Business Associate Agreement

Customer is a licensed insurance agent or agency that, in Medicare-related activities, may be a Covered Entity or a Business Associate under HIPAA. Customer uses the Evrcad Insurance Suite ("Service") to create, receive, maintain, or transmit Protected Health Information, and Evrcad acts as a Business Associate (or subcontractor Business Associate) of Customer.

Terms not defined here have the meanings in HIPAA (45 CFR Parts 160 and 164). "PHI" means protected health information Evrcad creates, receives, maintains, or transmits on Customer’s behalf through the Service, including electronic PHI ("ePHI"). "Breach," "Security Incident," "Required by Law," "Subcontractor," and "Unsecured PHI" have their HIPAA meanings. "Subprocessor" means a Subcontractor engaged by Evrcad that creates, receives, maintains, or transmits PHI in connection with the Service. "Subprocessor List" means the current list of Subprocessors that Evrcad maintains and makes available to Customer under Section 3.11.

2.1 Evrcad may use and disclose PHI only as necessary to perform the Service and as otherwise permitted or required by this Agreement or Required by Law.

2.2 Evrcad may use PHI for its own proper management and administration and to carry out its legal responsibilities, and may disclose PHI for such purposes only if Required by Law or with reasonable confidentiality assurances and breach-notification commitments from the recipient.

2.3 Evrcad may provide data aggregation services relating to Customer’s health care operations, per 45 CFR §164.504(e)(2)(i)(B).

2.4 Evrcad may de-identify PHI per 45 CFR §164.514(a)–(c); de-identified data is not PHI.

2.5 Evrcad will not use or disclose PHI in a manner that would violate the Privacy Rule if done by Customer, except as permitted above; will not sell PHI; and will not use PHI for marketing except as permitted by HIPAA and the Underlying Agreement.

3.1 Safeguards. Evrcad will implement administrative, physical, and technical safeguards protecting ePHI and comply with the Security Rule. Current safeguards include TLS in transit and AES-256 at rest, role-based access controls, network segmentation, logging via AWS CloudTrail and CloudWatch, and multi-tenant isolation via tenant identifiers and Row-Level Security.

3.2 Evrcad will not use or disclose PHI other than as permitted by this Agreement or Required by Law.

3.3 Evrcad will report to Customer any impermissible use or disclosure, any Security Incident, and any Breach of Unsecured PHI, per Section 4.

3.4 Subcontractors. Per 45 CFR §164.502(e)(1)(ii) and §164.308(b)(2), Evrcad will bind any Subcontractor that handles PHI to terms at least as restrictive as those here. Evrcad maintains a BAA with Amazon Web Services covering HIPAA-eligible AWS services (including RDS, S3, Bedrock, SES, and logging). The current Subprocessor List is available at https://insurance.evrcad.com/subprocessors; the addition, removal, or replacement of Subprocessors is governed by Section 3.11.

3.5 Access. Within [FIFTEEN (15)] business days of a written request, Evrcad will make PHI in a Designated Record Set available to satisfy 45 CFR §164.524.

3.6 Amendment. Within [FIFTEEN (15)] business days, Evrcad will make PHI available for amendment and incorporate amendments per 45 CFR §164.526.

3.7 Accounting. Evrcad will document disclosures and make information available for an accounting per 45 CFR §164.528 within [THIRTY (30)] days of a written request.

3.8 HHS Access. Evrcad will make relevant internal practices, books, and records available to the Secretary of HHS for compliance determinations.

3.9 Minimum Necessary. Evrcad will limit use, disclosure, and requests of PHI to the minimum necessary.

3.10 Mitigation. Evrcad will take reasonable steps to mitigate harmful effects of any impermissible use or disclosure of which it becomes aware.

3.11 Subprocessor List; Changes to Subprocessors. Evrcad maintains the Subprocessor List at https://insurance.evrcad.com/subprocessors and may add, remove, or replace Subprocessors from time to time as its vendors and infrastructure change. Before a new or replacement Subprocessor begins handling PHI, Evrcad will (a) bind that Subprocessor to written terms at least as restrictive as those in this Agreement, consistent with 45 CFR §164.502(e)(1)(ii) and §164.308(b)(2), and (b) update the Subprocessor List and notify Customer by email, in-app notice, or by posting the updated Subprocessor List with a revised effective date. Such changes take effect without any amendment or re-execution of this Agreement, and Customer’s continued use of the Service after a change’s effective date constitutes acceptance of that change. If Customer objects to a new Subprocessor on reasonable, documented data-protection grounds, Customer’s sole and exclusive remedy is to notify Evrcad in writing within [FIFTEEN (15)] days after notice of the change and, if the parties cannot resolve the objection within a reasonable period, to discontinue use of the affected feature or terminate the applicable Service under Section 5.

