This Business Associate Agreement ("BAA") is entered into between VVY Technologies, Inc. (d/b/a Moxcares), a Delaware corporation with registered office at 131 Continental Dr, Suite 305, Newark, DE 19713 ("Business Associate"), and the healthcare clinic or provider organization that accepts this BAA ("Covered Entity"). It supplements, and is incorporated into the Moxcares Terms of Service.
Effective Date: the date Covered Entity accepts this BAA during signup or onboarding.
1. Definitions
Terms used but not defined have the meanings in the HIPAA Rules (45 C.F.R. Parts 160 and 164). "PHI" means Protected Health Information that Business Associate creates, receives, maintains, or transmits on behalf of a Covered Entity.
2. Permitted Uses and Disclosures
Business Associate may use or disclose PHI only:
- to perform the services described in the Terms of Service—scheduling and intake, charting, clinical documentation, ambient scribing, coding assistance, e-prescribing, eligibility and claims, payments, fax, patient messaging, and the AI receptionist and AI staff member—including transmitting PHI at Covered Entity’s direction to designated recipients such as pharmacies, clearinghouses, payers, fax recipients, laboratories and other providers. Payment-card credentials are handled by Stripe, not stored by Business Associate;
- as required by law;
- for the proper management and administration of Business Associate, and to carry out its legal responsibilities, provided any disclosure is required by law or made with reasonable assurances of confidentiality and breach-notification from the recipient.
Business Associate will not use or disclose PHI in a manner that would violate the HIPAA Rules if done by Covered Entity, except as permitted above.
3. Safeguards
Business Associate will implement administrative, physical, and technical safeguards (including those required by the HIPAA Security Rule for electronic PHI) that reasonably and appropriately protect the confidentiality, integrity, and availability of PHI.
3A. Specific Safeguards
Without limiting Section 3, Business Associate maintains encryption of electronic PHI in transit (TLS 1.2 or higher) and at rest (AES-256); MFA for clinic users; role-based access and clinical designations, with a stated and recorded reason required for administrative chart access without clinical authority; an immutable patient-record access log available to Covered Entity for compliance review; breach-notification procedures consistent with Section 4; and workforce training. The current description is published in the Trust Center. Access logs support review but are not, by themselves, a determination of which events constitute an accounting of disclosures under HIPAA.
4. Reporting
Business Associate will report to Covered Entity any use or disclosure of PHI not permitted by this BAA, any Security Incident, and any Breach of Unsecured PHI, without unreasonable delay and no later than 30 days after discovery, consistent with 45 C.F.R. § 164.410.
5. Subcontractors
Business Associate will ensure that subcontractors creating, receiving, maintaining or transmitting PHI on its behalf agree in writing to restrictions and conditions at least as stringent as those applying to Business Associate. PHI subcontractors engaged under BAAs are Google Cloud Platform, Google, Anthropic, Twilio, Stedi, Documo and MDToolbox. Stripe, Firebase Authentication and Postmark operate within their documented non-PHI scope and are not used for clinical PHI. The current dated register is published at moxcares.com/subprocessors. Business Associate will update that register before a new subcontractor processes PHI.
6. Access, Amendment, and Accounting
Business Associate will make PHI available to Covered Entity (or the individual) as needed for Covered Entity to meet its HIPAA obligations regarding individual access (§ 164.524), amendment (§ 164.526), and accounting of disclosures (§ 164.528).
7. Availability to HHS
Business Associate will make its internal practices, books, and records relating to the use and disclosure of PHI available to the Secretary of HHS for determining Covered Entity's compliance.
8. Return or Destruction on Termination
On termination of the Terms of Service, Covered Entity may request its PHI in C-CDA format together with its documents, and Business Associate will provide it. Business Associate retains patient records for seven (7) years after the subscription ends, or longer where applicable state or federal law requires, as stated in the Privacy Policy. BAA protections continue during retention, after which records are destroyed. Where destruction is infeasible, including backup media that expire on their own schedule, Business Associate extends BAA protections and limits further use and disclosure to the purposes making destruction infeasible for as long as the PHI is retained.
9. Term and Termination
This BAA is effective on the Effective Date. Its protections continue for as long as Business Associate retains PHI, including after an export or termination of the subscription as described in Section 8. Covered Entity may terminate for a material breach that Business Associate fails to cure.
10. Miscellaneous
Governing law, interpretation in favor of HIPAA compliance, amendment to maintain compliance, and survival.
11. Limitation of Liability; Relationship to the Terms of Service
This BAA supplements and is incorporated into the Moxcares Terms of Service. Except as required by the HIPAA Rules, each party's liability arising out of or relating to this BAA — including liability for a use or disclosure of PHI not permitted by this BAA, a Security Incident, or a Breach — is subject to and limited by the Limitations of Liability section of the Terms of Service, including its tiered structure under which claims arising from a breach of data-security or confidentiality obligations or from a violation of HIPAA or this BAA are limited to the limits of the Company's applicable cyber-liability and technology errors-and-omissions insurance coverage then in effect. In the event of a conflict between this BAA and the Terms of Service with respect to the use, disclosure, or protection of PHI, this BAA controls; in all other respects, including the allocation and limitation of monetary liability, the Terms of Service control.
To request a counter-signed copy of this BAA tailored to your clinic, contact legal@moxcares.com.