Business Associate Agreement
Version 1.1 · Last updated December 12, 2025
This BUSINESS ASSOCIATE AGREEMENT (“BAA”), version 1.1 dated December 12, 2025, is effective on the date Covered Entity accepts it (the “Effective Date”), by checking the acceptance box when creating an Eggmed account or by otherwise accepting the Terms, and is between the customer that has accepted the Terms (as defined below) (“Covered Entity”) and Eggmed Inc (“Business Associate”). Covered Entity may itself be a business associate, in which case this BAA applies to Eggmed as a subcontractor business associate with respect to PHI lawfully provided through Covered Entity. Each is a “Party” and together the “Parties.”
Background
I. Covered Entity is either a “covered entity” or “business associate” of a covered entity as each are defined under the Health Insurance Portability and Accountability Act of 1996, Public Law 104-191, as amended by the HITECH Act (as defined below) and the related regulations promulgated by HHS (as defined below) (collectively, “HIPAA”) and, as such, is required to comply with HIPAA’s provisions regarding the confidentiality and privacy of Protected Health Information (as defined below);
II. The Parties have entered into or will enter into Eggmed’s Terms and Conditions published at www.eggmed.com/terms-and-conditions, as updated from time to time (the “Terms”), together with each Order Form and the other documents incorporated into the Terms, under which Business Associate provides services to Covered Entity (collectively, the “Agreement”). The Terms incorporate this BAA by reference;
III. In providing services pursuant to the Agreement, Business Associate will have access to Protected Health Information;
IV. By providing the services pursuant to the Agreement, Business Associate will become a “business associate” of the Covered Entity as such term is defined under HIPAA;
V. Both Parties are committed to complying with all federal and state laws governing the confidentiality and privacy of health information, including, but not limited to, the Standards for Privacy of Individually Identifiable Health Information found at 45 CFR Part 160 and Part 164, Subparts A and E (collectively, the “Privacy Rule”); and
VI. Both Parties intend to protect the privacy and provide for the security of Protected Health Information disclosed to Business Associate pursuant to the terms of this BAA, HIPAA and other applicable laws.
Agreement
NOW, THEREFORE, in consideration of the mutual covenants and conditions contained herein and the continued provision of PHI by Covered Entity to Business Associate under the Agreement in reliance on this BAA, the Parties agree as follows:
1. Definitions
For purposes of this BAA, the Parties give the following meaning to each of the terms in this Section 1 below. Any capitalized term used in this BAA, but not otherwise defined, has the meaning given to that term in the Privacy Rule or pertinent law.
A. “Affiliate” means a subsidiary or affiliate of Covered Entity that is, or has been, considered a covered entity, as defined by HIPAA.
B. “Breach” means the acquisition, access, use, or disclosure of PHI in a manner not permitted under the Privacy Rule which compromises the security or privacy of the PHI, as defined in 45 CFR §164.402.
C. “Breach Notification Rule” means the portion of HIPAA set forth in Subpart D of 45 CFR Part 164.
D. “Data Aggregation” means, with respect to PHI created or received by Business Associate in its capacity as the “business associate” under HIPAA of Covered Entity, the combining of such PHI by Business Associate with the PHI received by Business Associate in its capacity as a business associate of one or more other “covered entity” under HIPAA, to permit data analyses that relate to the Health Care Operations (defined below) of the respective covered entities. The meaning of “data aggregation” in this BAA shall be consistent with the meaning given to that term in the Privacy Rule.
E. “Designated Record Set” has the meaning given to such term in 45 CFR §164.501.
F. “De-Identify” means to alter the PHI such that the resulting information meets the requirements described in 45 CFR §§164.514(a) and (b).
G. “Electronic PHI” means any PHI maintained in or transmitted by electronic media as defined in 45 CFR §160.103.
H. “Health Care Operations” has the meaning given to that term in 45 CFR §164.501.
I. “HHS” means the U.S. Department of Health and Human Services.
J. “HITECH Act” means the Health Information Technology for Economic and Clinical Health Act, enacted as part of the American Recovery and Reinvestment Act of 2009, Public Law 111-005.
