Hippo to notify. For upstream Business Associate customers, reporting and assistance flow through Customer to the relevant Covered Entity except as law requires. Coordination must not delay legally required notice.

6. Customer responsibilities

Customer will provide lawful instructions and necessary permissions, disclose only minimum-necessary PHI where required, and not request impermissible uses or disclosures. Customer will promptly communicate relevant privacy-notice limitations, permission changes or revocations, agreed or legally required restrictions, and upstream contractual restrictions. The parties will identify additional requirements before expanding scope. Customer will keep notice contacts current and perform its assigned configuration and access duties. These allocations do not excuse Data Hippo's own duties.

7. Term, suspension, and termination

This BAA continues while Data Hippo performs Covered Services, subject to termination and surviving protections. Either party may terminate for material breach uncured after 30 days' written notice, or immediately if cure is impossible, and may suspend affected PHI processing for an imminent security risk with prompt notice where practicable. Suspension does not excuse safeguards, reporting, assistance, or preservation duties.

On termination, PHI processing stops except for lawful offboarding or protected retention. A surviving Services Agreement alone does not authorize PHI processing without an effective BAA. Data Hippo will return or destroy all PHI it or its subcontractors hold or control if feasible, retaining no copies except as permitted below. Customer-specific models and training artifacts, including non-PHI copies, will also be returned or destroyed under the agreed schedule unless an Express Opt-In permits non-PHI retention or reuse. Data Hippo will not delete Customer-controlled source systems merely because services end.

If PHI return or destruction is infeasible, Data Hippo will notify Customer of the conditions, maintain BAA protections, and limit further uses and disclosures to the purposes making it infeasible for as long as PHI is retained. It will return or destroy that PHI when retention is no longer necessary. Legally required retention remains protected.

8. General terms

The parties will interpret and amend this BAA as necessary for compliance with the HIPAA Rules and applicable law. It controls conflicts about permitted PHI uses, required protections, and operational HIPAA duties. Other matters remain governed by the Services Agreement, including contractual liability, caps, indemnification, governing law, and dispute procedures to the extent legally permitted. This BAA creates no separate indemnification duty or liability cap and does not limit mandatory legal duties.

Website changes do not amend executed agreements. Customer-specific amendments must identify the changed provision and be signed by both parties. Required safeguards, reporting, individual-rights assistance, government access, protected retention, and return/destruction duties survive as needed. Default data and model-use restrictions survive termination, subject only to the scope and duration of an applicable Express Opt-In.

9. Execution schedule

Complete before execution and PHI access. Approval may cover an agreed project or phase, not each query or session, but does not authorize other purposes, recipients, or deployments.

• Customer legal name, address, HIPAA role, and relevant Covered Entity/upstream customers: [complete].
• Services Agreement/SOW identifier and date; effective date and approved project/phase period: [complete].
• Covered Services, purpose, PHI categories, sources, destinations, and data flows: [complete].
• Customer/Data Hippo systems and accounts/workspaces; regions; authorized roles, access, exports, and support channels; responsibilities for keys, logs, backups, patching, security, and offboarding: [complete].
• Downstream PHI providers, eligible services/features, retention/settings, and responsibility for required BAAs: [complete; none unless listed].
• Customer-specific training/testing: [not authorized unless completed; objective, data, isolated model/artifact locations, retention, and deliverables].
• De-identification/data aggregation: [not authorized unless completed; method and purpose; no extra reuse rights without an Express Opt-In].
• Express Opt-Ins: [none by default; identify the separate signed instrument and the exceptions required by Section 2].
• Designated Record Set status and individual-rights workflow: [complete; reassess if use changes].
• Incident contacts, secure reporting channel, escalation route, and shorter deadlines: [complete].
• Return/export and deletion instructions, model/artifact handling, backup deletion cycle, and legally required retention: [complete].