Business Associate Agreement

Every practice signs our Business Associate Agreement online when it sets up its account, before any form is uploaded or goes live. This is the agreement it signs.

Open the agreement (PDF)

AlpineForm (Pruett & Co., LLC)

Effective Date: the date of acceptance shown on the signature page (Section 15)

Introduction

This Business Associate Agreement ("Agreement") is entered into between the covered entity identified in the signature block below ("Covered Entity" or "You") and Pruett & Co., LLC, doing business as AlpineForm ("Business Associate," "AlpineForm," "We," "Us," or "Our").

This Agreement is mandatory for HIPAA and HITECH compliance.

AlpineForm is a "business associate" under HIPAA Rules. This means that we are an entity that provides services that involve access to protected health information to covered entities. The HIPAA Rules require that covered entities enter into contracts with their business associates to ensure that protected health information is safeguarded. This business associate agreement serves to clarify and limit, as appropriate, the permissible uses and disclosures of protected health information by the business associate based on the relationship between the parties and the services being performed.

As a business associate, AlpineForm may use or disclose protected health information only as permitted or required by this Agreement or as required by law. We are directly liable under HIPAA Rules and subject to civil and criminal penalties for using and disclosing protected health information not authorized by this Agreement or required by law. We are also directly liable and subject to civil penalties for failing to safeguard protected health information under the HIPAA Security Rule.

We help support HIPAA and HITECH compliance for your business, but our services do not address every compliance requirement. Your business is responsible for maintaining an adequate compliance program and having internal processes in place.

Table of Contents

1. Definitions
2. Services Provided
3. Our Obligations and Activities
4. Our Representations and Warranties
5. Our Permitted Uses and Disclosures
6. Your Responsibilities
7. Provisions for You to Inform Us of Privacy Practices and Restrictions
8. Permissible Requests by You
9. Term and Termination
10. Limitation of Liability
11. Indemnification
12. Miscellaneous
13. About Subcontractors
14. Governing Law and Jurisdiction
15. Signature and Acceptance

1. Definitions

"HIPAA Rules" shall mean the Privacy, Security, Breach Notification, and Enforcement Rules at 45 CFR Part 160 and Part 164.

The following terms used in this Agreement shall have the same meaning as those terms in the HIPAA Rules: Breach, Data Aggregation, Designated Record Set, Disclosure, Health Care Operations, Individual, Minimum Necessary, Notice of Privacy Practices, Protected Health Information, Required By Law, Secretary, Security Incident, Subcontractor, Unsecured Protected Health Information, and Use.

"Business Associate," "We," "Us," "Our," and "AlpineForm" shall generally have the same meaning as the term "business associate" at 45 CFR 160.103, and in reference to the party to this Agreement, shall mean Pruett & Co., LLC, doing business as AlpineForm.

"Covered Entity," "You," and "Yours" shall generally have the same meaning as the term "covered entity" at 45 CFR 160.103, and in reference to the party to this Agreement, shall mean the covered entity identified in the signature block below and its workforce members.

"PHI" and "ePHI" shall generally have the same meaning as the terms "protected health information" and "electronic protected health information," respectively, as defined at 45 CFR 160.103.

"Services" shall mean the services described in Section 2 of this Agreement.

2. Services Provided

AlpineForm provides web-based services that involve the creation, receipt, maintenance, and transmission of protected health information on behalf of Covered Entity. Specific services include:

• Electronic document creation and generation containing or incorporating ePHI
• Secure cloud storage of ePHI via encrypted cloud storage platforms
• Secure email transmission of ePHI using TLS 1.2+ encryption
• Automated backup and disaster recovery services for ePHI
• Web application services that create, receive, maintain, or transmit ePHI

The specific services provided to Covered Entity are as agreed upon in the underlying service agreement or order form between the parties.

3. Our Obligations and Activities

As a business associate, AlpineForm agrees to:

3.1 Permitted Uses and Disclosures

Not use or disclose protected health information other than as permitted or required by this Agreement or as required by law.

