Notafid ← Back to home

Business Associate Agreement

Last updated: September 12, 2026

This Business Associate Agreement (“Agreement”) is a binding agreement between the healthcare practice, practitioner, or other entity accepting this Agreement (“Covered Entity”), and Notafid LLC (“Business Associate”) (each a “Party” and collectively, the “Parties”). Covered Entity is the practice, practitioner, or other entity identified in, and using the account credentials and registration information submitted to Business Associate through, Business Associate’s Notafid software platform (the “Platform”). This Agreement becomes effective as of the date and time Covered Entity accepts this Agreement in the manner described below (the “Effective Date”).

PLEASE READ THIS AGREEMENT CAREFULLY. BY SCROLLING THROUGH THIS AGREEMENT AND CLICKING THE “I AGREE,” “I ACCEPT,” OR A SIMILAR BUTTON, OR BY OTHERWISE INDICATING ACCEPTANCE OF THIS AGREEMENT THROUGH THE PLATFORM, OR BY ACCESSING OR USING THE PLATFORM (SUCH EVENT, THE “EFFECTIVE DATE”), COVERED ENTITY (A) ACKNOWLEDGES THAT IT HAS READ AND UNDERSTANDS THIS AGREEMENT; (B) REPRESENTS AND WARRANTS THAT THE INDIVIDUAL ACCEPTING THIS AGREEMENT IS AT LEAST 18 YEARS OF AGE AND IS AUTHORIZED TO ACCEPT THIS AGREEMENT ON BEHALF OF COVERED ENTITY AND TO BIND COVERED ENTITY TO ITS TERMS; AND (C) ACCEPTS THIS AGREEMENT AND AGREES THAT COVERED ENTITY IS LEGALLY BOUND BY ITS TERMS. IF COVERED ENTITY DOES NOT AGREE TO THESE TERMS, COVERED ENTITY MUST NOT ACCEPT THIS AGREEMENT AND MUST NOT ACCESS OR USE THE PLATFORM.

Recitals

WHEREAS, Covered Entity provides medical and/or other health care services to patients in compliance with the Health Insurance Portability and Accountability Act of 1996, Public Law 104-191 (“HIPAA”), and, in connection with those services, Covered Entity may disclose to Business Associate certain PHI that is subject to protection under HIPAA, the Health Information Technology for Economic and Clinical Health Act, Public Law 111-005 (“HITECH Act”), and regulations promulgated thereunder by the U.S. Department of Health and Human Services to implement certain privacy and security provisions of HIPAA (the “HIPAA Regulations”), codified at 45 C.F.R. Parts 160 and 164;

WHEREAS, The Parties intend to protect the privacy and security of PHI disclosed by Covered Entity to Business Associate, or received or created by Business Associate, when providing Services in compliance with HIPAA, the HITECH Act and its implementing regulations and guidance issued by the Secretary, and other applicable state and federal laws, all as amended from time to time; and

WHEREAS, Covered Entity is required under HIPAA to enter into a business associate agreement with Business Associate that meets certain requirements with respect to the Use and Disclosure of PHI, which are met by this Agreement.

NOW THEREFORE, in consideration of the foregoing recitals, which are hereby incorporated as an integral part of this Agreement, and of the mutual promises contained herein and other good and valuable consideration, the Parties, intending to be legally bound, hereby agree as follows:

1. Definitions

The following terms shall have the meaning set forth below. Capitalized terms used but not otherwise defined in this Agreement shall have the meanings set forth in HIPAA, the HIPAA Regulations, and the HITECH Act.

2. Obligations and Activities of Business Associate

(a) Permitted Uses and Disclosures. Business Associate may Use or Disclose PHI as necessary to perform management and administrative services for Covered Entity and shall not Disclose PHI in any manner that: (i) is not directly related to Business Associate’s engagement with Covered Entity, or (ii) would constitute a violation of the Privacy Rule or the HITECH Act if so Disclosed by a Covered Entity or Covered Entity.

