Business Associate Agreement

COSMANEURA INC.

HIPAA BUSINESS ASSOCIATE AGREEMENT

(Click-Through Edition — Accepted Electronically During Provider Onboarding)

This Business Associate Agreement (this "BAA") is entered into by and between CosmaNeura Inc., a Delaware corporation ("Business Associate"), and the health care provider or organization identified in the account registration for Business Associate’s services ("Covered Entity") (each a "Party" and collectively the "Parties"). This BAA is effective as of the date on which Covered Entity accepts it by electronic means as described in Section 5.11 (the "Effective Date").

RECITALS

A. Covered Entity is a "covered entity" as that term is defined under the Health Insurance Portability and Accountability Act of 1996 (Public Law 104-191), as amended ("HIPAA"), and the regulations promulgated thereunder by the Secretary of the U.S. Department of Health and Human Services (the "Secretary"), including, without limitation, the regulations codified at 45 C.F.R. Parts 160 and 164 (the "HIPAA Regulations");

B. Business Associate performs Services for or on behalf of Covered Entity and, in performing such Services, creates, receives, maintains, or transmits Protected Health Information. Business Associate is a "business associate" of Covered Entity as that term is defined at 45 C.F.R. § 160.103;

C. The Parties intend to protect the privacy and provide for the security of PHI Disclosed by Covered Entity to Business Associate, or received or created by Business Associate on behalf of Covered Entity, in compliance with HIPAA, the Health Information Technology for Economic and Clinical Health Act (Public Law 111-5) (the "HITECH Act") and its implementing regulations and guidance issued by the Secretary, and other applicable state and federal laws, all as amended from time to time; and

D. Covered Entity is required under HIPAA to enter into a BAA with Business Associate that meets certain requirements with respect to the Use and Disclosure of PHI, which requirements are met by this BAA.

AGREEMENT

In consideration of the Recitals and for other good and valuable consideration, the receipt and adequacy of which are hereby acknowledged, the Parties agree as follows:

ARTICLE I — DEFINITIONS

The following terms have the meanings set forth below. Capitalized terms used in this BAA and not otherwise defined have the meanings ascribed to them in HIPAA, the HIPAA Regulations, or the HITECH Act, as applicable.

1.1. Breach. "Breach" has the meaning given at 42 U.S.C. § 17921(1) and 45 C.F.R. § 164.402.

1.2. Designated Record Set. "Designated Record Set" has the meaning given at 45 C.F.R. § 164.501.

1.3. Disclose and Disclosure. "Disclose" and "Disclosure" mean, with respect to PHI, the release, transfer, provision of access to, or divulging in any other manner of PHI outside of Business Associate or to persons other than members of its Workforce, as set forth in 45 C.F.R. § 160.103.

1.4. Electronic PHI. "Electronic PHI" or "e-PHI" means PHI that is transmitted or maintained in electronic media, as set forth in 45 C.F.R. § 160.103.

1.5. Protected Health Information. "Protected Health Information" and "PHI" mean any information, whether oral or recorded in any form or medium, that: (a) relates to the past, present or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present or future payment for the provision of health care to an individual; (b) identifies the individual (or for which there is a reasonable basis for believing the information can be used to identify the individual); and (c) has the meaning given to such term under the Privacy Rule, including, but not limited to, 45 C.F.R. § 160.103. PHI includes e-PHI. PHI does not include information that has been de-identified in accordance with 45 C.F.R. § 164.514(a)–(c).

1.6. Security Incident. "Security Incident" has the meaning given at 45 C.F.R. § 164.304.

1.7. Services. "Services" means the services and functions performed by Business Associate for or on behalf of Covered Entity as described in Exhibit A and pursuant to any service agreement(s) between the Parties in effect now or from time to time (the "Underlying Agreement"), or, if no such agreement is in effect, the services or functions performed by Business Associate that constitute a business associate relationship, as set forth in 45 C.F.R. § 160.103.

1.8. Subcontractor. "Subcontractor" has the meaning given at 45 C.F.R. § 160.103, and refers to a person or entity to whom Business Associate delegates a function, activity, or service involving the creation, receipt, maintenance, or transmission of PHI.

1.9. Unsecured PHI. "Unsecured PHI" has the meaning given at 42 U.S.C. § 17932(h), 45 C.F.R. § 164.402, and related guidance issued by the Secretary pursuant to the HITECH Act.