3.2 Appropriate Safeguards

Use appropriate administrative, physical, and technical safeguards, and comply with Subpart C of 45 CFR Part 164 (the HIPAA Security Rule) with respect to electronic protected health information, to prevent use or disclosure of protected health information other than as provided for by this Agreement.

3.3 Security Incident and Breach Reporting

Report to Covered Entity any use or disclosure of protected health information not provided for by this Agreement of which we become aware, including breaches of unsecured protected health information as required at 45 CFR 164.410, and any security incident of which we become aware.

Notification Timeline: AlpineForm will provide notification to Covered Entity without unreasonable delay and in no case later than sixty (60) calendar days after discovery of a breach or security incident.

Information Provided: AlpineForm will provide Covered Entity with sufficient information to enable Covered Entity to meet its breach notification obligations to individuals, the U.S. Department of Health and Human Services (HHS), and media as required by law, including:

• A brief description of what happened, including the date of the breach and the date of discovery
• A description of the types of unsecured protected health information involved
• The identification of each individual whose unsecured protected health information has been, or is reasonably believed to have been, accessed, acquired, used, or disclosed
• Any steps individuals should take to protect themselves from potential harm
• A brief description of what AlpineForm is doing to investigate, mitigate harm, and prevent further breaches
• Contact information for individuals to ask questions or obtain additional information

Clarification on Notification Responsibilities: AlpineForm will not send breach notifications on behalf of Covered Entity to individuals, the HHS Office for Civil Rights (OCR), or the media. Covered Entity is responsible for making all required breach notifications to individuals, HHS, and media as required by 45 CFR Part 164, Subpart D.

3.4 Subcontractor Agreements

In accordance with 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2), ensure that any subcontractors that create, receive, maintain, or transmit protected health information on behalf of AlpineForm agree to the same restrictions, conditions, and requirements that apply to AlpineForm with respect to such protected health information.

3.5 Access to Protected Health Information

Make available protected health information in a designated record set to Covered Entity as necessary to satisfy Covered Entity's obligations under 45 CFR 164.524 (right of access).

Process: In the event that AlpineForm receives a request for protected health information directly from an individual, AlpineForm will forward that request to Covered Entity within five (5) business days. Covered Entity is responsible for fulfilling the individual's access request.

3.6 Amendment of Protected Health Information

Make any amendment(s) to protected health information in a designated record set as directed or agreed to by Covered Entity pursuant to 45 CFR 164.526, or take other measures as necessary to satisfy Covered Entity's obligations under 45 CFR 164.526.

Process: In the event that AlpineForm receives a request to amend or modify protected health information directly from an individual, AlpineForm will forward that request to Covered Entity within five (5) business days. AlpineForm will only amend protected health information with express written authorization from Covered Entity.

3.7 Accounting of Disclosures

Maintain and make available the information required to provide an accounting of disclosures to Covered Entity as necessary to satisfy Covered Entity's obligations under 45 CFR 164.528.

Process: In the event that AlpineForm receives a request for an accounting of disclosures directly from an individual, AlpineForm will forward that request to Covered Entity within five (5) business days. AlpineForm will provide Covered Entity with information regarding disclosures made by AlpineForm as necessary for Covered Entity to fulfill the accounting request.

3.8 Compliance with Applicable HIPAA Requirements

To the extent that AlpineForm is to carry out one or more of Covered Entity's obligations under Subpart E of 45 CFR Part 164 (Privacy of Individually Identifiable Health Information), comply with the requirements of Subpart E that apply to Covered Entity in the performance of such obligation(s).

3.9 Access to Books and Records

Make AlpineForm's internal practices, books, and records relating to the use and disclosure of protected health information available to the Secretary of the U.S. Department of Health and Human Services for purposes of determining compliance with the HIPAA Rules.

