Version: October 28, 2026
This Business Associate Agreement ("BAA") is entered into by and between the healthcare practice, clinic, or other HIPAA covered entity that creates a SIVIA Medical practice account ("Covered Entity" or "Customer") and SisaTech AI, Inc. ("Business Associate"). It is effective on the date the Customer's authorized representative accepts it while creating the practice account, and it forms part of the Terms of Service governing the Customer's use of the SIVIA Medical platform (the "Agreement"). By accepting this BAA, the person creating the account represents that he or she is authorized to bind the Covered Entity.
All capitalized terms used in this BAA and not otherwise defined shall have the meanings ascribed to them in the Health Insurance Portability and Accountability Act of 1996, as amended ("HIPAA"), the Health Information Technology for Economic and Clinical Health Act ("HITECH"), and their implementing regulations at 45 C.F.R. Parts 160 and 164 (the "HIPAA Rules").
(a) Permitted Uses: Business Associate shall not use or disclose PHI other than as permitted or required by this BAA or as required by law.
(b) Safeguards: Business Associate shall implement appropriate administrative, physical, and technical safeguards to prevent unauthorized use or disclosure of PHI, including compliance with the Security Rule (45 C.F.R. Part 164, Subpart C).
(c) Minimum Necessary: Business Associate shall limit its uses and disclosures of, and requests for, PHI to the minimum necessary to accomplish the intended purpose.
(d) Reporting: Business Associate shall report to Covered Entity any use or disclosure of PHI not provided for by this BAA of which it becomes aware, including any Breach of Unsecured PHI as required by 45 C.F.R. § 164.410, without unreasonable delay and in no event later than five (5) business days after discovery. Unsuccessful Security Incidents (such as pings, port scans, and blocked login attempts) that do not result in unauthorized access to PHI occur routinely, and this paragraph constitutes notice of such events.
(e) Subcontractors: Business Associate shall ensure that any subcontractors that create, receive, maintain, or transmit PHI on behalf of Business Associate agree in writing to the same restrictions and conditions that apply to Business Associate under this BAA. Business Associate's current subcontractors that process PHI are identified in the Privacy Policy.
(f) Access and Accounting: Business Associate shall make PHI available to Covered Entity as necessary to satisfy Covered Entity's obligations under 45 C.F.R. § 164.524, shall make PHI available for amendment and incorporate any amendments to PHI as directed or agreed to by Covered Entity in accordance with 45 C.F.R. § 164.526, shall, to the extent Business Associate carries out any of Covered Entity's obligations under the Privacy Rule, comply with the requirements that apply to Covered Entity in performing such obligations, and shall maintain and make available the information required to provide an accounting of disclosures in accordance with 45 C.F.R. § 164.528.
(g) HHS Access: Business Associate shall make its internal practices, books, and records relating to the use and disclosure of PHI available to the Secretary of HHS for purposes of determining compliance with the HIPAA Rules.
Business Associate may use and disclose PHI solely for the purpose of performing the services under the Agreement. Business Associate may de-identify PHI in accordance with 45 C.F.R. § 164.514(a)-(c) and use such de-identified data for internal product improvement, analytics, and research. Business Associate explicitly agrees not to use PHI or de-identified data derived from Covered Entity for algorithm training or foundational model development.
Covered Entity shall not request Business Associate to use or disclose PHI in any manner that would not be permissible under the HIPAA Rules if done by Covered Entity, shall notify Business Associate of any limitation in its notice of privacy practices and of any restriction or revocation of authorization that would affect Business Associate's use or disclosure of PHI, and is responsible for the Users it authorizes to access the platform and for the EHR connections it directs Business Associate to make on its behalf.
(a) Term: This BAA is effective for as long as the Customer's practice account exists and Business Associate holds PHI received from Covered Entity.
(b) Termination for Cause: Covered Entity may terminate this BAA and the Agreement immediately if it determines Business Associate has violated a material term of this BAA and cure is not feasible, or if Business Associate fails to cure such violation within thirty (30) days of written notice.
(c) Return or Destruction: Upon termination of the Agreement and expiration of the data export period described in the Terms of Service (including delivery of any export timely requested), Business Associate shall securely delete or destroy all live PHI received from Covered Entity within thirty (30) days. If return or destruction is not feasible (e.g., in routine backup archives), Business Associate shall extend the protections of this BAA to such PHI and limit further uses and disclosures to those purposes that make the return or destruction infeasible. Backup archives containing PHI shall be securely deleted in accordance with Business Associate's standard retention schedule, not to exceed ninety (90) days. Notwithstanding the foregoing, Business Associate may permanently retain de-identified analytics and performance data generated during the term, provided such data has been de-identified in accordance with 45 C.F.R. § 164.514(a)-(c).
The Parties agree to take such action as is necessary to amend this BAA from time to time as is necessary for compliance with the requirements of the HIPAA Rules and any other applicable law. Any ambiguity in this BAA shall be resolved to permit compliance with the HIPAA Rules. In the event of a conflict between this BAA and the Terms of Service with respect to PHI, this BAA controls. A Customer that has executed a separately negotiated Master Services Agreement and BAA with SisaTech AI, Inc. is governed by that signed agreement, which supersedes this BAA.
Questions about this BAA: support@sisatech.ai