K. “Individual” has the meaning given in 45 CFR §160.103 and includes a personal representative under 45 CFR §164.502(g).
L. “Privacy Rule” means that portion of HIPAA set forth in 45 CFR Part 160 and Part 164, Subparts A and E.
M. “Protected Health Information” or “PHI” has the meaning in 45 CFR §160.103, limited to information created, received, maintained, or transmitted by Business Associate on behalf of Covered Entity.
N. “Security Incident” means the attempted or successful unauthorized access, use, disclosure, modification, or destruction of information or interference with system operations in an information system.
O. “Security Rule” means the Security Standards for the Protection of Electronic Health Information provided in 45 CFR Part 160 & Part 164, Subparts A and C.
P. “Unsecured Protected Health Information” or “Unsecured PHI” means any “protected health information” as defined in 45 CFR §§164.501 and 160.103 that is not rendered unusable, unreadable or indecipherable to unauthorized individuals through the use of a technology or methodology specified by the HHS Secretary in the guidance issued pursuant to the HITECH Act and codified at 42 USC §17932(h).
2. Use and Disclosure of PHI.
A. Except as otherwise provided in this BAA, Business Associate may use or disclose PHI as reasonably necessary to provide the services described in the Agreement to Covered Entity, and to undertake other activities of Business Associate permitted or required of Business Associate by this BAA or as required by law.
B. Except as otherwise limited by this BAA or federal or state law, Covered Entity authorizes Business Associate to use the PHI in its possession for the proper management and administration of Business Associate’s business and to carry out its legal responsibilities. Business Associate may disclose PHI for its proper management and administration, provided that (i) the disclosures are required by law; or (ii) Business Associate obtains, in writing, prior to making any disclosure to a third party (a) reasonable assurances from this third party that the PHI will be held confidential as provided under this BAA and used or further disclosed only as required by law or for the purpose for which it was disclosed to this third party and (b) an agreement from this third party to notify Business Associate immediately of any breaches of the confidentiality of the PHI, to the extent it has knowledge of the breach.
C. Business Associate will not use or disclose PHI in a manner other than as provided in this BAA, as permitted under the Privacy Rule, or as required by law. Business Associate will use or disclose PHI, to the extent practicable, as a limited data set or limited to the minimum necessary amount of PHI to carry out the intended purpose of the use or disclosure, in accordance with Section 13405(b) of the HITECH Act (codified at 42 USC §17935(b)) and any of the act’s implementing regulations adopted by HHS, for each use or disclosure of PHI.
D. Upon request, Business Associate will make available to Covered Entity any of Covered Entity’s PHI that Business Associate or any of its agents or subcontractors have in their possession.
E. Business Associate may use PHI to report violations of law to appropriate Federal and State authorities, consistent with 45 CFR §164.502(j)(1).
F. Covered Entity authorizes Business Associate to use PHI to create De-Identified information in accordance with 45 CFR §164.514(a) and (b), and to provide Data Aggregation services relating to the Health Care Operations of Covered Entity and the respective covered entities whose PHI is combined. De-Identified information is not PHI and is not subject to this BAA. Business Associate may use De-Identified information during and after the Agreement as permitted by Sections 5.6, 5.7 and 10.1 of the Terms, subject to applicable law.
3. Safeguards Against Misuse of PHI
Business Associate will use appropriate safeguards to prevent the use or disclosure of PHI other than as provided by the Agreement or this BAA and Business Associate agrees to implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity and availability of the Electronic PHI that it creates, receives, maintains or transmits on behalf of Covered Entity. Business Associate agrees to take reasonable steps, including providing adequate training to its employees to ensure compliance with this BAA and to ensure that the actions or omissions of its employees or agents do not cause Business Associate to breach the terms of this BAA. Business Associate will comply with Subpart C of 45 CFR Part 164 with respect to Electronic PHI. To the extent Business Associate carries out an obligation of Covered Entity under Subpart E of 45 CFR Part 164, Business Associate will comply with the requirements of that Subpart that apply to Covered Entity in performing that obligation.