1.10. Unsuccessful Security Incident. "Unsuccessful Security Incident" means a Security Incident that does not result in unauthorized access to, or unauthorized acquisition, Use, or Disclosure of, PHI, including, without limitation, pings and other broadcast attacks on Business Associate’s firewall, port scans, unsuccessful log-on attempts, denials of service, and any combination of the foregoing.

1.11. Use. "Use" and "Uses" mean, with respect to PHI, the sharing, employment, application, utilization, examination, or analysis of such PHI within Business Associate’s internal operations, as set forth in 45 C.F.R. § 160.103.

1.12. Workforce. "Workforce" has the meaning given at 45 C.F.R. § 160.103.

ARTICLE II — OBLIGATIONS OF BUSINESS ASSOCIATE

2.1. Permitted Uses and Disclosures of PHI. Business Associate shall not Use or Disclose PHI other than for the purposes described in Exhibit A (Services and Permitted Purposes), for performing the Services, as permitted or required by this BAA, or as Required by Law. Business Associate shall not Use or Disclose PHI in any manner that would constitute a violation of Subpart E of 45 C.F.R. Part 164 if so Used or Disclosed by Covered Entity. Notwithstanding the foregoing, Business Associate may Use or Disclose PHI: (i) for the proper management and administration of Business Associate; (ii) to carry out the legal responsibilities of Business Associate, provided that, with respect to any such Disclosure, either (a) the Disclosure is Required by Law, or (b) Business Associate obtains a written agreement from the person to whom the PHI is to be Disclosed that such person will hold the PHI in confidence, will not Use or further Disclose such PHI except as Required by Law and for the purpose(s) for which it was Disclosed, and will notify Business Associate of any instances of which it is aware in which the confidentiality of the PHI has been breached; and (iii) to provide Data Aggregation services relating to the Health Care Operations of Covered Entity. To the extent that Business Associate carries out one or more of Covered Entity’s obligations under Subpart E of 45 C.F.R. Part 164, Business Associate shall comply with the requirements of Subpart E that apply to Covered Entity in the performance of such obligations.

2.2. De-Identification. Business Associate may de-identify PHI in accordance with 45 C.F.R. § 164.514(a)–(c). Information de-identified in accordance with such standards is no longer PHI, and Business Associate may Use and Disclose such de-identified information for any lawful business purpose, including developing, benchmarking, validating, and improving its products and services. Upon Covered Entity’s written request, Business Associate will provide a written description of its de-identification methodology.

2.3. Prohibited Marketing and Sale of PHI. Notwithstanding any other provision of this BAA: (i) Business Associate shall not Use or Disclose PHI for fundraising or marketing purposes, except to the extent expressly authorized or permitted by this BAA and consistent with the requirements of 42 U.S.C. § 17936, 45 C.F.R. § 164.514(f), and 45 C.F.R. § 164.508(a)(3); and (ii) Business Associate shall not directly or indirectly receive remuneration in exchange for PHI except with the prior written consent of Covered Entity and as permitted by the HITECH Act, 42 U.S.C. § 17935(d)(2), and 45 C.F.R. § 164.502(a)(5)(ii). For clarity, this Section does not prohibit payment of fees for Services under the Underlying Agreement or the activities permitted by Section 2.2.

2.4. Adequate Safeguards of PHI. Business Associate shall implement and maintain appropriate safeguards to prevent the Use or Disclosure of PHI other than as provided for by this BAA. Business Associate shall reasonably and appropriately protect the confidentiality, integrity, and availability of e-PHI that it creates, receives, maintains, or transmits on behalf of Covered Entity in compliance with Subpart C of 45 C.F.R. Part 164.

2.5. Mitigation. Business Associate shall mitigate, to the extent practicable, any harmful effect known to Business Associate of a Use or Disclosure of PHI by Business Associate in violation of this BAA.

2.6. Reporting Non-Permitted Uses, Disclosures, Security Incidents, and Breaches.

2.6.1 Security Incidents and Non-Permitted Uses or Disclosures. Business Associate shall report to Covered Entity in writing each Security Incident, and each Use or Disclosure of PHI made by Business Associate, members of its Workforce, or its Subcontractors that is not permitted by this BAA, no later than five (5) business days after Business Associate’s security or compliance personnel become aware of such Security Incident or non-permitted Use or Disclosure, in accordance with the notice provisions of this BAA. Business Associate shall investigate each such Security Incident or non-permitted Use or Disclosure to determine whether it constitutes a reportable Breach of Unsecured PHI, shall document and retain records of its investigation, and, upon Covered Entity’s request, shall furnish such documentation and its assessment to Covered Entity. If a reportable Breach of Unsecured PHI has occurred, Business Associate shall also comply with Section 2.6.2.