4. Our Representations and Warranties

AlpineForm represents and warrants to Covered Entity that:

4.1 HIPAA Compliance Program

AlpineForm maintains appropriate administrative, physical, and technical safeguards as required by the HIPAA Security Rule (45 CFR Part 164, Subpart C) to protect the confidentiality, integrity, and availability of electronic protected health information.

4.2 Security Policies and Procedures

AlpineForm has documented security policies and procedures that comply with HIPAA requirements and reviews and updates such policies at least annually or as needed in response to environmental or operational changes.

4.3 Risk Analysis and Security Audits

AlpineForm conducts regular risk assessments and security audits to identify potential risks and vulnerabilities to electronic protected health information and implements appropriate security measures to address identified risks.

4.4 Subcontractor Management

AlpineForm maintains business associate agreements with all subcontractors that create, receive, maintain, or transmit protected health information on behalf of AlpineForm, as required by HIPAA.

4.5 Workforce Training

AlpineForm's workforce members who handle protected health information receive appropriate HIPAA security and privacy training prior to accessing protected health information and receive refresher training at least annually.

4.6 Insurance Coverage

AlpineForm maintains appropriate insurance coverage, including cyber liability insurance, in commercially reasonable amounts.

4.7 Material Changes

AlpineForm will promptly notify Covered Entity in writing of any material changes to AlpineForm's security practices, infrastructure, or subcontractors that may affect the security or privacy of Covered Entity's protected health information.

4.8 Encryption Standards

AlpineForm implements encryption for protected health information:

• At Rest: 256-bit encryption (XChaCha20-Poly1305) for ePHI stored
• In Transit: TLS 1.2 or higher for email transmission and all other electronic transmissions of ePHI

5. Our Permitted Uses and Disclosures

5.1 Services-Related Uses and Disclosures

AlpineForm may use or disclose protected health information as necessary to perform the Services for Covered Entity, including:

• Creating, receiving, maintaining, and transmitting ePHI
• Creating and storing documents that may include ePHI
• Sending email messages that may include ePHI using TLS 1.2+ encryption in transit to Covered Entity's designated HIPAA-compliant email addresses
• Storing backup files that may include ePHI
• Transmitting data to and from websites and applications that may include ePHI

5.2 Required by Law

AlpineForm may use or disclose protected health information as required by law.

5.3 Minimum Necessary

AlpineForm agrees to make uses and disclosures and requests for protected health information consistent with Covered Entity's minimum necessary policies and procedures, to the extent provided to AlpineForm in writing.

5.4 Limitation on Uses and Disclosures

AlpineForm may not use or disclose protected health information in a manner that would violate Subpart E of 45 CFR Part 164 if done by Covered Entity, except for the specific uses and disclosures set forth in this Section 5.

5.5 Management and Administration

AlpineForm may use protected health information for the proper management and administration of AlpineForm's business or to carry out AlpineForm's legal responsibilities.

5.6 Disclosure for Management and Administration

AlpineForm may disclose protected health information for the proper management and administration of AlpineForm's business or to carry out AlpineForm's legal responsibilities, provided that:

• The disclosure is required by law, OR
• AlpineForm obtains reasonable assurances from the person to whom the information is disclosed that:
  • The information will remain confidential and will be used or further disclosed only as required by law or for the purposes for which it was disclosed to the person, AND
  • The person will notify AlpineForm of any instances of which it is aware in which the confidentiality of the information has been breached.

5.7 Data Aggregation

AlpineForm may provide data aggregation services relating to the health care operations of Covered Entity as permitted by 45 CFR 164.504(e)(2)(i)(B).

5.8 De-Identified Information

AlpineForm may use or disclose protected health information for its own purposes only after de-identifying the information in accordance with 45 CFR 164.514(a)-(c). De-identified information is not subject to the restrictions of this Agreement.

6. Your Responsibilities

Covered Entity represents, warrants, and agrees that:

6.1 Covered Entity Status

Covered Entity is a covered entity as defined under HIPAA or is otherwise authorized under applicable law to disclose protected health information to AlpineForm for the purposes set forth in this Agreement.