4. Reporting Disclosures of PHI and Security Incidents
Business Associate will report to Covered Entity in writing any use or disclosure of PHI not provided for by this BAA of which it becomes aware and Business Associate agrees to report to Covered Entity any Security Incident affecting Electronic PHI of Covered Entity of which it becomes aware. Business Associate agrees to report any such event within five business days of becoming aware of the event. The Parties agree that this Section 4 is notice, without further reporting, of the ongoing existence of unsuccessful Security Incidents, such as pings, port scans, denial-of-service attempts, and unsuccessful log-on attempts, that do not result in unauthorized access to, or use, disclosure, modification or destruction of, Electronic PHI.
5. Reporting Breaches of Unsecured PHI
Business Associate will notify Covered Entity in writing promptly upon the discovery of any Breach of Unsecured PHI in accordance with the requirements set forth in 45 CFR §164.410, but in no case later than 30 calendar days after discovery of a Breach. Contractual monetary liability arising from a Breach is governed by Section 16.C.
6. Mitigation of Disclosures of PHI
Business Associate will take reasonable measures to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of any use or disclosure of PHI by Business Associate or its agents or subcontractors in violation of the requirements of this BAA.
7. Agreements with Agents or Subcontractors
Business Associate will ensure that any of its agents or subcontractors that have access to, or to which Business Associate provides, PHI agree in writing to the restrictions and conditions concerning uses and disclosures of PHI contained in this BAA and agree to implement reasonable and appropriate safeguards to protect any Electronic PHI that it creates, receives, maintains or transmits on behalf of Business Associate or, through the Business Associate, Covered Entity. Upon written request, Business Associate will provide Covered Entity, or upstream Business Associate, with a list of its agents and subcontractors that receive or maintain PHI under Section 1.M within ten (10) business days of the request. Business Associate shall ensure that all subcontracts and agreements provide the same level of privacy and security as this BAA.
8. Audit report
Upon written request, Business Associate will provide Covered Entity, or upstream Business Associate, with a summary of its then-current administrative, physical, and technical safeguards and any independent third-party security assessment report it then holds and may lawfully disclose, subject to reasonable confidentiality and security protections. Business Associate may redact information concerning other customers or sensitive security details and provide a relevant summary where report licensing restricts disclosure. No named certification, independent audit, or assessment is promised by this Section. Covered Entity may disclose these materials only to personnel and professional advisers with a need to know and confidentiality obligations, or as required by law, including to regulators.
9. Access to PHI by Individuals
A. Upon request, Business Associate agrees to furnish Covered Entity with copies of the PHI maintained by Business Associate in a Designated Record Set in the time and manner designated by Covered Entity to enable Covered Entity to respond to an Individual’s request for access to PHI under 45 CFR §164.524.
B. In the event any Individual or personal representative requests access to the Individual’s PHI directly from Business Associate, Business Associate within ten business days, will forward that request to Covered Entity. Any disclosure of, or decision not to disclose, the PHI requested by an Individual or a personal representative and compliance with the requirements applicable to an Individual’s right to obtain access to PHI shall be the sole responsibility of Covered Entity.
10. Amendment of PHI
A. Upon request and instruction from Covered Entity, Business Associate will amend PHI or a record about an Individual in a Designated Record Set that is maintained by, or otherwise within the possession of, Business Associate as directed by Covered Entity in accordance with procedures established by 45 CFR §164.526. Any request by Covered Entity to amend such information will be completed by Business Associate within 15 business days of Covered Entity’s request.
B. In the event that any Individual requests that Business Associate amend such Individual’s PHI or record in a Designated Record Set, Business Associate within ten business days will forward this request to Covered Entity. Any amendment of, or decision not to amend, the PHI or record as requested by an Individual and compliance with the requirements applicable to an Individual’s right to request an amendment of PHI will be the sole responsibility of Covered Entity.
