Template agreement under which Care Tales handles protected health information on a customer's behalf.
This is the template Care Tales offers. The version that binds the parties is the one they sign, with the bracketed details completed.
This Business Associate Agreement (the "Agreement") is entered into by and between:
Covered Entity or Business Associate: [CUSTOMER LEGAL NAME], a [STATE AND ENTITY TYPE], with its principal place of business at [CUSTOMER ADDRESS] (the "Customer"); and
Business Associate: Care Tales, Inc., a [STATE OF INCORPORATION] corporation, with its principal place of business at [CARE TALES ADDRESS] ("Care Tales").
Effective as of [EFFECTIVE DATE] (the "BAA Effective Date").
This Agreement supplements and is made part of the [NAME OF UNDERLYING AGREEMENT, E.G. MASTER SUBSCRIPTION AGREEMENT] between the parties dated [DATE] (the "Underlying Agreement"). Where the Customer is itself a business associate of a covered entity rather than a covered entity, Care Tales is a subcontractor under 45 CFR 164.502(e)(1)(ii) and this Agreement applies with the words "Covered Entity" read as "Customer" throughout.
1.1 Capitalized terms used but not defined in this Agreement have the meanings given to them in the Health Insurance Portability and Accountability Act of 1996, the Health Information Technology for Economic and Clinical Health Act, and their implementing regulations at 45 CFR Parts 160 and 164 (together, the "HIPAA Rules").
1.2 Without limiting clause 1.1, the following terms have the meanings set out in the HIPAA Rules: Breach, Business Associate, Covered Entity, Data Aggregation, Designated Record Set, Disclosure, Electronic Protected Health Information, Health Care Operations, Individual, Minimum Necessary, Notice of Privacy Practices, Protected Health Information, Required By Law, Secretary, Security Incident, Subcontractor, Unsecured Protected Health Information and Use.
1.3 "PHI" means Protected Health Information, including Electronic Protected Health Information, that Care Tales creates, receives, maintains or transmits for or on behalf of the Customer under the Underlying Agreement.
1.4 "Services" means the patient education platform and related services Care Tales provides under the Underlying Agreement.
2.1 Care Tales may Use and Disclose PHI only:
(a) to perform the Services, and as otherwise permitted or required by this Agreement or the Underlying Agreement;
(b) as Required By Law;
(c) for the proper management and administration of Care Tales, or to carry out its legal responsibilities, provided that where Care Tales discloses PHI for those purposes it either obtains reasonable assurances in writing from the recipient that the PHI will be held confidentially and used or further disclosed only as Required By Law or for the purpose for which it was disclosed and that the recipient will notify Care Tales of any breach of confidentiality, or the disclosure is Required By Law; and
(d) to provide Data Aggregation services relating to the Health Care Operations of the Customer, if requested by the Customer.
2.2 Care Tales may de-identify PHI in accordance with 45 CFR 164.514(a) to (c). Information de-identified in that manner is not PHI and is not subject to this Agreement. Care Tales' current aggregate reporting surfaces a chat term to the Customer only once it has appeared in at least three separate conversations, and raw patient messages are not exported for reporting.
2.3 Care Tales will not Use or Disclose PHI in a manner that would violate Subpart E of 45 CFR Part 164 if done by the Customer, except as permitted by clause 2.1(c).
2.4 Care Tales will not sell PHI, and will not Use or Disclose PHI for marketing or for the creation of psychographic or advertising profiles.
2.5 Care Tales will not use PHI to train machine learning models, and will not permit a Subcontractor to do so. Care Tales uses Google Gemini models to generate responses and content as described in its AI disclosure. PHI is transmitted only to Gemini on Google Cloud Vertex AI, a service eligible under Google's business associate agreement, and is processed to return a result for the Customer's patient and not for model improvement.
2.6 Care Tales will limit its Use, Disclosure and requests for PHI to the Minimum Necessary to accomplish the intended purpose, consistent with 45 CFR 164.502(b).
3.1 Safeguards. Care Tales will use appropriate administrative, physical and technical safeguards and will comply with Subpart C of 45 CFR Part 164 with respect to Electronic Protected Health Information, to prevent Use or Disclosure of PHI other than as provided for by this Agreement. The measures in place as of the BAA Effective Date are described in the Care Tales security overview at [URL], which is incorporated by reference. That document also lists, honestly, the controls Care Tales has not yet implemented, including the absence of a SOC 2 report, an external penetration test, a Content Security Policy, a production access log of staff reads of patient data and an automated retention schedule. The Customer acknowledges that it has read that list.
