Pfend HIPAA Business Associate Agreement

This HIPAA Business Associate Agreement ("BAA") is entered into between PFEND CORP., operating the Pfend service ("Pfend"), and the customer identified below or in the electronic acceptance record ("Customer"). It supplements and is incorporated into the Services Agreement between Pfend and Customer solely with respect to Protected Health Information processed through the Covered Services.

Pfend legal entity: PFEND CORP.

Pfend notice email: legal@pfend.com

Customer legal name: 

Customer notice email: 

Effective date: 

This BAA takes effect on the effective date stated above if signed by both parties, or when Customer electronically accepts this BAA through Pfend's acceptance process (the "BAA Effective Date"). An existing Services Agreement is required for this BAA to be effective. The person signing or electronically accepting this BAA on behalf of Customer represents that they have authority to bind Customer and that they have read and agree to this BAA.

1 Definitions

Capitalized terms not otherwise defined in this BAA have the meanings given in HIPAA or, where HIPAA does not define them, in the Services Agreement.

Business Associate, Covered Entity, Individual, Required by Law, and Subcontractor have the meanings given in 45 CFR § 160.103.

Breach has the meaning given in 45 CFR § 164.402, including the exceptions and risk assessment requirements in that section.

Breach Notification Rule means 45 CFR Part 164, Subpart D.

Covered Services means the Pfend AI scribing and clinical documentation services provided to Customer under the Services Agreement that create, receive, maintain, or transmit PHI on Customer's behalf. These include, to the extent provided under that agreement, capture and processing of clinical input, generation and revision of clinical documentation, incorporation and summarization of diagnostic results and prior records, and transfer or export of documentation to Customer's electronic medical record system. Covered Services include Pfend's associated processing, storage, and support activities involving PHI and services performed on Pfend's behalf by its Subcontractors. A feature expressly designated as unsuitable for PHI before Customer uses it is not a Covered Service, and Customer must not submit PHI to that feature.

Designated Record Set has the meaning given in 45 CFR § 164.501.

HIPAA means the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations at 45 CFR Parts 160 and 164, as amended, including amendments made by the HITECH Act.

HITECH Act means the Health Information Technology for Economic and Clinical Health Act and its implementing regulations, as amended.

Privacy Rule means 45 CFR Part 160 and Part 164, Subparts A and E.

Protected Health Information or PHI has the meaning given in 45 CFR § 160.103 and, for this BAA, means PHI that Pfend creates, receives, maintains, or transmits on behalf of Customer in connection with the Covered Services, including PHI contained in clinical inputs and generated documentation. Electronic PHI is PHI in electronic form.

Secretary means the Secretary of the United States Department of Health and Human Services or the Secretary's designee.

Security Incident has the meaning given in 45 CFR § 164.304.

Security Rule means 45 CFR Part 160 and Part 164, Subparts A and C.

Services Agreement means the written agreement between Pfend and Customer governing the Covered Services, including applicable online terms of service, order forms, and incorporated service terms.

Unsecured PHI has the meaning given in 45 CFR § 164.402.

2 Applicability

This BAA applies to the extent Customer acts as a Covered Entity or Business Associate and Pfend, through provision of the Covered Services, acts as Customer's Business Associate or Subcontractor under HIPAA. If Customer is a Business Associate, references to Customer's HIPAA obligations include its applicable obligations to the Covered Entity on whose behalf it acts.

This BAA governs PHI processed by Pfend and its Subcontractors on Customer's behalf. It does not govern Customer's independent use of third-party applications, electronic medical record systems, or local devices outside Pfend's provision of the Covered Services. That exclusion does not relieve Pfend of its obligations for PHI while Pfend or its Subcontractors create, receive, maintain, or transmit it on Customer's behalf.

3 Permitted and required uses and disclosures

(a) Performance of the Services Agreement. Pfend may use and disclose PHI only as necessary to provide the Covered Services for or on behalf of Customer, as otherwise permitted or required by this BAA, or as Required by Law. Pfend must not use or disclose PHI in a manner that would violate the Privacy Rule if done by the applicable Covered Entity, except for management, administration, and legal responsibilities expressly permitted under Section 3(b).

(b) Management, administration, and legal responsibilities. Pfend may use PHI as necessary for its proper management and administration or to carry out its legal responsibilities. Pfend may disclose PHI for these purposes only if the disclosure is Required by Law or Pfend obtains reasonable written assurances that the recipient will keep the PHI confidential, use or further disclose it only as Required by Law or for the purpose for which it was disclosed, and notify Pfend of any known breach of its confidentiality.

(c) Minimum necessary. Pfend will limit its uses, disclosures, and requests for PHI to the minimum necessary to accomplish the intended purpose, to the extent required by HIPAA.

