Business Associate Agreement

This Business Associate Agreement ("Agreement") is entered into by and between:

Covered Entity: the Home Care agency identified in the TildyCare subscription that accepts this Agreement ("Agency"); and

Business Associate: TildyCare, LLC ("Business Associate," "TildyCare").

The Agency subscribes to the TildyCare application, a software-as-a-service CRM for home care intake. In providing the service, TildyCare creates, receives, maintains, or transmits Protected Health Information on the Agency's behalf. Under 45 CFR §164.504(e), the parties agree as follows. This Agreement is incorporated into the TildyCare Terms of Service, and if the two conflict about PHI, this Agreement controls.

If the Agency is itself a business associate of another covered entity, this Agreement applies to the same extent to PHI the Agency is authorized to handle, and the Agency confirms that its own business associate agreement with that covered entity permits it.

This is version 1.0 of this Agreement. The current version is published at https://tildycare.com/baa, and the application records which version an Agency accepts and when.

1. Definitions

Terms used but not defined in this Agreement have the meaning given in the HIPAA Rules (45 CFR Parts 160, 162, and 164).

• Breach has the meaning given in 45 CFR §164.402.
• Designated Record Set has the meaning given in 45 CFR §164.501.
• Protected Health Information ("PHI") means individually identifiable health information created, received, maintained, or transmitted by Business Associate on behalf of Covered Entity, in any form or medium, including electronic media, paper, and oral.
• HIPAA Rules means the Privacy, Security, Breach Notification, and Enforcement Rules at 45 CFR Part 160 and Part 164, as amended by the HITECH Act and the Omnibus Final Rule.

2. Obligations and Activities of Business Associate

2.1 Use and disclosure. Business Associate agrees not to use or further disclose PHI other than as permitted or required by this Agreement or as required by law, and to use appropriate safeguards to prevent use or disclosure of PHI other than as provided for by this Agreement.

2.2 Minimum necessary. Business Associate will use PHI only for the purposes of providing the service, and will apply the minimum-necessary standard to all uses and disclosures.

2.3 Safeguards. Business Associate will implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of electronic PHI, as required by 45 CFR §164.308, §164.310, §164.312, and §164.316. The controls Business Associate has implemented as of the effective date are described in TildyCare's Security Controls Summary, which is available before acceptance and on request, and is incorporated by reference.

2.4 Reporting. Business Associate will report to Covered Entity any use or disclosure of PHI not provided for by this Agreement of which it becomes aware, including Breaches of Unsecured PHI as required by 45 CFR §164.410, and any security incidents of which it becomes aware as required by 45 CFR §164.314(a)(2)(i)(B). Notification timelines are specified in Section 7.

2.5 Subcontractors. Business Associate will ensure that any agent, including a subcontractor, that creates, receives, maintains, or transmits PHI on its behalf agrees in writing to the same restrictions and conditions that apply to Business Associate with respect to PHI. Business Associate's current subprocessors are described by category in the TildyCare Privacy Policy, and a named list is available on request; Business Associate has executed a Business Associate Agreement with Amazon Web Services that flows down these obligations (45 CFR §164.308(b)). Business Associate will notify Covered Entity before any new subcontractor begins to handle PHI.

2.6 Access to PHI. Business Associate will make PHI available to Covered Entity, or as directed by Covered Entity, for so long as Business Associate maintains PHI, within fifteen (15) days of a request, to permit Covered Entity to satisfy its obligations under 45 CFR §164.524 (access of individuals to PHI).

2.7 Amendment of PHI. Business Associate will make PHI available to Covered Entity for amendment within fifteen (15) days of a request and will incorporate any amendments agreed to by Covered Entity, to permit Covered Entity to satisfy its obligations under 45 CFR §164.526.

2.8 Accounting of disclosures. Business Associate will maintain a record of disclosures of PHI and will make that record available to Covered Entity within thirty (30) days of a request, to permit Covered Entity to satisfy its obligations under 45 CFR §164.528. Within TildyCare this record is the platform audit log, which records who accessed or changed what record and when; Covered Entity may request an accounting export through support.

2.9 Internal practices. To the extent Business Associate carries out any of Covered Entity's obligations under the HIPAA Rules, Business Associate will comply with those obligations. Business Associate will make its internal practices, books, and records relating to the use and disclosure of PHI available to the Secretary of Health and Human Services for purposes of determining Covered Entity's compliance with the HIPAA Rules.

2.10 No marketing or sale. Business Associate will not use or disclose PHI for marketing purposes, will not sell PHI, and will not disclose PHI to a health plan for payment purposes, in each case as prohibited by 45 CFR §164.508 and §164.502(a)(5). Business Associate does not use PHI to train machine learning models.

3. Obligations of Covered Entity

3.1 Covered Entity will inform Business Associate of any changes or limitations in its notice of privacy practices or permitted uses of PHI that affect Business Associate's use or disclosure of PHI.

3.2 Covered Entity will obtain any consent, authorization, or agreement required under the HIPAA Rules from individuals before Business Associate uses or discloses PHI on Covered Entity's behalf.

3.3 Covered Entity will not request Business Associate to use or disclose PHI in any manner that would not be permissible under the HIPAA Rules if done by Covered Entity.

3.4 If Covered Entity needs to submit records subject to 42 CFR Part 2 (substance use disorder treatment), it will contact Business Associate before uploading. They are not covered by this Agreement unless the parties agree in writing.