3.2 Mitigation. Care Tales will mitigate, to the extent practicable, any harmful effect known to it of a Use or Disclosure of PHI by Care Tales in violation of this Agreement.
3.3 Workforce. Care Tales will require each member of its workforce with access to PHI to be trained on its obligations under this Agreement, to be bound by confidentiality obligations that survive the end of their engagement and to authenticate with two factor authentication, which Care Tales requires for every staff and provider role.
3.4 Compliance with the Customer's restrictions. Care Tales will comply with any restriction on the Use or Disclosure of PHI that the Customer has agreed to under 45 CFR 164.522, and with the relevant requirements of the Customer's Notice of Privacy Practices, in each case to the extent the Customer notifies Care Tales of the restriction or requirement in writing and the restriction is technically capable of being honored in the Services. Care Tales will tell the Customer promptly if a notified restriction cannot be honored.
4.1 Breach. Care Tales will notify the Customer of any Breach of Unsecured PHI without unreasonable delay and in no case later than forty-eight (48) hours after Discovery. That first notice carries what is known at the time. Care Tales will then provide the full report described in clause 4.4 as soon as the information is available and in no case later than ten (10) calendar days after Discovery. The same two windows apply under clause 10 of the Care Tales data processing addendum, so one incident produces one set of deadlines.
4.2 Other incidents. Care Tales will report to the Customer any Use or Disclosure of PHI not permitted by this Agreement, and any Security Incident of which it becomes aware, on the same timetable as clause 4.1.
4.3 Unsuccessful incidents. Unsuccessful attempts at unauthorized access that result in no access to or Use or Disclosure of PHI, such as port scans, failed log-in attempts and denied network traffic, occur routinely. This clause is notice of them. Care Tales will report them only in aggregate and only on written request, no more than quarterly.
4.4 Contents of a report. The full report under clause 4.1 will include, to the extent then known and with updates as further information becomes available: the nature of the incident, the date of the incident and the date of Discovery, the categories and approximate number of Individuals and records affected, the types of PHI involved, the steps Care Tales has taken to investigate and mitigate and a contact for further information. The first notice will carry as much of this as is known when it is sent. Care Tales will cooperate with the Customer's investigation and will provide the information the Customer reasonably needs to make its own notifications.
4.5 Notification to Individuals. Unless the parties agree otherwise in writing, the Customer is responsible for notifying Individuals, the Secretary and the media where required by 45 CFR 164.404 to 164.408. Care Tales will not notify Individuals directly without the Customer's prior written consent, except where Required By Law.
5.1 Care Tales will ensure that any Subcontractor that creates, receives, maintains or transmits PHI on its behalf agrees in writing to restrictions and conditions at least as protective as those that apply to Care Tales under this Agreement, in accordance with 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2).
5.2 The Subcontractors engaged as of the BAA Effective Date are listed in the Care Tales subprocessors page at [URL]. Care Tales will maintain that page and will give the Customer at least 30 days notice by email before a new Subcontractor begins processing PHI, except where a Subcontractor must be engaged sooner to prevent or resolve a security or availability incident. The Customer may object on reasonable grounds within the notice period, in which case the parties will work in good faith to find an alternative, and if none is available the Customer may terminate the affected part of the service without penalty for the remainder of the paid term.
5.3 Care Tales remains responsible to the Customer for the acts and omissions of its Subcontractors with respect to PHI as if they were its own.
6.1 Access. Care Tales will, within ten (10) business days of a written request from the Customer, make available to the Customer the PHI in a Designated Record Set that Care Tales holds, so that the Customer can meet its obligations under 45 CFR 164.524.
6.2 Amendment. Care Tales will, within ten (10) business days of a written request from the Customer, make any amendment to PHI in a Designated Record Set that the Customer directs or agrees to under 45 CFR 164.526.
6.3 Accounting. Care Tales will document Disclosures of PHI and information relating to those Disclosures as would be required for the Customer to respond to a request for an accounting under 45 CFR 164.528, and will provide that information to the Customer within twenty (20) business days of a written request. The Customer acknowledges that Care Tales does not currently maintain a production access log of reads of patient data by its own staff other than internal connector calls, and that an accounting will therefore be assembled from the records that do exist.
6.4 Requests received directly. If Care Tales receives a request from an Individual to exercise a right under Subpart E of 45 CFR Part 164, it will not respond on the merits and will forward the request to the Customer within five business days, unless Required By Law to do otherwise. The parties acknowledge that Care Tales generally cannot identify a patient who has used the Services without an account, and that the Customer is the party able to link a request to a record.