The Parties acknowledge the ongoing existence and occurrence of attempted but Unsuccessful Security Incidents, and agree that this Section constitutes notice by Business Associate to Covered Entity of such Unsuccessful Security Incidents, for which no additional or separate reporting shall be required; provided that, upon Covered Entity’s reasonable written request, Business Associate shall provide a summary of material Unsuccessful Security Incidents.

2.6.2 Breach of Unsecured PHI. If Business Associate determines that a reportable Breach of Unsecured PHI has occurred, Business Associate shall provide a written report to Covered Entity without unreasonable delay, and in no event later than thirty (30) calendar days after discovery of the Breach. To the extent information is available to Business Associate, the written report shall include the content described in 45 C.F.R. § 164.410(c), and Business Associate shall supplement the report as additional information becomes available. Business Associate shall cooperate with Covered Entity in meeting Covered Entity’s obligations under the HITECH Act with respect to such Breach. Covered Entity shall have final control over the timing, content, and method of providing notification of such Breach to affected individual(s), the Secretary, and, if applicable, the media, as required by the HITECH Act; provided that Covered Entity shall consult with Business Associate in good faith regarding such notification before it is made.

2.6.3 Breach Costs. To the extent a Breach of Unsecured PHI results from Business Associate’s violation of this BAA, Business Associate shall reimburse Covered Entity for its reasonable, documented, out-of-pocket costs of providing the notifications required by 45 C.F.R. §§ 164.404 through 164.408, including reasonable administrative, printing, and mailing costs. The costs of credit monitoring or identity-protection services shall be included only where required by applicable law or reasonably necessary in light of the nature of the PHI compromised. All amounts under this Section 2.6.3 are subject to the limitation of liability in Section 5.3.

2.7. Availability of Internal Practices, Books, and Records to Government. Business Associate shall make its internal practices, books, and records relating to the Use and Disclosure of PHI received from, created by, or received by Business Associate on behalf of Covered Entity available to the Secretary for purposes of determining Covered Entity’s compliance with HIPAA, the HIPAA Regulations, and the HITECH Act. Except to the extent prohibited by law, Business Associate shall notify Covered Entity of all requests served upon Business Associate for such information or documentation by or on behalf of the Secretary.

2.8. Access to and Amendment of PHI. To the extent that Business Associate maintains a Designated Record Set on behalf of Covered Entity, within fifteen (15) days of a request by Covered Entity, Business Associate shall (a) make the PHI it maintains (or which is maintained by its Subcontractors) in Designated Record Sets available to Covered Entity for inspection and copying, or to an individual, to enable Covered Entity to fulfill its obligations under 45 C.F.R. § 164.524, or (b) amend the PHI it maintains (or which is maintained by its Subcontractors) in Designated Record Sets to enable Covered Entity to fulfill its obligations under 45 C.F.R. § 164.526. Business Associate shall not Disclose PHI to a health plan for payment or Health Care Operations purposes if and to the extent that Covered Entity has informed Business Associate that the patient has requested this special restriction and has paid out of pocket in full for the health care item or service to which the PHI solely relates, consistent with 42 U.S.C. § 17935(a) and 45 C.F.R. § 164.522(a)(1)(vi). If Business Associate maintains PHI in a Designated Record Set electronically, Business Associate shall provide such information in the electronic form and format requested by Covered Entity if readily reproducible in such form and format and, if not, in such other form and format agreed to by Covered Entity, to enable Covered Entity to fulfill its obligations under 42 U.S.C. § 17935(e) and 45 C.F.R. § 164.524(c)(2). Business Associate shall notify Covered Entity within fifteen (15) days of its receipt of a request made directly to Business Associate for access to PHI.

2.9. Accounting. To the extent that Business Associate maintains a Designated Record Set on behalf of Covered Entity, within thirty (30) days of receipt of a request from Covered Entity or an individual for an accounting of Disclosures of PHI, Business Associate and its Subcontractors shall make available to Covered Entity the information required to provide an accounting of Disclosures, to enable Covered Entity to fulfill its obligations under 45 C.F.R. § 164.528 and 42 U.S.C. § 17935(c). Business Associate shall notify Covered Entity within fifteen (15) days of its receipt of a request made directly to Business Associate by an individual or other requesting party for an accounting of Disclosures of PHI.