(b) Minimum Necessary. Business Associate acknowledges that it shall limit the Use or Disclosure of PHI to perform or fulfill a specific function required or permitted hereunder to the Minimum Necessary to accomplish the intended purpose of such Use or Disclosure. Further, Business Associate will restrict access to PHI to those employees of Business Associate or other agents under the control of Business Associate who are actively and directly participating in providing services to Covered Entity and who need to know such information in order to fulfill such responsibilities.

(c) Prohibited Uses and Disclosures. Business Associate shall not Use or Disclose PHI for any purpose not permitted or required by this Agreement or as Required by Law. Business Associate shall not receive any remuneration, direct or indirect, in exchange for PHI, except with prior written consent of Covered Entity and as permitted under applicable law. Nothing in this provision shall be construed to prohibit payment to Business Associate by Covered Entity for Services provided pursuant to any service agreement(s) or underlying contract(s) between Covered Entity and Business Associate.

(d) Safeguards for Protection of PHI. Business Associate agrees to use appropriate safeguards to prevent Use or Disclosure of the PHI other than as provided for by this Agreement. Further, Business Associate shall use appropriate safeguards and comply with 45 C.F.R. Part 164, Subpart C with respect to ePHI that it creates, receives, maintains, or transmits on behalf of Covered Entity, if any.

(e) Reporting of Unauthorized Uses or Disclosures and Security Incidents. Business Associate agrees to report to Covered Entity in writing any Security Incident or Use or Disclosure of PHI not provided for by this Agreement, including breaches of unsecured PHI as required by 45 C.F.R. § 164.410, of which Business Associate (or Business Associate's employee, officer, or agent) becomes aware. Business Associate shall so notify Covered Entity pursuant to this Section 2(e) within three (3) days after Business Associate’s "discovery" within the meaning of the HITECH Act of such Security Incident or unauthorized Use or Disclosure of PHI; however, Covered Entity deems to have received notice from Business Associate of routine occurrences of (i) unsuccessful attempts to penetrate computer networks or services maintained by Business Associate and (ii) immaterial incidents such as “pinging” or “denial of services” attacks. Business Associate’s notice shall include sufficient information to permit Covered Entity to comply with the HIPAA Breach notification requirements and shall include the notice elements listed in 45 C.F.R. § 164.404(c). Business Associate agrees to mitigate, to the extent practicable, any harmful effect known to the Business Associate that results from such Security Incident or unauthorized Use or Disclosure. Business Associate shall also appoint a liaison and provide contact information for the same so that Covered Entity may ask questions or learn additional information concerning the HIPAA Breach. This section shall survive the expiration or termination of this Agreement and shall remain in effect for so long as Business Associate maintains PHI.

(f) Data Breach Notification and Mitigation Under Other Laws. In addition to the requirements of 2(e), Business Associate agrees to implement reasonable systems for the discovery and prompt reporting of any breach of individually identifiable information (including but not limited to PHI and referred to hereinafter as "Individually Identifiable Information") that, if misused, disclosed, lost or stolen, would trigger an obligation under one or more state data breach notification laws (each a "State Breach") to notify the individuals who are the subjects of the information. Business Associate agrees that in the event any Individually Identifiable Information is lost, stolen, compromised, used or disclosed in a manner that would trigger the application of one or more State data breach notification laws, Business Associate shall promptly: (i) notify Covered Entity within three (3) days of such misuse, disclosure, loss or theft; (ii) cooperate and assist Covered Entity with any investigation into any State Breach or alleged State Breach; (iii) cooperate and assist Covered Entity with any investigation into any State Breach or alleged State Breach conducted by any State Attorney General or State Consumer Affairs Department (or their respective agents); (iv) mitigate, to the extent practicable, any potential harm to the individuals impacted by the State Breach; and (v) assist with the implementation of any decision by any State agency, including any State Attorney General or State Consumer Affairs Department (or their respective agents), to notify individuals impacted or potentially impacted by a State Breach. This section shall survive the expiration or termination of this Agreement and shall remain in effect for so long as Business Associate maintains PHI or Individually Identifiable Information.

