Business Associate Agreement

Definitions

Terms used in this BAA have the meanings defined in the Health Insurance Portability and Accountability Act of 1996 (HIPAA), the HITECH Act, and their implementing regulations, including 45 CFR Parts 160 and 164.

Obligations of InstaRoom

InstaRoom agrees to:

• Not use or disclose Protected Health Information (PHI) other than as permitted by this BAA or required by law
• Implement appropriate safeguards to protect PHI
• Report any known security incident or breach of unsecured PHI to the Covered Entity within 60 days of discovery
• Ensure any subcontractors that handle PHI agree to the same restrictions
• Make PHI available for access and amendment as required
• Return or destroy PHI upon termination of the agreement

Permitted Uses

InstaRoom may use PHI only as necessary to provide the InstaRoom platform services including video session facilitation, appointment scheduling, and payment processing. InstaRoom will not use PHI for marketing or sell PHI to any third party.

Obligations of the Covered Entity

The Covered Entity agrees to:

• Obtain any consent required from clients before using InstaRoom
• Notify InstaRoom of any restrictions on PHI use that may affect InstaRoom's services
• Not request InstaRoom to use PHI in a manner that would violate HIPAA

Term & Termination

This BAA is effective upon your use of InstaRoom and remains in effect until your account is terminated. Upon termination InstaRoom will return or destroy all PHI within 30 days.

Limitation of Liability

InstaRoom's liability under this BAA is limited to direct damages and shall not exceed the fees paid by the Covered Entity in the 12 months preceding the claim.

Governing Law

This BAA is governed by the laws of the State of California and applicable federal law including HIPAA and the HITECH Act. Any disputes shall be resolved in the courts of Alameda County, California.