Read it, then sign below. Version 2026-11-07.
BUSINESS ASSOCIATE AGREEMENT
This Business Associate Agreement ("BAA") is entered into as of the date of electronic signature below (the "Effective Date") by and between MedBriefly, Inc., a corporation organized under the laws of the Commonwealth of Pennsylvania ("Business Associate"), and the practice or legal entity named in the signature block ("Covered Entity").
This BAA is executed electronically and constitutes a valid and enforceable agreement in accordance with the U.S. Electronic Signatures in Global and National Commerce Act (ESIGN) and the Uniform Electronic Transactions Act (UETA), with the same force and effect as an agreement executed by handwritten signature.
1. DEFINITIONS
Except as otherwise provided here, capitalized terms not defined in this BAA have the meanings given in the Health Insurance Portability and Accountability Act of 1996, as amended, and its implementing regulations, including 45 C.F.R. Parts 160 and 164 (together, "HIPAA").
"Protected Health Information" or "PHI" has the meaning given to "protected health information" under HIPAA.
"Services" means MedOne, the medical documentation and practice-assistant platform, and any related services that Business Associate provides to Covered Entity.
2. OBLIGATIONS AND ACTIVITIES OF BUSINESS ASSOCIATE
2.1 Permitted Uses and Disclosures. Business Associate shall use and disclose PHI only as reasonably necessary to perform the Services on behalf of Covered Entity, and as otherwise permitted or required by this BAA or by HIPAA.
2.2 Safeguards. Business Associate shall implement and maintain appropriate administrative, physical and technical safeguards designed to protect the confidentiality, integrity and availability of PHI, in compliance with the HIPAA Security Rule.
2.3 Reporting of Breaches. Business Associate shall notify Covered Entity without unreasonable delay, and in no event later than forty-eight (48) hours after discovery, of any Breach of Unsecured PHI as defined under HIPAA.
2.4 Subcontractors. Business Associate may engage subcontractors or agents, including cloud hosting providers, to perform Services involving PHI, provided they are bound by written agreements imposing privacy and security obligations no less protective than those in this BAA.
2.5 Reporting of Unauthorized Uses and Disclosures. Business Associate shall report to Covered Entity any use or disclosure of PHI not provided for by this BAA, and any Security Incident, of which it becomes aware.
2.6 Access by the Secretary. Business Associate shall make its internal practices, books and records relating to the use and disclosure of PHI available to the Secretary of the U.S. Department of Health and Human Services for purposes of determining compliance with HIPAA.
3. OBLIGATIONS OF COVERED ENTITY
Covered Entity shall:
- use the Services in compliance with HIPAA and all applicable federal, state and local laws;
- ensure that all PHI disclosed to Business Associate has been lawfully obtained and disclosed in accordance with HIPAA; and
- not ask Business Associate to use or disclose PHI in any manner that would violate HIPAA or other applicable law.
4. ACCESS, AMENDMENT AND ACCOUNTING
To the extent required by HIPAA, Business Associate shall make PHI available to Covered Entity to enable Covered Entity to comply with its obligations under 45 C.F.R. 164.524, 164.526 and 164.528.
5. TERM AND TERMINATION
5.1 Term. This BAA remains in effect for as long as Business Associate provides Services involving PHI to Covered Entity.
5.2 Termination for Cause. Either party may terminate this BAA on written notice if the other commits a material breach that remains uncured thirty (30) days after written notice.
5.3 Effect of Termination. On termination, Business Associate shall return or securely destroy all PHI received from Covered Entity, except to the extent retention is required by applicable law.
6. SURVIVAL
The obligations of Business Associate under this BAA survive any termination or expiration of this BAA.
7. MISCELLANEOUS
7.1 Governing Law; Venue. This BAA is governed by the laws of the Commonwealth of Pennsylvania, without regard to conflict-of-laws principles. Any legal action arising out of or relating to this BAA shall be brought exclusively in the state or federal courts located in the Commonwealth of Pennsylvania, and the parties submit to the personal jurisdiction and venue of those courts.
SERVICE TERMS
These Service Terms ("Terms") govern Covered Entity's ("Customer's") access to and use of MedOne and the related MedBriefly services (the "Services"), and are incorporated by reference into the Business Associate Agreement above.
1. ELIGIBILITY AND ACCOUNT USE
The Services are intended solely for licensed healthcare professionals and their authorized personnel. Account sharing is strictly prohibited because of HIPAA security requirements. Each authorized user must keep a unique account credential.
1.1 Patient Consent for Recording. Customer is solely responsible for obtaining all required patient consents, authorizations and notices before recording any patient encounter or conversation with the Services, including compliance with all applicable federal, state and local consent, wiretapping and recording laws. MedBriefly does not obtain patient consent on Customer's behalf and disclaims responsibility for Customer's recording practices.
Customer agrees to indemnify, defend and hold harmless MedBriefly from claims, damages, penalties, fines, liabilities and expenses (including reasonable attorneys' fees) arising from Customer's failure to obtain valid patient consent before recording.
2. FREE TRIAL, SUBSCRIPTIONS AND CANCELLATION
A 7-day free trial is available to new practices. The trial starts when MedBriefly sets up Customer's practice, and MedBriefly will contact Customer within twenty-four (24) business hours of this signature to arrange it. After the trial, the Services are provided under a plan and price agreed with MedBriefly in writing for Customer's practice.
To cancel, Customer must contact MedBriefly at sbromberg@medbriefly.com. Cancellation requests require up to twenty-four (24) hours to process. Requests submitted within twenty-four (24) hours of a renewal date may not be honored. Subscription fees are non-refundable unless MedBriefly agrees otherwise in writing.
3. NO MEDICAL ADVICE; ACCURACY AND AI DISCLAIMER
MedBriefly provides documentation and workflow assistance tools only. The Services use automated transcription and artificial intelligence that may produce incomplete, inaccurate, misleading or erroneous output.
Customer acknowledges that all AI-generated content must be independently reviewed, verified and approved by a licensed healthcare professional before use, and that MedBriefly does not provide medical, legal or regulatory advice. Customer retains sole responsibility for all clinical decisions, documentation accuracy, patient care, billing, coding and regulatory compliance.
4. INTELLECTUAL PROPERTY
MedBriefly retains all right, title and interest in the Services. Customer retains ownership of its data and clinical documentation.
5. LIMITATION OF LIABILITY
To the maximum extent permitted by law, MedBriefly is not liable for any indirect, incidental, consequential, special, exemplary or punitive damages arising out of or relating to the Services or this agreement. MedBriefly's aggregate liability shall not exceed the total fees paid by Customer to MedBriefly in the twelve (12) months before the event giving rise to the claim.
6. DATA RETENTION AND DELETION
After the Services end, Customer data is retained for thirty (30) days to allow export or reactivation and is then permanently deleted, unless retention is required by applicable law or legal process.
7. GOVERNING LAW; DISPUTE RESOLUTION
These Terms are governed by the laws of the Commonwealth of Pennsylvania.
7.1 Binding Arbitration; Class Action Waiver. Except for claims seeking injunctive or equitable relief relating to intellectual property or confidentiality, all disputes arising out of or relating to the Services or these Terms shall be resolved exclusively by binding arbitration administered by the American Arbitration Association. The arbitration shall take place in the Commonwealth of Pennsylvania, and disputes may be brought only on an individual basis. CUSTOMER EXPRESSLY WAIVES ANY RIGHT TO A JURY TRIAL OR TO PARTICIPATE IN A CLASS ACTION.
8. ENTIRE AGREEMENT
These Terms, together with the Business Associate Agreement above, are the entire agreement between the parties and supersede all prior or contemporaneous agreements about the Services.