6.2 Authorizations and Consents

Covered Entity has obtained or will obtain all necessary authorizations, consents, and permissions required under applicable law to disclose protected health information to AlpineForm and for AlpineForm to use and disclose such protected health information as provided in this Agreement.

6.3 HIPAA-Compliant Email System

Covered Entity maintains and will continue to maintain a HIPAA-compliant email system capable of receiving TLS 1.2+ encrypted email. Covered Entity acknowledges that AlpineForm will transmit ePHI to Covered Entity via email using TLS 1.2+ encryption in transit (standard email encryption, not end-to-end encryption), and Covered Entity agrees that this method of transmission is acceptable and meets Covered Entity's security requirements.

6.4 Email Address Accuracy

Covered Entity will provide AlpineForm with accurate and current email addresses for receipt of ePHI and will promptly notify AlpineForm of any changes to such email addresses.

6.5 Safeguards for Received PHI

Covered Entity will implement and maintain appropriate administrative, physical, and technical safeguards to protect protected health information received from AlpineForm, in accordance with HIPAA requirements.

6.6 Current Contact Information

Covered Entity will provide and maintain accurate and current contact information for breach notifications, security incident reports, and other required communications under this Agreement.

6.7 HIPAA Compliance

Covered Entity will comply with all applicable HIPAA requirements with respect to protected health information, including but not limited to the Privacy Rule, Security Rule, and Breach Notification Rule.

6.8 Security Incident Notification

Covered Entity will notify AlpineForm promptly (within five (5) business days) of any security incidents, breaches, or unauthorized uses or disclosures of protected health information provided by AlpineForm of which Covered Entity becomes aware.

6.9 Restrictions and Limitations

Covered Entity will notify AlpineForm in writing of any restrictions or limitations on the use or disclosure of protected health information that AlpineForm must observe, as described in Section 7 below.

7. Provisions for You to Inform Us of Privacy Practices and Restrictions

Covered Entity shall notify AlpineForm in writing of:

7.1 Limitations in Notice of Privacy Practices

Any limitation(s) in Covered Entity's notice of privacy practices under 45 CFR 164.520, to the extent that such limitation may affect AlpineForm's use or disclosure of protected health information.

7.2 Changes in Permissions

Any changes in, or revocation of, permission by an individual to use or disclose his or her protected health information, to the extent that such changes may affect AlpineForm's use or disclosure of protected health information.

7.3 Agreed-Upon Restrictions

Any restriction on the use or disclosure of protected health information that Covered Entity has agreed to or is required to abide by under 45 CFR 164.522, to the extent that such restriction may affect AlpineForm's use or disclosure of protected health information.

Timeline: Covered Entity shall provide such notifications to AlpineForm within ten (10) business days of the event requiring notification.

Effect: AlpineForm will comply with such restrictions and limitations upon receipt of written notification from Covered Entity.

8. Permissible Requests by You

8.1 Access to PHI

Covered Entity may request copies of any data containing protected health information for Covered Entity that AlpineForm collects or stores, at any time. AlpineForm will provide such copies within ten (10) business days of receiving the written request, in the format reasonably requested by Covered Entity.

8.2 Limitation on Requests

Covered Entity shall not request AlpineForm to use or disclose protected health information in any manner that would not be permissible under Subpart E of 45 CFR Part 164 if done by Covered Entity, unless the request is for AlpineForm to:

• Use or disclose protected health information for data aggregation purposes, OR
• Use or disclose protected health information for management and administration of AlpineForm or to carry out legal responsibilities of AlpineForm.

9. Term and Termination

9.1 Term

The term of this Agreement shall be effective as of the date signed below ("Effective Date") and shall continue until terminated in accordance with this Section 9 or until Covered Entity cancels its service with AlpineForm.

9.2 Termination for Cause

Either party may terminate this Agreement upon written notice if the other party has violated a material term of this Agreement, provided that:

• The terminating party first provides written notice to the breaching party specifying the violation, AND
• The breaching party fails to cure the breach within thirty (30) days of receiving such notice.