11. Accounting of Disclosures
A. Business Associate will document any disclosures of PHI made by it to account for such disclosures as required by 45 CFR §164.528(a). Business Associate also will make available information related to such disclosures as would be required for Covered Entity to respond to a request for an accounting of disclosures in accordance with 45 CFR §164.528. At a minimum, Business Associate will furnish Covered Entity the following with respect to any covered disclosures by Business Associate:
(i) the date of disclosure of PHI;
(ii) the name of the entity or person who received PHI, and, if known, the address of such entity or person;
(iii) a brief description of the PHI disclosed; and
(iv) a brief statement of the purpose of the disclosure which includes the basis for such disclosure.
B. Business Associate will furnish to Covered Entity information collected in accordance with this Section 11, within ten business days after written request by Covered Entity, to permit Covered Entity to make an accounting of disclosures as required by 45 CFR §164.528, or in the event that Covered Entity elects to provide an Individual with a list of its business associates, Business Associate will provide an accounting of its disclosures of PHI upon request of the Individual, if and to the extent that such accounting is required under the HITECH Act or under HHS regulations adopted in connection with the HITECH Act.
C. In the event an Individual delivers the initial request for an accounting directly to Business Associate, Business Associate will within ten business days forward such request to Covered Entity.
12. Availability of Books and Records
Business Associate will make available its internal practices, books, agreements, records, and policies and procedures relating to the use and disclosure of PHI, upon request, to the Secretary of HHS for purposes of determining Covered Entity’s and Business Associate’s compliance with HIPAA, and this BAA.
13. Responsibilities of Covered Entity
With regard to the use and/or disclosure of Protected Health Information by Business Associate, Covered Entity agrees to:
A. Notify Business Associate of any limitation(s) in its notice of privacy practices in accordance with 45 CFR §164.520, to the extent that such limitation may affect Business Associate’s use or disclosure of PHI.
B. Notify Business Associate of any changes in, or revocation of, permission by an Individual to use or disclose Protected Health Information, to the extent that such changes may affect Business Associate’s use or disclosure of PHI.
C. Notify Business Associate of any restriction to the use or disclosure of PHI that Covered Entity has agreed to in accordance with 45 CFR §164.522, to the extent that such restriction may affect Business Associate’s use or disclosure of PHI.
D. Except for data aggregation or management and administrative activities of Business Associate, Covered Entity shall not request Business Associate to use or disclose PHI in any manner that would not be permissible under HIPAA if done by Covered Entity.
E. Covered Entity is responsible for its own compliance with HIPAA and with all other applicable federal and state health privacy laws, including obtaining any patient consents or authorizations required by applicable law.
14. Data Ownership
Business Associate does not acquire ownership of Covered Entity’s PHI by providing the services under the Agreement. Business Associate’s rights in De-Identified information and its underlying technology are governed by Section 2.F of this BAA and Sections 5.6, 5.7 and 10.1 of the Terms.
15. Terms and Terminations
A. This BAA will become effective on the Effective Date, and will continue in effect until all obligations of the Parties have been met under the Agreement and under this BAA.
B. Covered Entity may terminate this BAA and the affected services under the Agreement if Business Associate materially breaches this BAA and fails to cure within thirty (30) days after written notice describing the breach. Where applicable law requires earlier action or the breach cannot be cured, Covered Entity may terminate affected services sooner to the extent reasonably necessary. Covered Entity may report the problem to the Secretary of HHS if termination is not feasible. Unaffected services and agreements do not terminate solely under this Section.
C. If Business Associate determines that Covered Entity has breached a material term of this BAA, then Business Associate will provide Covered Entity with written notice of the existence of the breach and shall provide Covered Entity with 30 days to cure the breach. Covered Entity’s failure to cure the breach within the 30-day period will be grounds for immediate termination of the Agreement and this BAA by Business Associate. Business Associate may report the breach to HHS.