2.10. Use of Subcontractors. Business Associate shall require each of its Subcontractors that creates, receives, maintains, or transmits PHI on behalf of Business Associate to execute a written agreement that imposes on such Subcontractor restrictions, conditions, and requirements at least as restrictive as those that apply to Business Associate under this BAA with respect to PHI.

2.11. Minimum Necessary. Business Associate (and its Subcontractors) shall, to the extent practicable, limit its requests, Uses, and Disclosures of PHI to the minimum amount of PHI necessary to accomplish the purpose of the request, Use, or Disclosure, in accordance with 42 U.S.C. § 17935(b) and 45 C.F.R. § 164.502(b)(1) and any guidance issued thereunder.

ARTICLE III — OBLIGATIONS OF COVERED ENTITY

3.1. Notice of Limitations, Revocations, and Restrictions. Covered Entity shall notify Business Associate in writing of (a) any limitation in Covered Entity’s notice of privacy practices under 45 C.F.R. § 164.520, (b) any change in, or revocation of, an individual’s permission to Use or Disclose PHI, and (c) any restriction on the Use or Disclosure of PHI that Covered Entity has agreed to under 45 C.F.R. § 164.522 (including restrictions described in Section 2.8), in each case to the extent such limitation, change, revocation, or restriction may affect Business Associate’s Use or Disclosure of PHI.

3.2. Permissible Requests. Covered Entity shall not request that Business Associate Use or Disclose PHI in any manner that would not be permissible under HIPAA, the HIPAA Regulations, or the HITECH Act if done by Covered Entity, except as permitted for a business associate under 45 C.F.R. § 164.504(e)(2)(i)(A)–(B).

3.3. Consents and Authorizations. Covered Entity shall obtain any consents, authorizations, or permissions required under HIPAA or other applicable law for Business Associate to perform the Services and to Use and Disclose PHI as contemplated by this BAA and the Underlying Agreement.

ARTICLE IV — TERM AND TERMINATION

4.1. Term. The term of this BAA shall commence on the Effective Date and shall terminate on the earlier of (a) the date on which all PHI provided by Covered Entity to Business Associate, or created or received by Business Associate on behalf of Covered Entity, is destroyed or returned to Covered Entity (or, if return or destruction is infeasible, the date on which protections are extended to such PHI in accordance with Section 4.3), or (b) the date on which a Party terminates this BAA for cause as authorized in Section 4.2.

4.2. Termination for Cause. Upon a Party’s knowledge of a material breach of this BAA by the other Party, the non-breaching Party shall either: (a) notify the breaching Party of the material breach in writing and provide an opportunity to cure the material breach within thirty (30) days of such notice, and, if the breaching Party fails to cure the material breach within such period, terminate this BAA upon written notice; or (b) upon written notice, immediately terminate this BAA if the non-breaching Party reasonably determines that the material breach cannot be cured. Termination of this BAA shall not relieve Covered Entity of its obligation to pay fees due for Services performed prior to the effective date of termination.

4.3. Disposition of PHI Upon Termination or Expiration.

4.3.1 Upon termination or expiration of this BAA, Business Associate shall return or destroy all PHI received from, or created or received on behalf of, Covered Entity that Business Associate still maintains in any form, and shall retain no copies of such PHI, except as provided in Sections 4.3.2 and 4.3.3. If Covered Entity requests the return of PHI, Business Associate shall return the PHI in a standard, machine-readable format within a mutually agreed, commercially reasonable timeframe; one such export shall be provided at no additional charge.

4.3.2 If return or destruction is not feasible, Business Associate shall (a) retain only that PHI which is necessary for Business Associate to continue its proper management and administration or to carry out its legal responsibilities; (b) return to Covered Entity the remaining PHI that Business Associate maintains in any form; (c) continue to extend the protections of this BAA to the retained PHI for as long as it is retained; (d) limit further Uses and Disclosures of such PHI to those purposes that make its return or destruction infeasible, subject to the same conditions set out in Sections 2.1 and 2.3; and (e) return or destroy the retained PHI when it is no longer needed for such purposes.