If the breach is not curable, the non-breaching party may terminate this Agreement immediately upon written notice.

Either party may terminate this Agreement immediately upon written notice if the other party violates a material term of this Agreement and such violation results in a breach of unsecured protected health information.

9.3 Termination Upon Loss of Required Status

This Agreement will automatically terminate if AlpineForm is no longer a business associate as defined under HIPAA or if Covered Entity is no longer a covered entity as defined under HIPAA.

9.4 Effect of Termination

Upon termination of this Agreement for any reason, AlpineForm, with respect to protected health information received from Covered Entity, or created, maintained, or received by AlpineForm on behalf of Covered Entity, shall:

a) Retention of Necessary PHI: Retain only that protected health information which is necessary for AlpineForm to continue its proper management and administration or to carry out its legal responsibilities, as permitted by law.

b) Return of PHI: Within thirty (30) days of termination, return to Covered Entity (or, if agreed upon by both parties, destroy) all remaining protected health information that AlpineForm still maintains in its live systems, including all copies there. Copies held in AlpineForm's encrypted backups are handled as described in Section 9.4(f). AlpineForm will provide written certification of the return or destruction of protected health information to Covered Entity.

c) Continued Safeguards: Continue to use appropriate administrative, physical, and technical safeguards and comply with Subpart C of 45 CFR Part 164 (the Security Rule) with respect to electronic protected health information to prevent use or disclosure of the protected health information, other than as provided for in this Section 9.4, for as long as AlpineForm retains the protected health information.

d) Limited Use of Retained PHI: Not use or disclose the protected health information that AlpineForm retains other than for the purposes for which such protected health information was retained and subject to the same conditions set forth in Section 5 (Our Permitted Uses and Disclosures) which applied prior to termination.

e) Return of Retained PHI: Return to Covered Entity (or, if agreed upon by both parties, destroy) the protected health information retained by AlpineForm when it is no longer needed by AlpineForm for its proper management and administration or to carry out its legal responsibilities. AlpineForm will provide written certification of such return or destruction.

f) Permanent Deletion: AlpineForm will permanently delete all protected health information from its live systems within thirty (30) days of termination, except for protected health information AlpineForm is required to retain by law or as otherwise agreed in writing by the parties. Copies held in AlpineForm's encrypted backups may remain after that date. Until they are deleted, those copies stay encrypted, are used only to restore AlpineForm's systems after a failure, and remain protected under Sections 9.4(c) and 9.4(d). Upon Covered Entity's request, AlpineForm will provide written certification of deletion confirming:

• The date of deletion
• The types of media from which protected health information was deleted
• The method of deletion used
• Which encrypted backup copies, if any, remain, and how they are protected until they are deleted

g) Impracticability of Return or Destruction: If AlpineForm determines that return or destruction of protected health information is infeasible, AlpineForm will:

• Notify Covered Entity in writing of the conditions that make return or destruction infeasible
• Extend the protections of this Agreement to such protected health information
• Limit further uses and disclosures of such protected health information to those purposes that make the return or destruction infeasible
• Provide Covered Entity with reasonable assurances that such protected health information will continue to be appropriately safeguarded

9.5 Survival

The obligations of AlpineForm under this Section 9 shall survive the termination of this Agreement.

10. Limitation of Liability

10.1 Exclusion of Consequential Damages

To the maximum extent permitted by law, in no event shall either party be liable to the other party for any indirect, incidental, consequential, special, exemplary, or punitive damages arising out of or relating to this Agreement or the Services, including but not limited to lost profits, lost revenue, loss of anticipated savings, loss of business opportunity, loss of data, or cost of replacement services, even if such party has been advised of the possibility of such damages.