4. Permitted Uses of PHI by Business Associate

Business Associate may use or disclose PHI:

4.1 To provide the service (including intake workflow management, lead and patient records, communications, support, and platform administration) as instructed by Covered Entity;

4.2 For the proper management and administration of Business Associate, as permitted by 45 CFR §164.504(e)(2)(i)(B); and

4.3 To carry out the legal responsibilities of Business Associate, as permitted by 45 CFR §164.504(e)(2)(i)(C).

5. Term and Termination

5.1 Term. This Agreement is effective when accepted by an authorized Agency administrator and continues for as long as Business Associate maintains PHI for Covered Entity, including any retention period described in Section 6.

5.2 Termination for cause. If either party breaches a material provision of this Agreement, the other party may terminate it after giving the breaching party written notice and a thirty (30) day opportunity to resolve the breach or end the violation. If Business Associate does not resolve it within that period, Covered Entity may terminate both this Agreement and the service. Either party may terminate immediately where the law requires or where PHI is at risk.

6. Return or Destroy PHI at Termination

6.1 Upon termination of this Agreement, Business Associate will return or destroy all PHI that Business Associate still maintains in any form, and will retain no copies, as required by 45 CFR §164.504(e)(2)(ii)(J), except as Section 6.5 permits.

6.2 Return procedure. Covered Entity may request a full data-return export (machine-readable JSON plus attached documents) through the TildyCare application or by contacting support. Business Associate will provide the export without unreasonable delay.

6.3 Destruction. Database records are purged and stored files (lead documents, inbound mail storage) are deleted as soon as the retention period permits. Deletion is permanent and unrecoverable. The destruction procedure, its checkpoints, and the disposal attestation are described in TildyCare's disposal runbook, which is available to the Agency on request.

6.4 Attestation. Upon completion, Business Associate will provide Covered Entity an automated disposal attestation describing what was deleted, when, and by whom.

6.5 If return or destruction of any PHI is not feasible (for example, records Business Associate must retain under other law, or backup media scheduled for routine expiry), Business Associate will extend the protections of this Agreement to such PHI for as long as Business Associate maintains it, limit further uses and disclosures to those purposes that make return or destruction infeasible, and notify Covered Entity of the specific PHI affected and the reason. The platform audit trail, the disposal attestation, and the deletion case thread are retained for seven years after disposal as the evidentiary record of the destruction. They remain subject to this Agreement and are destroyed when that period ends.

6.6 Legal hold. If Business Associate is notified of a legal or regulatory matter, it may suspend destruction and retain the affected records until the hold is lifted. Business Associate will tell Covered Entity when a hold affects its records.

7. Breach Notification

7.1 Business Associate will notify Covered Entity in writing of any Breach of unsecured PHI within five (5) business days of discovery of the Breach, as required by 45 CFR §164.410. Notification will include, to the extent known at notification: the nature of the Breach, the individuals affected (or a plan and date-certain for identifying them), and mitigation steps taken or planned. Additional operational detail is in TildyCare's breach runbook, which is available to the Agency on request.

7.2 A Breach is "discovered" on the first day it is known, or would have been known through the exercise of reasonable diligence, to Business Associate or any employee, officer, or agent of Business Associate (other than the person committing the Breach).

7.3 Business Associate will mitigate, to the extent practicable, any harmful effect known to Business Associate of a use or disclosure of PHI in violation of this Agreement.

8. Audit and Inspection

8.1 Covered Entity may request, no more than once per calendar year, evidence of Business Associate's compliance with this Agreement (for example, the current Security Controls Summary, the subprocessor list, and relevant policies). Business Associate will provide such evidence within twenty (20) business days of the request.

8.2 On-site audits are not required by this Agreement; the parties will cooperate in good faith on any regulator-directed assessment.

9. Miscellaneous

9.1 Amendment. The parties agree to take such action as is necessary to amend this Agreement from time to time as is necessary for the parties to comply with the HIPAA Rules. If Business Associate makes a material change to this Agreement beyond what the HIPAA Rules require, it will announce the new version to Agency administrators at least thirty (30) days before it takes effect.

9.2 Survival. The provisions of Sections 2.4, 2.5, 2.6, 2.7, 2.8, 2.9, 2.10, 6, and 7 survive termination of this Agreement.

9.3 No third-party beneficiaries. Nothing in this Agreement confers upon any person other than the parties any rights or remedies, except that individuals and the Secretary of Health and Human Services may enforce rights the HIPAA Rules give them.

9.4 Interpretation. Any ambiguity in this Agreement will be resolved to permit Covered Entity to comply with the HIPAA Rules.

9.5 Regulatory references. A reference in this Agreement to a regulation in the HIPAA Rules includes any corresponding or successor regulation.

9.6 Electronic acceptance. Acceptance in the TildyCare application by an authorized Agency administrator, or a signed copy, binds the Agency. The application records the accepting administrator, the date, and the version accepted.

9.7 Governing law. Florida law governs this Agreement, and the state or federal courts in Alachua County, Florida have exclusive venue. The HIPAA Rules govern where they apply.

10. Contact

TildyCare, LLC privacy@tildycare.com — privacy and contractual notices security@tildycare.com — security incidents and vulnerability reports

Business Associate will send Breach notices and other PHI-related notices to the Agency administrator's email address on file. The Agency will keep that address current.