(d) AI processing and other secondary uses. Processing PHI through AI systems to deliver the Covered Services is permitted subject to this BAA. This BAA does not authorize Pfend or its Subcontractors to use Customer's PHI to train or improve general-purpose or shared AI models, for advertising, or for sale. It also does not independently authorize de-identification of PHI for Pfend's unrelated purposes or data aggregation across customers. Any such additional use requires a separate written agreement with Customer and must be permitted under HIPAA and applicable law; Customer's agreement alone does not make an otherwise prohibited use permissible.

4 Pfend responsibilities

(a) Safeguards. Pfend will use appropriate safeguards to prevent use or disclosure of PHI other than as permitted by this BAA and will comply with the applicable requirements of the Security Rule with respect to electronic PHI.

(b) Incident and Breach reporting. Pfend will report to Customer, without unreasonable delay, any use or disclosure of PHI not permitted by this BAA and any Security Incident of which Pfend becomes aware, subject to Section 4(d). Pfend will notify Customer of a Breach of Unsecured PHI without unreasonable delay and in no event later than 60 calendar days after discovery, except to the extent a delay is permitted under 45 CFR § 164.412. Discovery will be determined in accordance with 45 CFR § 164.410(a)(2), including its reasonable diligence and imputed knowledge requirements. The 60-day limit is an outside deadline, not permission to delay reporting.

(c) Notice contents and cooperation. To the extent possible, Pfend's Breach notice will identify each affected Individual and include available information required under 45 CFR § 164.410(c), including the nature of the Breach, relevant dates, types of PHI involved, and mitigation measures. Pfend will provide additional information promptly as it becomes available, take reasonable steps to mitigate known harmful effects, and reasonably cooperate with Customer's investigation and notification obligations. Unless separately agreed in writing, Customer is responsible for required notices to Individuals, the Secretary, and the media. This allocation does not relieve Pfend of any notification obligation independently imposed on it by law.

(d) Unsuccessful attempts. This BAA constitutes continuing notice that Pfend may encounter routine unsuccessful attempts to access or interfere with its systems, including unsuccessful logins, port scans, pings, and blocked attacks. No separate notice of those attempts is required if they do not result in unauthorized access, acquisition, use, disclosure, modification, or destruction of PHI or material interference with systems containing PHI. This provision does not waive reporting of an impermissible use or disclosure, a Breach, or any other reportable Security Incident.

(e) Notice delivery. Pfend will deliver notices under this Section to Customer's notice email identified above or in its acceptance record, or to an updated address Customer provides in writing. Customer will keep that address current. Notices to Pfend will be sent to Pfend's notice email identified above or an updated address Pfend provides in writing. Sensitive incident details and PHI will be exchanged using an appropriate secure method.

(f) Subcontractors. In accordance with 45 CFR §§ 164.502(e)(1)(ii) and 164.308(b)(2), Pfend will ensure that each Subcontractor that creates, receives, maintains, or transmits PHI on Pfend's behalf agrees in writing to the same restrictions, conditions, and requirements that apply to Pfend with respect to that PHI, including applicable Security Rule requirements. This obligation includes cloud, transcription, and AI processing providers to the extent they handle PHI on Pfend's behalf. Pfend remains responsible under this BAA for its Subcontractors' performance as if performed by Pfend.

(g) Access and amendment. To the extent Pfend maintains PHI in a Designated Record Set on Customer's behalf, Pfend will make that PHI available to Customer as necessary for Customer to satisfy 45 CFR § 164.524. Pfend will make PHI available for amendment and incorporate amendments as directed or agreed to by Customer, or take other measures as necessary to satisfy 45 CFR § 164.526. Pfend will respond in a reasonably requested time and manner that enables Customer to meet applicable HIPAA deadlines. Customer determines whether records are part of its Designated Record Set and is responsible for responding to Individuals. If Pfend receives an Individual's request directly, it will promptly forward the request to Customer and will not independently decide it unless authorized by Customer or Required by Law.

(h) Accounting of disclosures. Pfend will document disclosures of PHI and maintain and make available to Customer the information necessary for Customer to provide an accounting under 45 CFR § 164.528, to the extent required by HIPAA. Pfend will provide this information in a reasonably requested time and manner that enables Customer to meet applicable deadlines. Customer will reasonably assist in identifying affected Individuals and relevant PHI where information held by Pfend alone is insufficient.

(i) Secretary's access. Pfend will make its internal practices, books, and records relating to the use and disclosure of PHI received from Customer, or created or received on Customer's behalf, available to the Secretary for purposes of determining compliance with HIPAA, as required by law. Nothing in the Services Agreement will restrict this required access.

(j) Return or destruction. Upon termination of this BAA or the applicable Services Agreement, Pfend will return or destroy all PHI received from Customer, or created, received, or maintained on Customer's behalf, that Pfend or its Subcontractors retain in any form, and retain no copies, if feasible. Pfend will reasonably cooperate with Customer to permit return before destruction. If return or destruction is infeasible, Pfend will inform Customer of the reason, extend the protections of this BAA to the retained PHI, and limit further uses and disclosures to the purposes that make return or destruction infeasible. Pfend will return or destroy that PHI when the reason for infeasibility no longer applies. These obligations continue for as long as Pfend or its Subcontractors retain the PHI.