(g) Protection of ePHI. Unless Covered Entity agrees that the requirement herein is infeasible with respect to particular data, Business Associate shall secure all ePHI by a technology standard that renders such information unusable, unreadable, or indecipherable to unauthorized individuals and is developed or endorsed by a standards developing organization that is accredited by the American National Standards Institution and is consistent with guidance issued by the Secretary specifying the technologies and methodologies that render ePHI unusable, unreadable, or indecipherable to unauthorized individuals, including the use of standards developed under the HITECH Act.

(h) Availability of Internal Practices, Books, and Records. Business Associate agrees to make internal practices, books, and records, including policies and procedures and PHI relating to the Use and Disclosure of PHI received from Covered Entity, or created or received by Business Associate on behalf of Covered Entity, available to the Secretary, for purposes of the Secretary determining Covered Entity’s compliance with HIPAA, the HIPAA Regulations, and the HITECH Act. Except to the extent prohibited by law, Business Associate shall notify Covered Entity of all requests served upon Business Associate for information or documentation by or on behalf of the Secretary as soon as reasonably practicable, but in any event within two (2) business days of receipt of such request(s).

(i) Agents and Business Associates. Business Associate shall obtain and maintain an agreement with each agent or Business Associate that creates, receives, maintains, or transmits PHI on behalf of Business Associate. Under the agreement, such agent or Business Associate shall agree to the same restrictions and conditions that apply to Business Associate pursuant to this Agreement with respect to such PHI.

(j) Authorized Access to PHI. To the extent that Business Associate has PHI in a Designated Record Set, Business Associate agrees to provide access, at the request of Covered Entity and in the time and manner designated by Covered Entity, to such PHI to Covered Entity or, as directed by Covered Entity, to an Individual, in order to meet the requirements under 45 C.F.R. § 164.524. Business Associate shall respond to any request from Covered Entity for access by an Individual within two (2) business days of such request. If a Business Associate receives a request from an Individual for access to PHI, Business Associate shall immediately forward such request to Covered Entity.

(k) Subpoena, Court or Administrative Order. In the event Business Associate receives a subpoena, court, or administrative order or other discovery request or mandate for release of PHI received from Covered Entity or created or received by Business Associate on behalf of Covered Entity, Business Associate shall notify Covered Entity of the request as soon as reasonably practicable, but in any event within two (2) business days of receipt of such request.

(l) Amendments to PHI. To the extent that Business Associate has PHI in a Designated Record Set, Business Associate agrees to make any amendment(s) to PHI in a Designated Record Set that Covered Entity requests or agrees to pursuant to 45 C.F.R. § 164.526 within five (5) business days of such request, and in the time and manner designated by Covered Entity. In the event any Individual requests a correction of PHI directly to the Business Associate, Business Associate shall immediately forward such request to Covered Entity. Business Associate shall have a process in place for receiving requests for amendments and for appending such requests to the Designated Record Set when requested by the Covered Entity.

(m) Accounting of Disclosures. Within fifteen (15) days of receipt of a request from Covered Entity or an Individual for an accounting of Disclosures of PHI, Business Associate shall make available to Covered Entity the information required to provide an accounting of Disclosures to enable Covered Entity to fulfill its obligations to the Covered Entities in accordance with 45 C.F.R. § 164.528. Business Associate agrees to implement an appropriate record keeping process that will track, at a minimum, the following information: (i) the date of the Disclosure; (ii) the name of the entity or person who received the PHI, and if known, the address of such entity or person; (iii) a brief description of the PHI Disclosed; and (iv) a brief statement of the purpose of such Disclosure which includes an explanation of the basis for such Disclosure. Business Associate’s accounting obligations under this section shall survive termination or expiration of this Agreement and with respect to any Disclosure, whether on or before the termination of this Agreement, shall continue for a minimum of seven (7) years following the date of disclosure.

