Provider Business Associate Agreement

1.1 "Protected Health Information" (PHI) means individually identifiable health information transmitted or maintained in any form or medium, as defined by HIPAA.

1.2 "HIPAA" means the Health Insurance Portability and Accountability Act of 1996, as amended by the HITECH Act, and all implementing regulations.

1.3 "Business Associate" means NexProLink, Inc., which provides encrypted video communication infrastructure to Covered Entities.

1.4 "Covered Entity" means the healthcare provider or practice using NexProLink's platform for patient communication.

2.1 NexProLink provides encrypted video communication infrastructure via Amazon Chime SDK (HIPAA-eligible), appointment scheduling, and payment facilitation for telehealth consultations between healthcare providers and their patients. In providing these services, NexProLink acts as a Business Associate under HIPAA, as defined in 45 C.F.R. § 160.103.

2.2 Limited PHI NexProLink Handles as Business Associate: Solely to facilitate scheduling, video communication, and payment processing on behalf of the Covered Entity, NexProLink may create, receive, maintain, or transmit the following limited categories of PHI: (a) appointment scheduling records linking a patient's name and contact information (email address, phone number) to a specific appointment with the Covered Entity; (b) session metadata (appointment date, time, duration, and session type); and (c) payment records for healthcare services rendered (amount, date, and provider identity). All such data is stored with AES-256 encryption at rest (AWS DynamoDB) and TLS 1.2+ encryption in transit.

2.3 What NexProLink Does NOT Access or Store: NexProLink does not store, record, transcribe, or access the audio or video content of any telehealth session. All session audio and video is routed end-to-end encrypted via Amazon Chime SDK and is never recorded or retained by NexProLink. Clinical notes, diagnoses, prescriptions, lab results, treatment plans, and all other clinical documentation are not collected, processed, or stored by NexProLink and remain exclusively on the Covered Entity's own systems, under the Covered Entity's sole control and responsibility. NexProLink is not a clinical documentation platform and does not provide medical record storage.

3.1 NexProLink shall not use or disclose PHI other than as permitted or required by this BAA or as required by law.

3.2 NexProLink shall use appropriate administrative, physical, and technical safeguards to prevent unauthorized use or disclosure of PHI, including AES-256 encryption for all video sessions.

3.3 NexProLink shall report to the Covered Entity any use or disclosure of PHI not provided for by this BAA of which NexProLink becomes aware, including any security incident or breach.

3.4 NexProLink has executed a Business Associate Agreement with Amazon Web Services (AWS), which provides the underlying HIPAA-eligible infrastructure (Amazon Chime SDK).

4.1 The Covered Entity shall be solely responsible for obtaining patient consent and maintaining all medical records, notes, and documentation from telehealth sessions.

4.2 The Covered Entity acknowledges that NexProLink does not store PHI and shall not rely on NexProLink for medical record storage or retrieval.

4.3 The Covered Entity shall comply with all applicable HIPAA requirements, including the Privacy Rule, Security Rule, and Breach Notification Rule.

4.4 The Covered Entity shall ensure that its use of the NexProLink platform complies with telehealth regulations in each jurisdiction where it provides services.

5.1 This BAA shall be effective upon the Covered Entity's acceptance (by saving their professional credentials on the NexProLink platform) and shall remain in effect for the duration of the Covered Entity's use of the platform.

5.2 Either party may terminate this BAA upon 30 days' written notice to the other party. Upon termination, NexProLink shall return or destroy any PHI in its possession, if applicable.

5.3 The obligations of NexProLink under this BAA shall survive termination with respect to any PHI that NexProLink retains after termination, if any.

For questions regarding this Business Associate Agreement, please contact: