BUSINESS ASSOCIATE AGREEMENT
InvisaClaim LLC
Effective Date: March 17, 2026
This Business Associate Agreement (“BAA” or “Agreement”) is entered into by and between:
Business Associate:
InvisaClaim LLC, a Florida limited liability company
433 Plaza Real, Suite 275
Boca Raton, FL 33432
Website: www.invisaclaim.com
Business Associate and Covered Entity may individually be referred to as a “Party” and collectively as the “Parties.”
RECITALS
WHEREAS, Covered Entity is a Covered Entity as defined under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), as amended by the Health Information Technology for Economic and Clinical Health Act (“HITECH Act”), and applicable implementing regulations;
WHEREAS, Business Associate operates an artificial intelligence-powered healthcare revenue cycle management and claims automation platform providing claims analysis, insurance denial identification, appeal preparation, reimbursement workflow automation, predictive analytics, and related administrative services;
WHEREAS, the Parties have entered into, or intend to enter into, one or more subscription, services, licensing, or other commercial agreements governing Business Associate's provision of services (collectively, the “Underlying Agreement”);
WHEREAS, Business Associate may create, receive, maintain, or transmit Protected Health Information (“PHI”) in performing services for Covered Entity;
WHEREAS, the Parties desire to establish their respective obligations concerning the privacy, security, confidentiality, use, and disclosure of PHI in compliance with applicable federal law;
NOW, THEREFORE, in consideration of the mutual covenants contained herein, the Parties agree as follows:
1. DEFINITIONS
1.1 HIPAA Rules. “HIPAA Rules” means the Privacy, Security, Breach Notification, and Enforcement Rules codified at 45 CFR Parts 160 and 164, as amended and applicable.
1.2 Protected Health Information. “PHI” shall have the meaning assigned under 45 CFR § 160.103 and shall include Electronic Protected Health Information (“ePHI”) where applicable.
1.3 Business Associate. InvisaClaim LLC, acting on behalf of Covered Entity in connection with the Services.
1.4 Services. The healthcare revenue cycle management, medical claims analysis, denial management, appeal preparation, claims automation, and related software and support services provided under the Underlying Agreement.
1.5 Subcontractor. Any third party that creates, receives, maintains, or transmits PHI on behalf of Business Associate in connection with the Services.
1.6 Security Incident. Shall have the meaning provided under 45 CFR § 164.304.
1.7 Breach. Shall have the meaning provided under 45 CFR § 164.402.
1.8 De-Identified Information. Information that has been de-identified in accordance with 45 CFR § 164.514(b).
1.9 Designated Record Set. Shall have the meaning assigned under 45 CFR § 164.501.
All other capitalized terms not specifically defined herein shall have the meanings assigned under the HIPAA Rules.
2. PERMITTED USES AND DISCLOSURES
2.1 Performance of Services.
Business Associate may use, process, maintain, and disclose PHI as reasonably necessary to perform the Services described in the Underlying Agreement, provided such activities comply with applicable HIPAA requirements.
Permitted activities may include:
Medical claims processing and analysis;
Insurance denial identification and classification;
Preparation and generation of insurance appeals;
Claims workflow automation;
Revenue cycle analytics and reporting;
Integration with electronic health record systems, practice management systems, and payer platforms;
Claims-related communications and administrative support;
Technical maintenance, troubleshooting, and security monitoring.
2.2 Management and Administration.
Business Associate may use PHI for its proper management and administration or to carry out its legal responsibilities, to the extent permitted by HIPAA.
Disclosures for these purposes shall occur only when required by law or when Business Associate obtains reasonable written assurances concerning confidentiality, permitted uses, and reporting of unauthorized disclosures, consistent with 45 CFR § 164.504(e).
2.3 Artificial Intelligence Processing.
Covered Entity acknowledges that Business Associate utilizes automated processing, machine learning, and artificial intelligence technologies in performing the Services.