10.2 Exceptions to Limitation

Notwithstanding Section 10.1, nothing in this Section 10 shall limit either party's liability for:

• Gross negligence or willful misconduct
• Breach of confidentiality obligations under this Agreement
• Violation of HIPAA or other applicable laws
• Indemnification obligations under Section 11
• Fraud or fraudulent misrepresentation
• Death or personal injury caused by negligence
• Any other liability that cannot be excluded or limited under applicable law

10.3 Cap on Liability

Subject to Section 10.2, AlpineForm's total aggregate liability to Covered Entity under this Agreement, whether in contract, tort, or otherwise, shall not exceed the total amount paid by Covered Entity to AlpineForm in the twelve (12) months immediately preceding the event giving rise to the claim.

10.4 Essential Basis of Bargain

The parties acknowledge and agree that the limitations and exclusions of liability set forth in this Section 10 are fundamental elements of the basis of the bargain between the parties, and that AlpineForm would not be able to provide the Services on an economically reasonable basis without such limitations.

11. Indemnification

11.1 Covered Entity Indemnification

Covered Entity agrees to indemnify, defend, and hold harmless AlpineForm, its officers, directors, employees, agents, and subcontractors from and against any and all claims, damages, losses, liabilities, costs, and expenses (including reasonable attorneys' fees and court costs) arising from or relating to:

• Covered Entity's breach of this Agreement
• Covered Entity's violation of applicable laws or regulations, including HIPAA
• Covered Entity's failure to maintain HIPAA-compliant systems for receiving, storing, or transmitting ePHI
• Covered Entity's failure to implement appropriate safeguards for protected health information received from AlpineForm
• Any negligent or wrongful acts or omissions by Covered Entity or Covered Entity's workforce members, agents, or contractors
• Covered Entity's use of protected health information in violation of applicable law or this Agreement
• Any claim by an individual whose protected health information was disclosed by Covered Entity in violation of applicable law

11.2 AlpineForm Indemnification

AlpineForm agrees to indemnify, defend, and hold harmless Covered Entity, its officers, directors, employees, and agents from and against any and all claims, damages, losses, liabilities, costs, and expenses (including reasonable attorneys' fees and court costs) arising from or relating to:

• AlpineForm's breach of this Agreement
• AlpineForm's violation of the HIPAA Rules
• AlpineForm's failure to implement appropriate administrative, physical, and technical safeguards as required by the HIPAA Security Rule
• Any negligent or wrongful acts or omissions by AlpineForm or AlpineForm's workforce members, agents, subcontractors, or other persons acting on AlpineForm's behalf in connection with the Services provided under this Agreement
• Any security incident or breach of unsecured protected health information caused by AlpineForm's failure to maintain appropriate safeguards

11.3 Indemnification Procedures

A party seeking indemnification under this Section 11 (the "Indemnified Party") shall:

• Promptly notify the other party (the "Indemnifying Party") in writing of any claim, demand, or action for which indemnification is sought
• Provide reasonable cooperation to the Indemnifying Party in the defense of such claim, demand, or action
• Allow the Indemnifying Party to control the defense and settlement of such claim, demand, or action, provided that the Indemnifying Party shall not settle any claim, demand, or action in a manner that admits liability on behalf of the Indemnified Party or imposes any obligation on the Indemnified Party without the Indemnified Party's prior written consent

12. Miscellaneous

12.1 Regulatory References

A reference in this Agreement to a section in the HIPAA Rules means the section as in effect or as amended from time to time. The parties acknowledge that HIPAA and its implementing regulations may be amended from time to time, and this Agreement shall be interpreted to comply with HIPAA as so amended.

12.2 Amendment

The parties agree to take such action as is necessary to amend this Agreement from time to time as is necessary for compliance with the requirements of the HIPAA Rules and any other applicable law. Either party may request an amendment to this Agreement to address changes in law or the parties' business relationship. Any amendment must be in writing and signed by both parties.

12.3 Interpretation

Any ambiguity in this Agreement shall be interpreted to permit compliance with the HIPAA Rules and to effectuate the intent of the parties to protect protected health information.

12.4 No Third-Party Beneficiaries

Nothing express or implied in this Agreement is intended to confer, nor shall anything herein confer, upon any person other than the parties and their respective successors and permitted assigns, any rights, remedies, obligations, or liabilities whatsoever.

12.5 Entire Agreement

This Agreement, together with any underlying service agreement or order form between the parties, constitutes the entire agreement between the parties with respect to the subject matter hereof and supersedes all prior or contemporaneous agreements, understandings, and communications, whether written or oral, relating to such subject matter.

12.6 Severability

If any provision of this Agreement is held to be invalid, illegal, or unenforceable, the validity, legality, and enforceability of the remaining provisions shall not be affected or impaired thereby, and such provision shall be reformed to the minimum extent necessary to make it valid, legal, and enforceable while preserving the intent of the parties.

12.7 Waiver

No waiver of any provision of this Agreement shall be effective unless it is in writing and signed by the party against whom the waiver is sought to be enforced. No failure or delay by either party in exercising any right, power, or remedy under this Agreement shall operate as a waiver thereof, nor shall any single or partial exercise of any such right, power, or remedy preclude any other or further exercise thereof or the exercise of any other right, power, or remedy.

12.8 Assignment

Neither party may assign or transfer this Agreement or any of its rights or obligations hereunder without the prior written consent of the other party, except that AlpineForm may assign this Agreement without consent in connection with a merger, acquisition, corporate reorganization, or sale of all or substantially all of its assets. Any attempted assignment or transfer in violation of this Section shall be void.

12.9 Notices

All notices, requests, consents, and other communications under this Agreement shall be in writing and shall be deemed to have been given:

• When delivered personally
• When sent by confirmed email
• Three (3) business days after being sent by registered or certified mail, return receipt requested, postage prepaid
• One (1) business day after being sent by overnight courier service

Notices to AlpineForm shall be sent to:

Pruett & Co., LLC, DBA AlpineForm
Attention: Scott Pruett, Security Official
Email: scott@alpineform.com
Physical Address: 8401 Mayland Dr, Ste A, Richmond, VA, 23294, USA

Notices to Covered Entity shall be sent to the address and contact person specified in the signature block below.

12.10 Force Majeure

Neither party shall be liable for any failure or delay in performance under this Agreement (except for payment obligations) to the extent such failure or delay is caused by circumstances beyond such party's reasonable control, including but not limited to acts of God, natural disasters, war, terrorism, riots, embargoes, acts of civil or military authorities, fire, floods, accidents, pandemics, epidemics, strikes, or shortages of transportation facilities, fuel, energy, labor, or materials.

12.11 Relationship of Parties

The parties are independent contractors. This Agreement does not create a partnership, franchise, joint venture, agency, fiduciary, or employment relationship between the parties. Neither party has the authority to bind the other or to incur any obligation on the other's behalf without the other party's prior written consent.

12.12 Counterparts

This Agreement may be executed in counterparts, each of which shall be deemed an original and all of which together shall constitute one and the same instrument. Electronic signatures shall have the same force and effect as original signatures.

13. About Subcontractors

The HIPAA Rules allow business associates to engage subcontractors that create, receive, maintain, or transmit protected health information on behalf of the business associate. Business associates are required to enter into business associate agreements with their subcontractors to ensure that protected health information is safeguarded.

AlpineForm utilizes subcontractors and has signed business associate agreements (BAAs) with each subcontractor that handles protected health information. These subcontractors provide technical infrastructure and services necessary for AlpineForm to provide the Services, including but not limited to:

• Proton AG: Email services and cloud storage
• Dropbox, Inc.: Cloud storage
• Linode, LLC: Server infrastructure and cloud storage

AlpineForm maintains a current list of all subcontractors with access to protected health information and will provide such list to Covered Entity upon written request. AlpineForm will notify Covered Entity in writing of any new subcontractors that will have access to protected health information at least ten (10) business days prior to such subcontractor's access to protected health information, unless such advance notice is impracticable due to emergency circumstances, in which case AlpineForm will notify Covered Entity as soon as reasonably practicable.