Care Tales will make its internal practices, books and records relating to the Use and Disclosure of PHI available to the Secretary for purposes of determining the Customer's compliance with the HIPAA Rules. Care Tales will notify the Customer of any such request as soon as it is legally permitted to do so.
8.1 The Customer will not request Care Tales to Use or Disclose PHI in any manner that would not be permissible under the HIPAA Rules if done by the Customer, except as permitted by clause 2.1(c).
8.2 The Customer will notify Care Tales in writing of any limitation in its Notice of Privacy Practices, any change in or revocation of an Individual's permission to Use or Disclose PHI and any restriction agreed under 45 CFR 164.522, in each case to the extent it affects Care Tales' Use or Disclosure of PHI.
8.3 The Customer is responsible for the content it places in the Services, including module material, its organization system prompt and its knowledge base, for deciding which of its workforce receives provider access, for removing that access when it is no longer required and for telling its patients how it uses the Services, including that chat conversations are recorded and that responses are generated by an AI model.
8.4 The Customer acknowledges that the record set may include which condition specific module a patient opened, survey answers, free text rating comments and verbatim chat messages.
9.1 Term. This Agreement begins on the BAA Effective Date and continues until all PHI is returned or destroyed in accordance with clause 9.4, or until terminated as provided below.
9.2 Termination for cause by the Customer. If Care Tales materially breaches this Agreement, the Customer may provide written notice of the breach and an opportunity to cure within thirty (30) days. If Care Tales does not cure within that period, the Customer may terminate this Agreement and the Underlying Agreement. If cure is not possible, the Customer may terminate immediately.
9.3 Termination for cause by Care Tales. If the Customer materially breaches this Agreement, Care Tales has the same rights of notice, cure and termination.
9.4 Return or destruction. On termination, Care Tales will return or destroy all PHI it holds, including PHI held by its Subcontractors, and will retain no copies, to the extent feasible. Care Tales will do so within thirty (30) days of termination or of the Customer's written instruction, whichever is later and will confirm completion in writing.
9.5 Where return or destruction is infeasible. If return or destruction is infeasible, Care Tales will notify the Customer in writing, explain why, extend the protections of this Agreement to the retained PHI for as long as it is retained and limit further Uses and Disclosures to the purposes that make return or destruction infeasible. Care Tales will destroy the retained PHI when those purposes end. The parties acknowledge that weekly database backups are kept for 98 days after deletion from the production systems and that Care Tales has no automated retention schedule for patient data, so deletion must be requested.
9.6 Effect on the Underlying Agreement. Termination of this Agreement does not by itself terminate the Underlying Agreement, but the Customer may terminate the Underlying Agreement where it terminates this Agreement for cause.
10.1 Survival. Clauses 2, 3.2, 4, 6.3, 7, 9.4, 9.5 and this clause 10 survive termination of this Agreement for as long as Care Tales holds PHI, and any provision that by its nature should survive does so.
10.2 Regulatory change. The parties will negotiate in good faith to amend this Agreement as necessary for either party to comply with a change in the HIPAA Rules.
10.3 Interpretation. Any ambiguity in this Agreement is resolved in favor of a meaning that permits compliance with the HIPAA Rules. In the event of a conflict between this Agreement and the Underlying Agreement with respect to PHI, this Agreement controls.
10.4 No third party beneficiaries. Nothing in this Agreement confers any right on any person other than the parties.
10.5 Governing law. This Agreement is governed by the laws of [STATE], without regard to its conflict of laws rules, except to the extent preempted by federal law.
10.6 Notices. Notices under this Agreement are given in writing to the addresses below, and are effective on receipt. Notices to Care Tales may also be sent to support@caretales.com.
Customer notice address: [CUSTOMER NOTICE ADDRESS AND EMAIL]
Care Tales notice address: [CARE TALES NOTICE ADDRESS], with a copy to support@caretales.com.
10.7 Counterparts. This Agreement may be executed in counterparts and by electronic signature.
[CUSTOMER LEGAL NAME]
Signature: [SIGNATURE]
Name: [PRINT NAME]
Title: [TITLE]
Date: [DATE]
Care Tales, Inc.
Signature: [SIGNATURE]
Name: [PRINT NAME OF AUTHORIZED SIGNATORY]
Title: [TITLE]
Date: [DATE]
Questions about this Agreement, and executed copies, go to support@caretales.com.
This is a template. Care Tales may revise it for future customers at any time. A revision does not change an agreement already executed. Changes to an executed agreement require a written amendment signed by both parties, except where clause 10.2 applies.