Business Associate may process PHI through authorized systems and service providers solely as necessary to provide the contracted Services.
Business Associate shall not use identifiable PHI to train publicly available or general-purpose artificial intelligence models without a separate lawful basis and express written authorization from Covered Entity.
2.4 De-Identified Data.
Business Associate may de-identify PHI in accordance with 45 CFR § 164.514(b), provided such activity is otherwise permitted by the HIPAA Rules and this Agreement.
Once properly de-identified, information may be used by Business Associate for lawful purposes, including:
Product development and improvement;
AI model training and refinement;
Statistical analysis;
Claims processing optimization;
Platform performance evaluation;
Healthcare reimbursement research and analytics.
Business Associate shall not attempt to re-identify De-Identified Information except as permitted by applicable law and expressly authorized by Covered Entity.
2.5 Minimum Necessary.
Business Associate shall apply the minimum necessary standard to uses, disclosures, and requests for PHI where required by HIPAA.
2.6 Prohibited Uses.
Business Associate shall not:
Sell PHI except as expressly permitted by applicable law;
Use PHI for unauthorized marketing;
Disclose PHI to unauthorized third parties;
Use identifiable PHI for unrelated commercial purposes;
Engage in any use or disclosure that would violate the HIPAA Rules if performed by Covered Entity, except where expressly permitted for Business Associates.
3. OBLIGATIONS OF BUSINESS ASSOCIATE
3.1 Administrative, Physical, and Technical Safeguards.
Business Associate shall implement reasonable and appropriate administrative, physical, and technical safeguards to protect the confidentiality, integrity, and availability of ePHI in accordance with 45 CFR Part 164, Subpart C.
Such safeguards shall include, as applicable and required by law:
Role-based access controls;
Authentication and access management;
Encryption of PHI in transit and at rest;
Audit logging and security monitoring;
Workforce security and confidentiality procedures;
Risk analysis and risk management;
Incident response procedures;
Secure data storage and transmission;
Appropriate vendor security oversight.
Business Associate shall comply with applicable HIPAA Security Rule requirements, including future amendments as they become legally effective.
3.2 Reporting of Unauthorized Disclosures and Breaches.
Business Associate shall notify Covered Entity of any discovered Breach of Unsecured PHI without unreasonable delay and in no event later than five (5) business days following discovery.
Business Associate shall also report impermissible uses or disclosures and Security Incidents as required by 45 CFR § 164.314(a) and § 164.504(e).
The Parties acknowledge that routine unsuccessful security events, including blocked network scans, unsuccessful login attempts, and other unsuccessful attempts that do not result in unauthorized access, may be reported through periodic security summaries or other mutually agreed reporting procedures.
An initial report shall include information reasonably available at the time, including the nature of the incident, discovery date, categories of affected PHI, and mitigation actions.
Business Associate may supplement its report as additional information becomes available.
3.3 Mitigation.
Business Associate shall mitigate, to the extent practicable, harmful effects arising from any use or disclosure of PHI in violation of this Agreement.
3.4 Subcontractors and Third-Party Providers.
Business Associate may engage subcontractors, cloud infrastructure providers, software vendors, AI processing providers, and other service providers as reasonably necessary to perform the Services.
Business Associate shall ensure that any Subcontractor creating, receiving, maintaining, or transmitting PHI on its behalf agrees in writing to applicable restrictions, conditions, and safeguards consistent with 45 CFR § 164.504(e)(5).
Business Associate shall remain responsible for its own compliance obligations and for ensuring that required subcontractor agreements are in place.
Nothing in this provision shall create unlimited contractual liability for Business Associate for acts outside its reasonable control, except to the extent such liability cannot lawfully be limited.
3.5 Individual Access Requests.
To the extent Business Associate maintains PHI in a Designated Record Set, it shall make such PHI available to Covered Entity, or directly to an Individual when directed by Covered Entity, as necessary for Covered Entity to comply with 45 CFR § 164.524.
Business Associate shall respond within ten (10) business days after receiving a sufficiently detailed written request, unless another period is required by applicable law.
3.6 Amendment Requests.
Business Associate shall incorporate amendments to PHI in a Designated Record Set as directed by Covered Entity and as required under 45 CFR § 164.526.
3.7 Accounting of Disclosures.
Business Associate shall maintain and provide information concerning disclosures of PHI as necessary for Covered Entity to satisfy applicable accounting requirements under 45 CFR § 164.528.
3.8 Regulatory Compliance.
Business Associate shall make its internal practices, books, and records relating to the use and disclosure of PHI available to the Secretary of the United States Department of Health and Human Services as required for determining compliance with the HIPAA Rules.
3.9 Privacy and Security Documentation.
Upon reasonable written request, Business Associate may provide Covered Entity with appropriate documentation describing its HIPAA-related privacy and security practices, subject to reasonable confidentiality and security restrictions.
Business Associate shall not be required to disclose proprietary source code, trade secrets, security credentials, confidential infrastructure configurations, or other information where disclosure would create a material security risk, except where disclosure is required by law.
4. OBLIGATIONS OF COVERED ENTITY
4.1 Lawful Disclosure of PHI.
Covered Entity represents that PHI disclosed to Business Associate is collected, maintained, and disclosed in accordance with applicable law.
4.2 Authorizations and Notices.
Covered Entity shall be responsible for obtaining any legally required patient authorizations, providing applicable privacy notices, and maintaining appropriate policies governing its disclosure of PHI.
4.3 Restrictions.
Covered Entity shall promptly notify Business Associate of any agreed restrictions on PHI use or disclosure that materially affect the Services.
4.4 Accuracy and Completeness.
Covered Entity shall be responsible for the accuracy, completeness, and lawful provision of patient records, medical claims, coding information, payer information, and other data supplied to Business Associate.
4.5 Authorized Users.
Covered Entity shall manage access privileges for its authorized personnel and promptly notify Business Associate of suspected compromised credentials or unauthorized account activity.
4.6 Clinical and Billing Responsibility.
Covered Entity retains responsibility for clinical decisions, medical necessity determinations, coding accuracy, claims submissions, reimbursement representations, and final approval of appeals or other payer communications, except to the extent specific responsibilities are expressly assigned to Business Associate under the Underlying Agreement.
Business Associate's automated outputs are administrative support tools and do not independently constitute clinical or legal determinations.
4.7 Prohibited Requests.
Covered Entity shall not direct Business Associate to use or disclose PHI in a manner prohibited by applicable law.
5. TERM AND TERMINATION
5.1 Term.
This Agreement becomes effective on the Effective Date and shall remain in effect for as long as Business Associate creates, receives, maintains, or transmits PHI on behalf of Covered Entity, unless terminated in accordance with this Agreement.
5.2 Termination for Cause.
Upon knowledge of a material breach of this Agreement, the non-breaching Party shall provide written notice describing the breach.
Where cure is feasible, the breaching Party shall have thirty (30) calendar days to cure the breach, unless applicable law requires more immediate action.
If the breach is not cured within the permitted period, the non-breaching Party may terminate this Agreement and the affected Services.
Where cure is not feasible, the non-breaching Party may terminate the Agreement in accordance with applicable HIPAA requirements.
5.3 Termination of Underlying Services.
Termination or expiration of the Underlying Agreement shall terminate this BAA, subject to surviving obligations relating to PHI retained by Business Associate.
