Business Associate Agreement

Business Associate Agreement (BAA)

1. Definitions

Terms used but not defined in this BAA have the meanings given to them under HIPAA, including the HIPAA Privacy Rule (45 CFR Part 164, Subparts A and E) and the HIPAA Security Rule (45 CFR Part 164, Subparts A and C).

"Protected Health Information" or "PHI"

Individually identifiable health information transmitted or maintained in any form or medium by CaseBench on behalf of the Covered Entity, as defined in 45 CFR §160.103. This includes, but is not limited to, patient references, clinical notes, STL files, dental radiographs, treatment plans, and clinical photographs uploaded to the platform.

"Electronic Protected Health Information" or "ePHI"

PHI that is created, stored, transmitted, or received electronically.

"Breach"

Has the meaning given in 45 CFR §164.402.

"Security Incident"

Has the meaning given in 45 CFR §164.304.

2. Permitted Uses and Disclosures by Business Associate

CaseBench may use or disclose PHI only as follows:

a) To provide services. CaseBench may use and disclose PHI as necessary to provide the CaseBench platform, including case coordination, secure file sharing, workflow management, communication between the Covered Entity and independent providers, platform security, audit logging, backup and disaster recovery, and administrative support access as described in Section 3(k).

b) As required by law. CaseBench may use or disclose PHI as required by applicable law, including HIPAA.

c) For Business Associate's operations. CaseBench may use PHI for its own proper management and administration, or to carry out its legal responsibilities, provided that disclosures are required by law or CaseBench obtains reasonable assurances from the recipient that the PHI will be kept confidential.

d) No other uses or disclosures. CaseBench will not use or disclose PHI in any manner not permitted by this BAA or HIPAA.

3. Obligations of Business Associate

CaseBench agrees to:

a) Not use or disclose PHI other than as permitted or required by this BAA or applicable law.

b) Implement safeguards. Use appropriate administrative, physical, and technical safeguards to protect the confidentiality, integrity, and availability of ePHI, in accordance with the HIPAA Security Rule (45 CFR Part 164, Subpart C).

c) Report breaches and security incidents. Notify the Covered Entity of: any Breach of Unsecured PHI within 30 days of discovery, including the information required by 45 CFR §164.410; and any Security Incident of which CaseBench becomes aware, including attempted but unsuccessful incidents, in accordance with 45 CFR §164.314(a)(2)(i)(C). Reports should be directed to hello@casebench.io or to the contact provided by the Covered Entity.

d) Sub-processors and subcontractors. Ensure that any subcontractor or sub-processor that creates, receives, maintains, or transmits PHI on behalf of CaseBench agrees to the same restrictions and conditions as apply to CaseBench under this BAA. See §4 for disclosure of current PHI-accessing sub-processors.

e) Access and amendment. Provide access to PHI in a Designated Record Set to the Covered Entity or, as directed, to the individual, in accordance with 45 CFR §164.524. Accommodate requests to amend PHI in accordance with 45 CFR §164.526.

f) Accounting of disclosures. Make available the information required for the Covered Entity to provide an accounting of disclosures in accordance with 45 CFR §164.528.

g) Compliance assistance. Make its internal practices, books, and records relating to the use and disclosure of PHI available to the Secretary of Health and Human Services for purposes of determining compliance with HIPAA.

h) Minimum necessary. Use, disclose, or request only the minimum PHI necessary to accomplish the intended purpose.

i) No sale of PHI. CaseBench will not directly or indirectly receive remuneration in exchange for PHI, except as permitted under HIPAA.

j) No AI training on PHI. CaseBench will not use identifiable PHI to train artificial intelligence or machine learning models.

k) Administrative support access. CaseBench may permit a limited number of authorized platform administrators to temporarily access the platform as an authorized user of the Covered Entity would see it ("Support Access"), solely to provide support requested by the Covered Entity or its users, to investigate and resolve faults or reported issues, and to protect the security and integrity of the platform. During Support Access, administrators may view PHI and may take actions within a user's account where reasonably necessary for those purposes. CaseBench will ensure that:

• (i) Support Access is limited to authorized administrators who are members of CaseBench's workforce or bound by written confidentiality obligations no less protective than this BAA;
• (ii) Support Access is subject to the minimum necessary standard in Section 3(h), and administrators access only the PHI reasonably necessary for the purpose of the session;
• (iii) each session is time-limited, ends automatically, and requires a reason to be recorded before it begins;
• (iv) the start and end of each session, the administrator involved, and the stated reason are recorded in CaseBench's audit logs, and these records are made available to the Covered Entity on reasonable written request to hello@casebench.io; and
• (v) Support Access is never used for any purpose other than those set out in this clause.