D. Upon termination of the Agreement or this BAA for any reason, Business Associate will retain Covered Entity’s PHI for a period of sixty (60) days, during which Covered Entity may export it through the standard export process and the protections of this BAA continue to apply to it. At the end of that period, Business Associate will return, destroy or De-Identify all PHI maintained by Business Associate, and will not retain any copies of PHI that has not been De-Identified, except as provided below where return or destruction is infeasible. Business Associate will fulfill a timely request for return before disposing of the requested PHI. Legally required PHI access or return will not be conditioned on payment. This provision will apply to PHI in the possession of Business Associate’s agents and subcontractors. If return or destruction of the PHI is not feasible, in Business Associate’s reasonable judgment, Business Associate will furnish Covered Entity with notification, in writing, of the conditions that make return or destruction infeasible. Upon mutual agreement of the Parties that return or destruction of the PHI is infeasible, Business Associate will extend the protections of this BAA to such information for as long as Business Associate retains such information and will limit further uses and disclosures to those purposes that make the return or destruction of the information not feasible. The Parties understand that this Section 15.D. will survive any termination of this BAA.
16. Effects of BAA
A. This BAA forms part of the Agreement and controls, consistent with Section 2.2 of the Terms, any conflict between this BAA and the Terms, any Order Form, the Privacy Policy, or the Documentation concerning the use, disclosure, safeguarding, access, incident notification, retention, and return or destruction of PHI. Contractual monetary liability is governed by Section 16.C of this BAA and Section 14 of the Terms.
B. Except as expressly stated in this BAA or as provided by law, this BAA will not create any rights in favor of any third party.
C. Contractual monetary liability under this BAA, including claims arising from a breach, is subject to the exclusions and the single aggregate cap in Section 14 of the Terms. No separate, cumulative, or enhanced PHI or confidentiality cap applies unless expressly agreed in a writing signed by both Parties. Nothing in this BAA limits or excludes any liability that cannot be limited or excluded under applicable law.
17. Regulatory References
A reference in this BAA to a section in HIPAA means the section as in effect or as amended at the time.
18. Notices
All notices, requests, and communications under this BAA must be in writing and delivered by email, personal delivery, or recognized courier to the following contacts, or replacement contacts designated in writing: Business Associate: legal@eggmed.com, with a copy to Eggmed Inc, 3164 21st St #1195, Long Island City, NY 11106; Covered Entity: the email address associated with Covered Entity’s Eggmed account or specified in the applicable Order Form. Incident and breach reports may be sent by email without a separate courier copy. Electronic delivery is effective on confirmed delivery or the next business day after transmission without a failure notice; failed delivery requires a prompt alternative delivery method.
19. Amendments and Waiver
This BAA may not be modified, nor will any provision be waived or amended, except in writing duly signed by authorized representatives of the Parties. A waiver with respect to one event shall not be construed as continuing, or as a bar to or waiver of any right or remedy as to subsequent events. Notwithstanding the foregoing, Business Associate may update this BAA by posting the updated version at www.eggmed.com/business-associate-agreement and notifying Covered Entity by email at least thirty (30) days before the update takes effect, and Covered Entity’s continued use of the services after the update takes effect constitutes acceptance; provided that no such update may reduce the protections for PHI required by HIPAA. Changes required by law may take effect on shorter notice where necessary to comply with law.
20. HITECH Act Compliance
Each Party will comply with the provisions of HIPAA and the HITECH Act, and their implementing regulations, that apply to it, as in effect from time to time. If a change in HIPAA, the HITECH Act, or their implementing regulations requires a change to this BAA, Business Associate may update this BAA to the extent required to comply, as provided in Section 19, and the Parties will otherwise negotiate in good faith to amend this BAA as reasonably necessary. If the Parties cannot agree on an amendment required by law, either Party may terminate this BAA and the affected services upon thirty (30) days’ prior written notice to the other Party.
21. Other Applicable Health Privacy Requirements
Covered Entity is responsible for identifying records subject to 42 CFR Part 2 or other special health-privacy restrictions and providing required permissions and lawful instructions. Each Party will comply with requirements applicable to its processing of those records. Additional services, configurations, or customer-specific requirements must be expressly agreed in writing.
Acceptance
Covered Entity accepts this BAA by checking the acceptance box when creating an Eggmed account, or by otherwise accepting the Terms, which incorporate this BAA by reference. No signature is required. The individual who accepts on behalf of Covered Entity represents that they are authorized to bind Covered Entity. Business Associate will keep a record of each acceptance, including the date, time, and version accepted. Upon acceptance, this BAA supersedes any prior business associate agreement between the Parties relating to the Agreement.