4.3.3 Notwithstanding the foregoing: (a) PHI residing in routine electronic backup or archival media may be retained until deleted or overwritten in the ordinary course of Business Associate’s standard backup-retention cycle, provided that such PHI remains subject to the protections of this BAA and is not otherwise Used or Disclosed; and (b) information de-identified in accordance with Section 2.2 is not PHI and is not subject to return or destruction.

ARTICLE V — MISCELLANEOUS

5.1. Amendment. This BAA may be amended only by a written instrument signed by both Parties; the Parties agree that electronic records and electronic acceptances (including acceptance of an amended version of this BAA presented through Business Associate’s platform in the manner described in Section 5.11) satisfy any requirement for a writing or a signature. If an amendment to this BAA is required by a change in HIPAA, the HIPAA Regulations, the HITECH Act, or other applicable law, the Parties shall negotiate such amendment in good faith. If the Parties are unable to agree on a legally required amendment within thirty (30) days after written notice from either Party, either Party may terminate this BAA upon written notice, and the provisions of Section 4.3 shall apply.

5.2. Mutual Indemnification. Each Party (the "Indemnifying Party") shall indemnify, defend, and hold harmless the other Party and its officers, directors, managers, members, employees, and agents (collectively, the "Indemnified Party") from and against third-party claims, and any resulting civil fines or penalties, damages, and reasonable expenses (including reasonable attorneys’ fees), in each case to the extent arising from the Indemnifying Party’s material breach of this BAA or violation of HIPAA, the HIPAA Regulations, or the HITECH Act. The Indemnified Party shall provide the Indemnifying Party with prompt written notice of any claim and reasonable cooperation, and the Indemnifying Party shall control the defense and settlement of the claim; provided that the Indemnifying Party shall not settle any claim in a manner that imposes non-monetary obligations on the Indemnified Party without its prior written consent, not to be unreasonably withheld.

5.3. Limitation of Liability. EXCEPT FOR A PARTY’S OBLIGATIONS UNDER SECTION 5.2 ARISING FROM ITS GROSS NEGLIGENCE OR WILLFUL MISCONDUCT, (a) NEITHER PARTY SHALL BE LIABLE TO THE OTHER FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES ARISING OUT OF OR RELATING TO THIS BAA, AND (b) EACH PARTY’S AGGREGATE LIABILITY ARISING OUT OF OR RELATING TO THIS BAA SHALL NOT EXCEED THE GREATER OF (i) THE AMOUNTS PAID OR PAYABLE BY COVERED ENTITY TO BUSINESS ASSOCIATE UNDER THE UNDERLYING AGREEMENT IN THE TWELVE (12) MONTHS PRECEDING THE FIRST EVENT GIVING RISE TO LIABILITY AND (ii) THE PROCEEDS ACTUALLY AVAILABLE UNDER BUSINESS ASSOCIATE’S CYBER LIABILITY INSURANCE FOR THE CLAIM. IF THE UNDERLYING AGREEMENT CONTAINS A LIMITATION OF LIABILITY, THAT LIMITATION APPLIES TO CLAIMS UNDER THIS BAA UNLESS THE UNDERLYING AGREEMENT EXPRESSLY STATES OTHERWISE.

5.4. Notices. Any notice required or permitted under this BAA shall be given in writing and shall be deemed received: (a) upon personal delivery; (b) if sent by email — for Business Associate, to the notice email set forth in the Acceptance section below, and for Covered Entity, to the administrative email address designated in Covered Entity’s account registration — on the business day of transmission absent an automated notice of non-delivery; (c) twenty-four (24) hours following deposit with a bonded courier or nationally recognized overnight delivery service; or (d) seventy-two (72) hours following deposit in the U.S. mail, first class, registered or certified, postage prepaid, return receipt requested. Notices of termination shall additionally be sent by a method described in clause (a), (c), or (d). Either Party may update its notice address by notice given in accordance with this Section, and Covered Entity may do so by updating its account registration.

5.5. Relationship of Parties. Business Associate is an independent contractor and not an agent of Covered Entity under this BAA. Business Associate has the sole right and obligation to supervise, manage, contract, direct, procure, perform, or cause to be performed all Business Associate obligations under this BAA.

5.6. No Third-Party Beneficiaries. Nothing in this BAA is intended to confer, nor shall anything herein confer, upon any person other than the Parties and their respective successors and permitted assigns, any rights, remedies, obligations, or liabilities whatsoever.