(n) Withdrawal of Authorization. If the Use or Disclosure of PHI under this Agreement is based upon an Individual’s specific authorization regarding the use of his or her PHI, and (i) the Individual revokes such authorization in writing; (ii) the effective date of such authorization has expired, or (iii) the authorization is found to be defective in any manner that renders it invalid for whatever reason, then Business Associate agrees, if it has received notice from Covered Entity regarding such revocation or invalidity, to cease the Use and Disclosure of any such Individual’s PHI except to the extent Business Associate has relied on such Use or Disclosure, or where an exception under the HITECH Act, HIPAA, or the HIPAA Regulations expressly applies.

(o) Audits. Upon request from Covered Entity, Business Associate shall permit Covered Entity to review and audit Business Associate’s policies, procedures, and practices relating to Business Associate’s compliance with the Privacy Rule and Security Rule, including the right to audit contracts and relationships with agents and Business Associates who have access to PHI, and upon request shall provide Covered Entity with copies of relevant documents.

(p) Carrying out Covered Entity Obligations. To the extent Business Associate is to carry out one or more of Covered Entity’s obligation(s) under Subpart E of 45 C.F.R. Part 164, Business Associate must comply with the requirements of Subpart E that apply to the Covered Entity in performance of such obligations.

3. Term and Termination

(a) Term. The term of this Agreement shall be effective as of the Effective Date and shall terminate as of the date that all of the PHI provided by Covered Entity to Business Associate, or created or received by Business Associate on behalf of Covered Entity, is destroyed or returned to Covered Entity, or, if it is infeasible to return or destroy the PHI, protections are extended to such information, in accordance with the terms of this Agreement. Business Associate shall have a continuing obligation to safeguard the confidentiality of PHI received from Covered Entity after the termination of this Agreement.

(b) Termination for Cause. Upon Covered Entity’s knowledge of a material breach or violation of this Agreement by Business Associate, Covered Entity shall either:

(c) Obligations of Business Associate Upon Termination.

4. Miscellaneous

(a) Ownership of PHI. Under no circumstances shall Business Associate be deemed in any respect to be the owner of any PHI Used or Disclosed by or to Business Associate pursuant to the terms of this Agreement or any service agreement(s) or underlying contract(s) between Covered Entity and Business Associate.

(b) Regulatory References. A reference in this Agreement to a section in the Privacy Rule, Security Rule, HIPAA, or the HITECH Act means the section as in effect or as amended.

(c) Amendment. No amendment, change, or modification of this Agreement shall be valid unless set forth in writing and agreed to by the Parties; provided that the Parties agree that electronic acceptance of this Agreement, or of any amended version of this Agreement, through the Platform (including by clicking an “I Agree,” “I Accept,” or similar button, or by continued use of the Platform after notice) satisfies any requirement of a writing signed by the Parties. Business Associate may amend this Agreement from time to time by posting a revised version through the Platform or otherwise providing notice to Covered Entity, and Covered Entity’s electronic acceptance of the revised version, or continued use of the Platform after such notice, constitutes acceptance of the amended Agreement. The Parties agree to take such action as is necessary to amend or further amend, as the case may be, this Agreement from time to time as is necessary for Covered Entity to comply with the applicable law, including but not limited to the requirements of HIPAA, the HITECH Act, and regulations promulgated thereunder.