5.4 Return or Destruction of PHI.
Upon termination or expiration:
a. Covered Entity shall have thirty (30) calendar days to export available PHI through the platform or another mutually agreed secure method.
b. Business Associate shall return or destroy PHI received from Covered Entity, or created, maintained, or received on its behalf, including PHI held by subcontractors, if feasible.
c. Business Associate shall use commercially reasonable measures to delete PHI from active production systems following the applicable transition period.
d. PHI contained in encrypted backups, disaster recovery systems, immutable logs, or archival storage may remain until deletion through established retention cycles where immediate destruction is not feasible.
e. Any retained PHI shall remain subject to the safeguards and restrictions of this Agreement, and further uses and disclosures shall be limited to purposes that make return or destruction infeasible.
f. Business Associate shall not be required to destroy information that must be retained under applicable law, provided such information remains appropriately protected.
g. Upon reasonable request, Business Associate shall provide written confirmation describing completed deletion activities and any categories of PHI retained because destruction is infeasible.
5.5 Survival.
All obligations relating to retained PHI shall survive termination until such PHI is returned or destroyed, or until applicable legal obligations cease.
6. BREACH RESPONSE AND NOTIFICATION
6.1 Cooperation.
Business Associate shall reasonably cooperate with Covered Entity in investigating and responding to a Breach involving PHI processed through the Services.
6.2 Regulatory and Individual Notifications.
Covered Entity shall retain primary responsibility for determining whether notification to affected individuals, regulatory authorities, or other parties is required, except where applicable law directly imposes such responsibility upon Business Associate.
6.3 Allocation of Costs.
Each Party shall be responsible for costs arising from its own acts, omissions, negligence, willful misconduct, or failure to comply with applicable law, subject to the liability provisions of the Underlying Agreement to the extent legally enforceable.
6.4 No Automatic Admission of Liability.
Notification of a Security Incident or Breach shall not, by itself, constitute an admission of fault, negligence, or liability by Business Associate.
7. SECURITY COMPLIANCE AND TECHNOLOGY
7.1 HIPAA Security Rule.
Business Associate shall comply with applicable requirements of the HIPAA Security Rule as legally effective during the term of this Agreement.
7.2 Artificial Intelligence Infrastructure.
Business Associate may use authorized third-party technology providers for infrastructure hosting, AI processing, system integrations, and related operational purposes.
Where such providers qualify as HIPAA Subcontractors, Business Associate shall maintain appropriate written agreements before disclosing PHI to them.
7.3 Security Improvements.
Business Associate may modify its technical infrastructure, security controls, AI models, software architecture, and service providers, provided such modifications do not materially diminish the safeguards required by applicable law.
7.4 Security Incidents Outside Business Associate's Control.
Business Associate shall not be responsible for Security Incidents caused exclusively by Covered Entity's systems, unauthorized actions of Covered Entity's personnel, or third-party systems outside Business Associate's responsibility, except to the extent Business Associate contributed to the incident or otherwise breached its legal obligations.
8. INSURANCE
8.1 Coverage.
Business Associate shall maintain commercially reasonable cyber liability and privacy-related insurance coverage appropriate to its size, operations, risk exposure, and contractual obligations.
8.2 Evidence of Insurance.
Upon reasonable written request, Business Associate shall provide evidence of applicable insurance coverage, subject to insurer restrictions and confidentiality requirements.
8.3 No Expansion of Liability.
The existence, absence, or amount of insurance coverage shall not independently expand or limit either Party's liability under applicable law or the Underlying Agreement.
9. INDEMNIFICATION AND LIMITATION OF LIABILITY
9.1 Mutual Responsibility.
Each Party shall be responsible for its own acts and omissions in connection with this Agreement and its compliance with applicable HIPAA requirements.
9.2 Indemnification.
To the extent provided in the Underlying Agreement, each Party shall indemnify the other against third-party claims arising from its material breach of this Agreement, negligence, willful misconduct, or violation of applicable law.
9.3 Limitation of Liability.
Except to the extent prohibited by applicable law, the limitations and exclusions of liability set forth in the Underlying Agreement shall apply to claims arising under this BAA.
Nothing in this Agreement shall limit a Party's obligations to comply with HIPAA, restrict the enforcement authority of applicable governmental agencies, or eliminate liability that cannot lawfully be limited.