(k) Delegated Privacy Rule obligations. To the extent Pfend carries out any of Customer's obligations under the Privacy Rule, Pfend will comply with the requirements of the Privacy Rule that apply to Customer in performing those obligations.

5 Customer responsibilities

(a) Authority and permissible requests. Customer will ensure that it has authority under HIPAA and applicable law to disclose PHI to Pfend and to direct the processing contemplated by the Services Agreement. Customer will not request any use or disclosure that would be impermissible under HIPAA if performed by the applicable Covered Entity, except uses expressly permitted for a Business Associate under HIPAA and this BAA. An Individual user must be authorized to act for the Customer whose PHI is processed.

(b) Use of the Covered Services. Customer will use available access, account, and security controls appropriately, restrict access to authorized users, protect user credentials and devices, and submit PHI only through Covered Services. Customer remains responsible for its own HIPAA compliance and its independent electronic medical record systems and other applications. These responsibilities do not reduce Pfend's obligations under this BAA.

(c) Safeguards and minimum necessary. Customer will use appropriate safeguards to prevent unauthorized use or disclosure of PHI and will limit PHI provided to Pfend to the minimum necessary to the extent required by HIPAA.

(d) Privacy practices and restrictions. Customer will notify Pfend of limitations in its notice of privacy practices, changes or revocations of permissions, and agreed or legally required restrictions under 45 CFR § 164.522, to the extent they affect Pfend's permitted processing. Pfend will comply with applicable restrictions communicated by Customer. If a restriction prevents lawful provision of a Covered Service, the parties will cooperate to modify or stop the affected processing.

(e) Clinical documentation. Customer is responsible for clinical decisions, review and approval of generated documentation, and management of its official medical records. These responsibilities do not excuse an impermissible use or disclosure of PHI by Pfend or its Subcontractors.

6 Term and termination

(a) Term. This BAA begins on the BAA Effective Date and continues until terminated under this Section or until all Services Agreements covering the Covered Services expire or terminate, subject to the surviving obligations in Section 7(a).

(b) Material breach. If either party materially breaches this BAA, the other party may terminate this BAA and the affected Covered Services on 30 days' written notice unless the breach is cured within that period. If cure is not reasonably possible, or a shorter period is necessary to comply with HIPAA, the other party may terminate immediately by written notice. Customer may terminate for a material violation by Pfend as required under 45 CFR § 164.504(e). Nothing in this Section limits a party's obligation to take legally required action to address a known violation.

(c) PHI processing after termination. Upon termination of this BAA, Customer must stop submitting PHI to Pfend and Pfend must stop processing PHI except as necessary for return or destruction under Section 4(j) or as Required by Law. Any continued use under the Services Agreement must be limited to services that do not involve PHI unless the parties enter into another effective BAA. Customer's removal of PHI does not relieve Pfend of its obligations concerning PHI remaining in its or its Subcontractors' possession.

7 Miscellaneous

(a) Survival. Section 4(j), this Section 7, and all obligations necessary to protect or lawfully handle retained PHI survive expiration or termination for as long as the relevant PHI is retained.

(b) Order of precedence and governing law. If this BAA conflicts with the Services Agreement concerning PHI, this BAA controls. Except as expressly modified by this BAA, the Services Agreement remains in effect. Its governing law and dispute resolution provisions apply, subject to HIPAA and other applicable law. Nothing in either agreement limits a regulatory obligation or authority.

(c) No third-party beneficiaries. This BAA does not create contractual rights for persons other than Pfend, Customer, and their permitted successors and assigns.

(d) Regulatory references and interpretation. References to HIPAA provisions mean those provisions as amended and applicable. Any ambiguity will be interpreted to permit compliance with HIPAA. The parties will cooperate in making amendments necessary to comply with applicable changes in law. Substantive amendments must be agreed in writing, including by valid electronic acceptance.

(e) Electronic acceptance and counterparts. This BAA may be signed in counterparts or accepted electronically. Electronic signatures and an authorized electronic acceptance record may evidence execution. If Customer accepts electronically through Pfend's acceptance process, separate handwritten signatures are not required.

Execution

For electronic acceptance, Customer's legal name, authorized representative, notice email, acceptance date, and accepted BAA version will be recorded in the acceptance record. For signature execution, complete the fields below.

Pfend

Legal entity: PFEND CORP.

Authorized signature: ____________________________________

Name and title: _________________________________________

Date: __________________________________________________

Customer

Legal entity:

Authorized signature: ____________________________________

Name and title: _________________________________________

Date: __________________________________________________

BAA Version: 2026-10-02