Business Associate Agreement

1Definitions

Terms used but not defined in this BAA have the meanings given to them under HIPAA, including the HIPAA Privacy Rule (45 CFR Part 164, Subparts A and E) and the HIPAA Security Rule (45 CFR Part 164, Subparts A and C).

“Protected Health Information” or “PHI” — Individually identifiable health information transmitted or maintained in any form or medium by Dental Nexus on behalf of the Covered Entity, as defined in 45 CFR §160.103. This includes, but is not limited to, patient references, clinical notes, STL files, dental radiographs, treatment plans and clinical photographs uploaded to the platform.

“Electronic Protected Health Information” or “ePHI” — PHI that is created, stored, transmitted or received electronically.

“Breach” — Has the meaning given in 45 CFR §164.402.

“Security Incident” — Has the meaning given in 45 CFR §164.304.

2Permitted Uses and Disclosures by Business Associate

Dental Nexus may use or disclose PHI only as follows:

a) To provide services. Dental Nexus may use and disclose PHI as necessary to provide the Dental Nexus platform, including case coordination, secure file sharing, workflow management, communication between the Covered Entity and independent providers, platform security, audit logging, and backup and disaster recovery.

b) As required by law. Dental Nexus may use or disclose PHI as required by applicable law, including HIPAA.

c) For Business Associate's operations. Dental Nexus may use PHI for its own proper management and administration, or to carry out its legal responsibilities, provided that disclosures are required by law or Dental Nexus obtains reasonable assurances from the recipient that the PHI will be kept confidential.

d) No other uses or disclosures. Dental Nexus will not use or disclose PHI in any manner not permitted by this BAA or HIPAA.

3Obligations of Business Associate

Dental Nexus agrees to:

a) Not use or disclose PHI other than as permitted or required by this BAA or applicable law.

b) Implement safeguards. Use appropriate administrative, physical and technical safeguards to protect the confidentiality, integrity and availability of ePHI, in accordance with the HIPAA Security Rule (45 CFR Part 164, Subpart C).

c) Report breaches and security incidents. Notify the Covered Entity of: any Breach of Unsecured PHI within 30 days of discovery, including the information required by 45 CFR §164.410; and any Security Incident of which Dental Nexus becomes aware, including attempted but unsuccessful incidents, in accordance with 45 CFR §164.314(a)(2)(i)(C). Reports should be directed to [EMAIL TO BE DETERMINED] or to the contact provided by the Covered Entity.

d) Sub-processors and subcontractors. Ensure that any subcontractor or sub-processor that creates, receives, maintains or transmits PHI on behalf of Dental Nexus agrees to the same restrictions and conditions as apply to Dental Nexus under this BAA. See §4 for disclosure of current PHI-accessing sub-processors.

e) Access and amendment. Provide access to PHI in a Designated Record Set to the Covered Entity or, as directed, to the individual, in accordance with 45 CFR §164.524. Accommodate requests to amend PHI in accordance with 45 CFR §164.526.

f) Accounting of disclosures. Make available the information required for the Covered Entity to provide an accounting of disclosures in accordance with 45 CFR §164.528.

g) Compliance assistance. Make its internal practices, books and records relating to the use and disclosure of PHI available to the Secretary of Health and Human Services for purposes of determining compliance with HIPAA.

h) Minimum necessary. Use, disclose or request only the minimum PHI necessary to accomplish the intended purpose.

i) No sale of PHI. Dental Nexus will not directly or indirectly receive remuneration in exchange for PHI, except as permitted under HIPAA.

j) No AI training on PHI. Dental Nexus will not use identifiable PHI to train artificial intelligence or machine learning models.

4Sub-processors with Access to PHI

The following Dental Nexus sub-processors may have access to PHI in the course of providing platform services. Dental Nexus maintains appropriate agreements with each:

4.1 AI Sub-processors

Dental Nexus works with one or more AI providers to deliver AI-assisted case processing features. When a Covered Entity activates an AI job, case files and clinical metadata are transmitted to the relevant AI provider. This constitutes PHI disclosure to a subcontractor.

Dental Nexus maintains BAA-equivalent agreements with AI providers that access PHI. Covered Entities should not activate AI-assisted processing unless they have accepted this BAA and understand that PHI will be transmitted to the relevant AI provider under those protections.

Dental Nexus will maintain and make available an up-to-date list of AI sub-processors upon written request to [EMAIL TO BE DETERMINED].

5Obligations of the Covered Entity

The Covered Entity agrees to:

a) Notify Dental Nexus of any restriction on the use or disclosure of PHI that the Covered Entity has agreed to in accordance with 45 CFR §164.522, to the extent such restriction may affect Dental Nexus's use or disclosure of PHI.

b) Notify Dental Nexus of any changes in or revocation of consent or authorization of individuals to use or disclose PHI, to the extent this affects Dental Nexus's permitted uses and disclosures.

c) Not request Dental Nexus to use or disclose PHI in any manner that would not be permissible under HIPAA if done by the Covered Entity.

d) Obtain all required patient authorizations and consents before uploading PHI to the Dental Nexus platform.

e) Implement appropriate access controls for its own users of the Dental Nexus platform and ensure that only authorized personnel upload or access PHI.

f) Use opaque patient references (e.g., a case number or initials) where clinically appropriate, rather than full patient names or other direct identifiers, to minimize PHI exposure on the platform.

6Term and Termination

a) Term. This BAA is effective upon the Covered Entity's acceptance of the Dental Nexus Terms of Service or DPA, and remains in effect for the duration of the service relationship.

b) Termination for cause. Either party may terminate this BAA immediately if the other party materially breaches a HIPAA obligation and fails to cure the breach within 30 days of written notice.

c) Obligations on termination. Upon termination, Dental Nexus will, at the direction of the Covered Entity, return or destroy all PHI received from or created on behalf of the Covered Entity, to the extent feasible. Where return or destruction is not feasible (for example, PHI held in backup systems), Dental Nexus will extend the protections of this BAA to such PHI for as long as it is retained, and will limit further uses and disclosures to those purposes that make the return or destruction infeasible.

d) Data deletion. PHI deletion requests are fulfilled via a managed process within 30 days of written request to [EMAIL TO BE DETERMINED]. Payment and audit records may be retained in pseudonymized form to meet legal and regulatory obligations.

7Amendments

Dental Nexus may amend this BAA from time to time to remain compliant with HIPAA and other applicable law. Material changes will be communicated to Covered Entities with reasonable advance notice. Continued use of the platform following notice of an amendment constitutes acceptance.

8Miscellaneous

a) Regulatory references. Any reference to a HIPAA regulation includes any amendments or successor provisions.

b) No third-party beneficiaries. This BAA is for the benefit of the parties only and does not create rights in any third party, including any patient.

c) Relationship to DPA. Where this BAA conflicts with the Dental Nexus DPA on matters relating to PHI, this BAA governs. In all other respects the DPA applies.

d) Governing law. This BAA is governed by the laws of [TO BE DETERMINED], subject to applicable federal law including HIPAA.

e) Entire agreement. This BAA, together with the Dental Nexus DPA and Terms of Service, constitutes the entire agreement between the parties with respect to HIPAA compliance.

f) Severability. If any provision of this BAA is found unenforceable, the remaining provisions continue in full force.

9Contact

To exercise rights under this BAA, report a Security Incident or Breach, or request a list of AI sub-processors:

Email: [EMAIL TO BE DETERMINED]
Company: Dental Nexus