[{"data":1,"prerenderedAt":152},["ShallowReactive",2],{"legal:\u002Flegal\u002Fbaa":3},{"id":4,"title":5,"body":6,"description":129,"extension":140,"meta":141,"navigation":143,"path":144,"seo":145,"stem":150,"__hash__":151},"content\u002Flegal\u002Fbaa.md","LightLeapAI® Business Associate Addendum",{"type":7,"value":8,"toc":128},"minimark",[9,14,18,22,25,28,31,34,37,40,43,46,49,52,55,59,62,66,69,73,76,80,83,87,90,94],[10,11,13],"h2",{"id":12},"_1-activation","1. Activation",[15,16,17],"p",{},"This Business Associate Addendum (\"BAA\") takes effect only when the Customer activates it in Part H of the DSA Schedule for a health services deployment. Until then it imposes no obligations. Once activated, it applies to Protected Health Information (\"PHI\") that N2N creates, receives, maintains, or transmits on the Customer's behalf. Terms used but not defined here have the meanings given in HIPAA, the HITECH Act, and their implementing regulations (\"HIPAA Rules\"). Where the Customer selects the HHS model business associate agreement in the DSA Schedule, that model replaces this BAA.",[10,19,21],{"id":20},"_2-n2ns-obligations","2. N2N's Obligations",[15,23,24],{},"N2N will:",[15,26,27],{},"(a) use or disclose PHI only as this BAA permits or as required by law;",[15,29,30],{},"(b) use appropriate safeguards and comply with 45 C.F.R. Part 164, Subpart C for electronic PHI;",[15,32,33],{},"(c) report to the Customer any use or disclosure not permitted by this BAA, and any Security Incident. Initial notice will be given within the period in DSA Terms Section 10.1. Notice of a Breach of Unsecured PHI, with the information required by 45 C.F.R. § 164.410, will be given without unreasonable delay and no later than sixty (60) days after discovery. Unsuccessful attempts that do not result in unauthorized access, such as pings, port scans, and blocked log-in attempts, are reported in summary on request and need no individual notice;",[15,35,36],{},"(d) ensure that subcontractors that handle PHI agree in writing to the same restrictions and conditions (45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2));",[15,38,39],{},"(e) make PHI in a designated record set available to the Customer as needed for 45 C.F.R. § 164.524 (access);",[15,41,42],{},"(f) make PHI available for amendment, and incorporate amendments, as needed for 45 C.F.R. § 164.526;",[15,44,45],{},"(g) maintain and provide the information needed for an accounting of disclosures under 45 C.F.R. § 164.528;",[15,47,48],{},"(h) to the extent N2N carries out a Covered Entity obligation, comply with the requirements of Subpart E that apply to that obligation;",[15,50,51],{},"(i) make its internal practices, books, and records available to the Secretary of HHS for purposes of determining compliance; and",[15,53,54],{},"(j) limit uses, disclosures, and requests to the minimum necessary.",[10,56,58],{"id":57},"_3-permitted-uses-and-disclosures","3. Permitted Uses and Disclosures",[15,60,61],{},"N2N may use and disclose PHI (a) to perform the health services use cases activated in the DSA Schedule; (b) for its proper management and administration or to meet its legal responsibilities, provided disclosures are required by law or N2N obtains reasonable assurances of confidentiality and notice of any breach; and (c) where Tier 2 photographic identity is authorized, for IAL2 identity verification of an individual accessing health services, and for no other purpose.",[10,63,65],{"id":64},"_4-customer-obligations","4. Customer Obligations",[15,67,68],{},"The Customer will not request any use or disclosure that would be impermissible under the HIPAA Rules if made by the Customer and will notify N2N of any limitation in its notice of privacy practices, or any restriction it has agreed to, that affects N2N's use or disclosure of PHI.",[10,70,72],{"id":71},"_5-term-and-termination","5. Term and Termination",[15,74,75],{},"This BAA ends when the DSA ends. If N2N materially violates this BAA and does not cure the violation within thirty (30) days after notice, the Customer may terminate the affected Order Forms. On termination, N2N will return or destroy PHI under DSA Terms Section 13; if that is infeasible, N2N will extend this BAA's protections to the retained PHI and limit further use to the purposes that make return or destruction infeasible.",[10,77,79],{"id":78},"_6-liability","6. Liability",[15,81,82],{},"MSA Section 9 applies. N2N's liability for a Breach of Unsecured PHI is subject to the Data Protection Cap (MSA Section 9.3) or, where the breach results from N2N's gross negligence or willful misconduct, the Aggregate Ceiling (MSA Section 9.5).",[10,84,86],{"id":85},"_7-interpretation","7. Interpretation",[15,88,89],{},"References to the HIPAA Rules mean those rules as amended. Any ambiguity will be resolved to permit compliance with the HIPAA Rules.",[10,91,93],{"id":92},"revision-history","Revision history",[95,96,97,113],"table",{},[98,99,100],"thead",{},[101,102,103,107,110],"tr",{},[104,105,106],"th",{},"Version",[104,108,109],{},"Effective",[104,111,112],{},"Summary",[114,115,116],"tbody",{},[101,117,118,122,125],{},[119,120,121],"td",{},"2027.01",[119,123,124],{},"November 7, 2026",[119,126,127],{},"Initial posted version. Replaces DSA Exhibit C; adds 45 C.F.R. §§ 164.526 and 164.528 obligations.",{"title":129,"searchDepth":130,"depth":130,"links":131},"",2,[132,133,134,135,136,137,138,139],{"id":12,"depth":130,"text":13},{"id":20,"depth":130,"text":21},{"id":57,"depth":130,"text":58},{"id":64,"depth":130,"text":65},{"id":71,"depth":130,"text":72},{"id":78,"depth":130,"text":79},{"id":85,"depth":130,"text":86},{"id":92,"depth":130,"text":93},"md",{"version":121,"effective":124,"canonicalUrl":142},"\u002Flegal\u002Fbaa\u002F",true,"\u002Flegal\u002Fbaa",{"title":146,"description":147,"image":148,"imageAlt":149,"canonical":142},"Business Associate Addendum | LightLeapAI®","HIPAA terms for health services deployments, activated in the DSA Schedule, covering PHI uses, safeguards, breach notice, and subcontractors.","\u002Fimages\u002Fog\u002Fog-legal.jpg","LightLeapAI® Legal — Business Associate Addendum.","legal\u002Fbaa","34NfjtNubxLNN8-zzSyTiZdwHRt7CUqEaKFxXpgVpS8",1794079363154]