(d) Indemnification. Business Associate shall indemnify, defend, and hold harmless Covered Entity, and its affiliates, from and against any and all claims, suits, demands, judgments, losses, costs, fines, penalties, damages, liabilities, and expenses (collectively “Claims”) up to the policy limit of Business Associate’s applicable insurance policy arising from any act or omission on the part of Business Associate, or its employees, Business Associates or agents, or arising from or related to this Agreement; provided, however, the policy limit cap of Business Associate’s applicable insurance policy shall not apply in instances where the Claims arise from willful misconduct or negligence by the Business Associate, or its employees, Business Associates or agents. Without limitation of the foregoing, Business Associate shall be responsible for all costs and expenses incurred by Covered Entity in notifying individuals, the media, and the Secretary of the Department of Health and Human Services of a Breach where the Breach was caused by Business Associate and the PHI was maintained, used, or disclosed by Business Associate when the Breach occurred.

(e) No Third-Party Rights. The terms of this Agreement are not intended, nor should they be construed, to grant any rights to any parties other than Business Associate and Covered Entity.

(f) Relationship of Parties. It is expressly agreed that the Parties shall be independent contractors and that the relationship between the two Parties shall not constitute a partnership, joint venture, or agency. Neither Party shall have the authority to make any statements, representations, or commitments of any kind, or to take any action, which shall be binding on the other Party, without the prior written consent of the other Party.

(g) Notices. All notices, requests, consents, claims, demands, waivers, and other communications hereunder shall be in writing and shall be deemed to have been given: (a) when delivered by hand (with written confirmation of receipt); (b) when received by the addressee if sent by a nationally recognized overnight courier (receipt requested); (c) on the date sent by facsimile or email (with confirmation of transmission) if sent during normal business hours of the recipient, and on the next business day if sent after normal business hours of the recipient; or (d) on the third day after the date mailed, by certified or registered mail, return receipt requested, postage prepaid. Such communications must be sent to the Parties at the following addresses:

If to Business Associate:
Notafid LLC
7901 4th St N, Suite # 35886
St. Petersburg, FL 33702
Attention: Legal Department
legal@notafid.com

If to Covered Entity: To the name, mailing address, email address, telephone number, and contact person for Covered Entity then currently on file with Business Associate, as provided by Covered Entity in connection with its Notafid account and registration through the Platform (or as later updated by Covered Entity through the Platform).

Covered Entity is responsible for maintaining current and accurate account and contact information with Business Associate. Any notice sent to the contact information then on file for Covered Entity is effective in accordance with this Section, and Business Associate may also deliver notices to Covered Entity through the Platform.

(h) Survival. The respective rights and obligations of the Parties under Sections 2(e), 2(f), 2(m), 3(c), and 4(d) shall survive any termination of this Agreement.

(i) Interpretation. Any ambiguity in this Agreement shall be resolved to permit Covered Entity to comply with the requirements of HIPAA and the HITECH Act, and other applicable law. In the case of conflict or inconsistency between this Agreement and any other written agreement between the Parties, the language of this Agreement shall control with regard to the subject matter herein. Without limitation of the foregoing, any limitation or exclusion of damages provisions shall not be applicable to this Agreement.

(j) Governing Law. This Agreement shall be governed by and construed under the laws of the State of Florida, without regard to choice of law rules.

(k) Electronic Acceptance. The Parties agree that this Agreement may be executed and accepted electronically, and that Covered Entity’s act of scrolling through and clicking the “I Agree,” “I Accept,” or a similar button, or otherwise indicating acceptance of this Agreement through the Platform, constitutes a valid and binding execution of this Agreement to the same extent as a handwritten signature. Each Party agrees that the electronic acceptance, records, and signatures associated with this Agreement are the legal equivalent of manual, written signatures and are enforceable in accordance with the federal Electronic Signatures in Global and National Commerce Act, the Uniform Electronic Transactions Act as adopted in the State of Florida, and other applicable law. Business Associate has authorized this Agreement to be made available for acceptance through the Platform, and no handwritten or wet-ink signature is required to make this Agreement binding on the Parties.

(l) Entire Agreement. This Agreement constitutes the entire agreement between the Parties with respect to the subject matter hereof, and supersedes all prior oral or written agreements, commitments, or understandings with respect thereto as of the Effective Date.