Individual users are not currently notified of each Support Access session.

4. Sub-processors with Access to PHI

The following CaseBench sub-processors may have access to PHI in the course of providing platform services. CaseBench maintains appropriate agreements with each:

4.1 AI Sub-processors

CaseBench works with one or more AI providers to deliver AI-assisted case processing features. When a Covered Entity activates an AI job, case files and clinical metadata are transmitted to the relevant AI provider. This constitutes PHI disclosure to a subcontractor.

CaseBench maintains BAA-equivalent agreements with AI providers that access PHI. Covered Entities should not activate AI-assisted processing unless they have accepted this BAA and understand that PHI will be transmitted to the relevant AI provider under those protections.

CaseBench will maintain and make available an up-to-date list of AI sub-processors upon written request to hello@casebench.io.

5. Obligations of the Covered Entity

The Covered Entity agrees to:

a) Notify CaseBench of any restriction on the use or disclosure of PHI that the Covered Entity has agreed to in accordance with 45 CFR §164.522, to the extent such restriction may affect CaseBench's use or disclosure of PHI.

b) Notify CaseBench of any changes in or revocation of consent or authorization of individuals to use or disclose PHI, to the extent this affects CaseBench's permitted uses and disclosures.

c) Not request CaseBench to use or disclose PHI in any manner that would not be permissible under HIPAA if done by the Covered Entity.

d) Obtain all required patient authorizations and consents before uploading PHI to the CaseBench platform.

e) Implement appropriate access controls for its own users of the CaseBench platform and ensure that only authorized personnel upload or access PHI.

f) Use opaque patient references (e.g., a case number or initials) where clinically appropriate, rather than full patient names or other direct identifiers, to minimize PHI exposure on the platform.

6. Term and Termination

a) Term. This BAA is effective upon the Covered Entity's acceptance of the CaseBench Terms of Service or DPA, and remains in effect for the duration of the service relationship.

b) Termination for cause. Either party may terminate this BAA immediately if the other party materially breaches a HIPAA obligation and fails to cure the breach within 30 days of written notice.

c) Obligations on termination. Upon termination, CaseBench will, at the direction of the Covered Entity, return or destroy all PHI received from or created on behalf of the Covered Entity, to the extent feasible. Where return or destruction is not feasible (for example, PHI held in backup systems), CaseBench will extend the protections of this BAA to such PHI for as long as it is retained, and will limit further uses and disclosures to those purposes that make the return or destruction infeasible.

d) Data deletion. PHI deletion requests are fulfilled via a managed process within 30 days of written request to hello@casebench.io. Payment and audit records may be retained in pseudonymized form to meet legal and regulatory obligations.

7. Amendments

CaseBench may amend this BAA from time to time to remain compliant with HIPAA and other applicable law. Material changes will be communicated to Covered Entities with reasonable advance notice. Continued use of the platform following notice of an amendment constitutes acceptance.

8. Miscellaneous

a) Regulatory references. Any reference to a HIPAA regulation includes any amendments or successor provisions.

b) No third-party beneficiaries. This BAA is for the benefit of the parties only and does not create rights in any third party, including any patient.

c) Relationship to DPA. Where this BAA conflicts with the CaseBench DPA on matters relating to PHI, this BAA governs. In all other respects the DPA applies.

d) Governing law. This BAA is governed by the laws of the State of Delaware, USA, subject to applicable federal law including HIPAA.

e) Entire agreement. This BAA, together with the CaseBench DPA and Terms of Service, constitutes the entire agreement between the parties with respect to HIPAA compliance.

f) Severability. If any provision of this BAA is found unenforceable, the remaining provisions continue in full force.

9. Contact

To exercise rights under this BAA, report a Security Incident or Breach, request a list of AI sub-processors, or request a record of administrative support access:

Email: hello@casebench.io
Company: ClearPath Digital, Inc. (CaseBench)