5.7. Order of Precedence; Entire Agreement. This BAA, together with the Underlying Agreement, constitutes the entire agreement between the Parties with respect to its subject matter. In the event of a conflict between this BAA and the Underlying Agreement, this BAA controls solely with respect to the Use, Disclosure, and safeguarding of PHI; in all other respects the Underlying Agreement controls.

5.8. Survival. The respective rights and obligations of the Parties under Sections 2.6, 2.7, 4.3, 5.2, and 5.3 of this BAA shall survive its termination or expiration.

5.9. Governing Law and Venue. This BAA shall be governed by and construed in accordance with the laws of the State of Delaware, without regard to conflict-of-laws principles. The Parties agree that all actions or proceedings arising in connection with this BAA shall be tried and litigated exclusively in the state or federal courts located in the State of Delaware, and each Party consents to the jurisdiction of such courts.

5.10. Electronic Records and Signatures. The Parties agree that this BAA may be executed and maintained entirely by electronic means, and that electronic signatures and acceptances — including the click-through acceptance described in Section 5.11 — are valid, binding, and enforceable to the same extent as handwritten signatures, in accordance with the federal Electronic Signatures in Global and National Commerce Act (15 U.S.C. § 7001 et seq.) and the Delaware Uniform Electronic Transactions Act (6 Del. C. § 12A-101 et seq.).

5.11. Electronic Acceptance and Execution. Covered Entity accepts and executes this BAA by having its authorized representative complete the acceptance action presented during onboarding to Business Associate’s services (for example, checking a box and selecting "I Agree" after being presented with the full text of this BAA). The individual completing the acceptance action represents and warrants that he or she is duly authorized to bind Covered Entity to this BAA. This BAA is deemed executed by Business Associate, without need for countersignature, upon Covered Entity’s acceptance. Business Associate shall maintain a record of acceptance — including the identity of the accepting individual, the Covered Entity identified in the account registration, the date and time of acceptance, and the version of this BAA accepted (identified by the Document ID and version number appearing in this BAA) — and shall make a copy of this BAA and the acceptance record available to Covered Entity upon acceptance and thereafter upon request. No PHI shall be exchanged under the Services until this BAA has been accepted.

ACCEPTANCE

BY CHECKING THE ACCEPTANCE BOX AND SELECTING "I AGREE" (OR THE EQUIVALENT ACCEPTANCE ACTION PRESENTED DURING ONBOARDING), COVERED ENTITY’S AUTHORIZED REPRESENTATIVE ACKNOWLEDGES THAT HE OR SHE HAS READ THIS BAA, IS AUTHORIZED TO BIND COVERED ENTITY, AND AGREES TO ITS TERMS ON BEHALF OF COVERED ENTITY, EFFECTIVE AS OF THE DATE OF ACCEPTANCE.

The following acceptance record is captured automatically by the platform at the time of acceptance:

• Legal name of Covered Entity: (captured automatically from account registration)

• Name and title of accepting individual: (captured automatically at acceptance)

• Email address of accepting individual: (captured automatically at acceptance)

• Date and time of acceptance (UTC): (captured automatically at acceptance)

• Document accepted: CN-BAA-CUST-CW, Version 2.3

FOR BUSINESS ASSOCIATE:

CosmaNeura Inc. — executed upon Covered Entity’s acceptance pursuant to Section 5.11.

Notice Address: CosmaNeura Inc., Attn: John Clemente, 15 Heidi Ln, Bow, NH 03304

Notice Email: john@cosmaneura.com

EXHIBIT A

SERVICES AND PERMITTED PURPOSES

The Services consist of the modules and features that Covered Entity subscribes to, activates, or uses under its account, order form, or subscription with Business Associate, each of which may involve the creation, receipt, maintenance, or transmission of PHI, and which may include:

(a) Administrative workflow automation, including patient intake, scheduling, referral management, and prior-authorization support;

(b) Billing and revenue-cycle support, including charge capture and remittance and payment-posting support;

(c) Patient engagement and communications, including appointment reminders, follow-up messaging, and patient education materials;

(d) Clinical documentation support, including visit summarization and draft note preparation for provider review;

(e) Analytics and reporting supporting Covered Entity’s Health Care Operations; and

(f) Related hosting, technical support, and maintenance of the foregoing.

The permitted purposes under Section 2.1 are automatically limited to the Services so subscribed, activated, or used from time to time, together with the purposes expressly permitted elsewhere in this BAA. Any additional or modified Services agreed between the Parties in an order form or written amendment are incorporated into this Exhibit A without further action.