3.12 Annual Verification of Safeguards. At least once every twelve (12) months, Evrcad will review the technical safeguards it deploys to protect ePHI and confirm in writing, through a qualified member of its personnel, that the safeguards required by the Security Rule and this Agreement are in place. Evrcad will make a written summary of the most recent verification available to Customer upon reasonable written request. If HHS finalizes a rule requiring business associates to verify safeguards on a defined schedule or in a defined form — including the annual written-verification requirement proposed in the January 2025 Security Rule Notice of Proposed Rulemaking — Evrcad will conform its verification to the requirements and timing of that final rule when it takes effect. This Section does not entitle Customer to Evrcad’s proprietary security details, audit work-papers, penetration-test results, or system configurations beyond what is reasonably necessary to confirm compliance.

4.1 Evrcad will notify Customer of any Breach of Unsecured PHI without unreasonable delay and no later than 60 calendar days after discovery. The parties acknowledge 45 CFR §164.410(b) permits up to 60 days;

4.2 To the extent known, notice will identify affected individuals and include information Customer needs to meet its 45 CFR §164.404 obligations.

4.3 Unsuccessful Security Incidents (pings, scans, and similar attempts not resulting in unauthorized access) need not be reported individually; this Section is notice of their ongoing existence.

5.1 Term. Effective on acceptance and continuing until all PHI is returned or destroyed under Section 5.4 or the Agreement is terminated.

5.2 Termination for cause. On a known material breach, Customer may give written notice and a [THIRTY (30)]-day cure period; if not cured, Customer may terminate this Agreement and the applicable Service.

5.3 On termination, Customer’s right to use the Service for PHI ends.

5.4 Return or destruction. On termination, Evrcad will, if feasible, return or destroy all PHI and retain no copies. Where infeasible — including PHI embedded in records subject to mandatory retention (Section 5.5) — Evrcad will extend this Agreement’s protections and limit further use to the purposes making return/destruction infeasible.

5.5 Regulatory retention carve-out. Certain records must be retained notwithstanding termination: Medicare marketing and sales call recordings (at least six (6) years under the CY2027 final rule; audio years 1–3, audio or complete accurate transcript years 4–6); Medicare enrollment records, including the enrollment portion of any call (at least ten (10) years); Scope of Appointment and HIPAA documentation (at least six (6) years). Evrcad may satisfy this retention obligation by returning or delivering the applicable records to Customer, who thereupon assumes responsibility for retaining them for the remainder of the applicable period; upon such delivery and acknowledgment, Evrcad has no further retention obligation for those records.

6.1 References to HIPAA mean the provisions as in effect or amended. 6.2 The parties will amend as needed to comply with HIPAA changes; material changes will be communicated with reasonable notice. 6.3 Ambiguities are resolved to permit HIPAA compliance. 6.4 No third-party beneficiaries. 6.5 Sections 3.8, 5.4, and 5.5 survive termination for as long as Evrcad retains PHI. 6.6 Governed by Utah law except where preempted by federal law. 6.7 Limitation of liability. Each party’s liability under this Agreement is subject to the limitations of liability, disclaimers, and exclusions in the Underlying Agreement, except to the extent those limitations are prohibited by HIPAA or other applicable law. 6.8 Allocation of responsibility. Customer is responsible for its own compliance with HIPAA; for configuring and using the Service in accordance with Evrcad’s documentation; for the accuracy and lawfulness of the PHI it inputs; and for not transmitting PHI through any channel Evrcad designates as non-PHI, including SMS and MMS. As between the parties, Evrcad is not responsible for Customer’s or its authorized users’ acts or omissions.

By checking the Business Associate Agreement box during onboarding, or by using the Service to create, receive, maintain, or transmit PHI, Customer agrees to this Agreement. Electronic acceptance, recorded with timestamp and IP address, constitutes a binding signature. A copy is available from legal@evrcad.com.