Each subcontractor that creates, receives, maintains, or transmits protected health information on behalf of AlpineForm has agreed in writing to:

• Comply with the applicable requirements of the HIPAA Rules
• Implement appropriate administrative, physical, and technical safeguards to protect protected health information
• Report security incidents and breaches to AlpineForm
• Return or destroy protected health information upon termination of the subcontract
• Be bound by the same restrictions and conditions that apply to AlpineForm with respect to protected health information

AlpineForm remains responsible and liable for the performance of its subcontractors under this Agreement.

14. Governing Law and Jurisdiction

14.1 Governing Law

This Agreement shall be governed by and construed in accordance with the laws of the Commonwealth of Virginia, without regard to its conflicts of law principles. However, to the extent that HIPAA or other federal law applies, such federal law shall govern.

14.2 Jurisdiction

The parties irrevocably submit to the exclusive jurisdiction of the state and federal courts located in Harrisonburg, Virginia, for any dispute, claim, or controversy arising out of or relating to this Agreement or the breach, termination, enforcement, interpretation, or validity thereof, including the determination of the scope or applicability of this agreement to arbitrate.

14.3 Waiver of Jury Trial

EACH PARTY HEREBY IRREVOCABLY WAIVES ANY AND ALL RIGHT TO TRIAL BY JURY IN ANY LEGAL PROCEEDING ARISING OUT OF OR RELATED TO THIS AGREEMENT OR THE TRANSACTIONS CONTEMPLATED HEREBY.

14.4 Class Action Waiver

Any claim brought by Covered Entity against AlpineForm shall proceed solely on an individual basis without the right for any claims to be arbitrated or litigated on a class action basis or in a representative capacity on behalf of others. Covered Entity waives any right to participate in or receive benefits from any class action, collective action, or representative action against AlpineForm.

15. Signature and Acceptance

This Business Associate Agreement is effective as of the date last signed below.

This Agreement is signed electronically. Covered Entity's authorized signatory completes Covered Entity's details below and accepts this Agreement in Covered Entity's AlpineForm account. AlpineForm signs when Covered Entity accepts. The completed signature block, with both signatures, the date, and a record of the acceptance, is the final page of each signed copy, and a signed copy is emailed to Covered Entity's signatory.

COVERED ENTITY: (completed at acceptance)

• Business/Organization Name
• Authorized Signatory
• Name (Printed)
• Title
• Date
• Email
• Notice Address
• Contact Person for HIPAA Matters: Name, Title, Email, and Phone

ALPINEFORM (Business Associate):

• Business Name: Pruett & Co., LLC, doing business as AlpineForm
• Authorized Signatory: signed electronically, as recorded on the signature page
• Name (Printed): Scott Pruett
• Title: Co-Founder, Security Official
• Date: the date of acceptance, as recorded on the signature page
• Email: scott@alpineform.com
• Notice Address: Pruett & Co., LLC, DBA AlpineForm; 8401 Mayland Dr, Ste A, Richmond, VA, 23294, USA
• Contact Person for HIPAA Matters: Scott Pruett, Security Official, scott@alpineform.com, (540) 358-0137

END OF BUSINESS ASSOCIATE AGREEMENT

Appendix A: Contact Information Update Form

Covered Entity may use this form to notify AlpineForm of changes to contact information, email addresses for receipt of ePHI, or contact persons for HIPAA matters.

Effective Date of Change: _________________________

Type of Change: (check all that apply)

☐ Primary contact person
☐ Email address for ePHI receipt
☐ Notice address
☐ Phone number
☐ Other: ___________________________

Updated Information:

_____________________________________________________________

_____________________________________________________________

_____________________________________________________________

Authorized Signature: _________________________________

Name (Printed): _________________________________

Title: _________________________________

Date: _________________________________

Document Version: 2.0
Last Updated: November 12, 2026
Replaces: AlpineForm BAA Version 1.0