9.4 Exclusion of Certain Damages.
To the extent permitted by applicable law and the Underlying Agreement, neither Party shall be liable to the other for indirect, incidental, special, exemplary, punitive, or consequential damages, including lost profits or business interruption, except as otherwise expressly provided in the Underlying Agreement.
10. CONFIDENTIALITY AND PROPRIETARY TECHNOLOGY
10.1 Proprietary Rights.
All software, algorithms, artificial intelligence models, workflows, source code, system architecture, analytics methodologies, documentation, and related intellectual property developed or owned by Business Associate shall remain the exclusive property of Business Associate or its licensors.
10.2 No Transfer of PHI Ownership.
Nothing in this Agreement transfers ownership of Covered Entity's PHI to Business Associate.
10.3 No License to Proprietary Technology.
This Agreement does not grant Covered Entity ownership or any independent license to Business Associate's proprietary technology beyond the rights expressly granted under the Underlying Agreement.
10.4 Confidentiality.
Each Party shall protect the other Party's nonpublic confidential business information in accordance with applicable confidentiality obligations in the Underlying Agreement.
11. MISCELLANEOUS
11.1 Governing Law.
This Agreement shall be governed by applicable federal law and, to the extent not preempted, the laws of the State of Florida, without regard to conflict-of-law principles.
11.2 Dispute Resolution.
Any contractual dispute arising under this Agreement shall be resolved in accordance with the dispute resolution provisions of the Underlying Agreement.
If the Underlying Agreement contains no applicable dispute resolution provision, the Parties agree to binding arbitration administered by the American Arbitration Association under its Commercial Arbitration Rules, with the arbitration conducted in Boca Raton, Florida.
Nothing herein shall restrict the authority of governmental agencies to investigate or enforce applicable law.
11.3 Order of Precedence.
In the event of a conflict between this Agreement and the Underlying Agreement concerning the permitted use, disclosure, or safeguarding of PHI, this Agreement shall control to the extent necessary to comply with HIPAA.
Commercial terms, including subscription fees, payment obligations, intellectual property rights, warranties, and limitations of liability, shall remain governed by the Underlying Agreement to the extent legally permissible.
11.4 Amendments.
The Parties shall amend this Agreement as reasonably necessary to comply with changes in applicable law.
Except where an amendment is required by operation of law, amendments must be in writing and executed by authorized representatives of both Parties.
11.5 Severability.
If any provision is determined to be invalid or unenforceable, the remaining provisions shall remain in full force and effect.
11.6 No Third-Party Beneficiaries.
Nothing in this Agreement creates rights or remedies in favor of any person or entity other than the Parties, except as expressly required by applicable law.
11.7 Assignment.
Neither Party may assign this Agreement except as permitted under the Underlying Agreement, provided any permitted successor assumes applicable obligations concerning PHI.
11.8 Notices.
All formal notices under this Agreement shall be in writing and delivered to the designated addresses of the Parties, or to such other addresses as subsequently provided in writing.
Notices to Business Associate shall be directed to:
InvisaClaim LLC
433 Plaza Real, Suite 275
Boca Raton, FL 33432
11.9 Entire Agreement.
This Agreement, together with the Underlying Agreement and applicable amendments, constitutes the agreement of the Parties concerning the subject matter addressed herein.
11.10 Counterparts and Electronic Signatures.
This Agreement may be executed in counterparts and by electronic signature, each of which shall be deemed an original and all of which together constitute one instrument.
11.11 Regulatory Interpretation.
Any ambiguity in this Agreement shall be interpreted in a manner consistent with the Parties' obligations under applicable HIPAA requirements.
12. EXECUTION
IN WITNESS WHEREOF, the Parties have executed this Business Associate Agreement through their duly authorized representatives.
BUSINESS ASSOCIATE
InvisaClaim LLC
433 Plaza Real, Suite 275
Boca Raton, FL 33432