Provider Business Associate Agreement

1. Parties and purpose

This Provider Business Associate Agreement (the "Agreement") is entered into by Silverforge Holdings LLC d/b/a Compounding Finder ("Compounding Finder" or "Business Associate") and the physician, nurse practitioner, physician assistant, other licensed prescriber, clinic, medical practice, or other account holder that accepts this Agreement through the Compounding Finder provider tools ("Provider" or "Covered Entity").

This Agreement applies when Compounding Finder creates, receives, maintains, or transmits Protected Health Information on behalf of Provider in connection with provider e-prescribing and referral services, including creating, electronically signing, storing, and transmitting compounded prescriptions and related patient information; notifying patients and collecting pharmacy quotes on their behalf; releasing prescription and patient contact information to the pharmacy the patient selects or Provider designates; prescriber verification; coverage checks; provider dashboards; support, analytics, billing support, security, compliance, and related services (the "Services").

If Provider is not acting as a HIPAA covered entity for a specific transaction, the parties agree that patient information shared through the Services will still be handled under the confidentiality, security, and use restrictions in this Agreement to the extent applicable.

2. Definitions

Capitalized terms not defined in this Agreement have the same meaning as in the HIPAA Rules. "HIPAA Rules" means the Privacy, Security, Breach Notification, and Enforcement Rules at 45 CFR Parts 160 and 164, as amended.

"Protected Health Information" or "PHI" means protected health information, including electronic protected health information ("ePHI"), received from Provider or created, received, maintained, or transmitted by Compounding Finder on behalf of Provider.

"Patient Information" means patient, prescription, medication, contact, quote request, referral, billing, support, or related information processed through the Services, whether or not the information is PHI in a particular context.

"Prescription Information" means the content of a prescription Provider creates or signs through the Services, including the patient identified on it, the medication, strength, form, quantity, directions, refills, compounding instructions, indication, and any statement of medical necessity.

3. Permitted uses and disclosures by Compounding Finder

Compounding Finder may use and disclose PHI only as permitted or required by this Agreement, by the applicable terms of use or service agreement, or as required by law.

Compounding Finder may use and disclose PHI as reasonably necessary to provide, operate, support, secure, improve, and document the Services, including rendering and storing signed prescriptions, routing de-identified prescription details to licensed pharmacies for quotes, contacting the patient at the email address or phone number Provider supplies, releasing Prescription Information and patient contact details to the pharmacy the patient selects or Provider designates, supporting patient, pharmacy, and Provider communications, maintaining audit logs, preventing fraud or abuse, troubleshooting service issues, and performing billing or administrative functions related to the Services.

Disclosures of PHI to a dispensing pharmacy under this Agreement are made at Provider's direction for treatment and dispensing. Each pharmacy in the Compounding Finder network is separately bound to Compounding Finder by a business associate agreement covering the Patient Information it receives through the Services.

Compounding Finder may use PHI for its proper management and administration and to carry out its legal responsibilities. Compounding Finder may disclose PHI for those purposes only if the disclosure is required by law or if Compounding Finder obtains reasonable assurances that the recipient will keep the information confidential and use or further disclose it only as required by law or for the purpose for which it was disclosed.

Compounding Finder may provide data aggregation services relating to Provider health care operations, and may de-identify PHI in accordance with 45 CFR 164.514. De-identified information is not PHI under this Agreement.

Compounding Finder will make uses, disclosures, and requests for PHI consistent with the minimum necessary standard when that standard applies. Before a patient selects a pharmacy, pharmacies receive only the clinical content of a prescription and not the patient's or Provider's identity.

Compounding Finder will not sell PHI or use PHI for marketing in a manner that would require an individual authorization under the HIPAA Rules unless the required authorization has been obtained.

4. Obligations of Compounding Finder

Compounding Finder will not use or disclose PHI other than as permitted by this Agreement or as required by law.

Compounding Finder will use appropriate administrative, technical, and physical safeguards to prevent use or disclosure of PHI other than as permitted by this Agreement. With respect to ePHI, Compounding Finder will comply with the applicable requirements of Subpart C of 45 CFR Part 164.

Compounding Finder will ensure that subcontractors that create, receive, maintain, or transmit PHI on behalf of Compounding Finder agree to restrictions, conditions, and requirements that are at least as protective as those that apply to Compounding Finder with respect to that PHI.

Compounding Finder will make its internal practices, books, and records relating to PHI received from, or created or received by Compounding Finder on behalf of, Provider available to the Secretary of the U.S. Department of Health and Human Services for purposes of determining compliance with the HIPAA Rules.

Compounding Finder will maintain a record of each prescription created through the Services, including the identity of the signing prescriber, the time of signature, and the pharmacy to which it was released, and will make that record available to Provider on request.

5. Reporting incidents and breaches

Compounding Finder will report to Provider any use or disclosure of PHI not permitted by this Agreement of which Compounding Finder becomes aware, including any Breach of Unsecured Protected Health Information as required by 45 CFR 164.410 and any Security Incident of which Compounding Finder becomes aware.

Compounding Finder will make the report without unreasonable delay and, for a Breach of Unsecured Protected Health Information, no later than ten business days after discovery unless a shorter period is required by law or the parties agree in writing to a different incident response process.

The report will include, to the extent known at the time, the nature of the incident, the PHI involved, affected individuals if known, mitigation steps taken or planned, and contact information for follow-up.

6. Individual rights and HIPAA support

To the extent PHI maintained by Compounding Finder is part of a Designated Record Set, Compounding Finder will make PHI available to Provider as reasonably necessary for Provider to satisfy access obligations under 45 CFR 164.524.

Compounding Finder will make PHI available for amendment and incorporate amendments as directed or agreed to by Provider as reasonably necessary for Provider to satisfy 45 CFR 164.526.

Compounding Finder will maintain and make available information required for an accounting of disclosures as reasonably necessary for Provider to satisfy 45 CFR 164.528.

To the extent Compounding Finder carries out one or more of Provider's obligations under Subpart E of 45 CFR Part 164, Compounding Finder will comply with the requirements of Subpart E that apply to Provider in performing those obligations.

7. Provider obligations

Provider will not request Compounding Finder to use or disclose PHI in a manner that would violate the HIPAA Rules if done by Provider.

Provider will notify Compounding Finder of any limitation in Provider's notice of privacy practices, restriction on use or disclosure, or revocation or change of permission by an individual, in each case to the extent the limitation, restriction, revocation, or change may affect Compounding Finder's use or disclosure of PHI.

Provider represents that it is permitted to disclose the Patient Information it enters into the Services for the purposes described in this Agreement, and that it has given any notice or obtained any authorization its own policies or applicable law require before doing so.

Provider is solely responsible for the clinical content and legal validity of each prescription it creates or signs through the Services, including compliance with the prescribing, electronic prescribing, licensure, and controlled-substance laws of the states in which Provider and the patient are located. Provider will not use the Services to prescribe or transmit any controlled substance. Compounding Finder does not practice medicine or pharmacy, does not prescribe or dispense, and does not alter the content of a prescription.

Provider is responsible for the accuracy of the prescriber identity, license, and contact information in its account, for keeping its account credentials and sign-in email secure, for ensuring that only authorized individuals sign prescriptions through its account, and for notifying Compounding Finder promptly of any unauthorized use.

Provider is responsible for determining whether it is a covered entity, whether information it provides or receives is PHI, and whether its use of the Services complies with laws applicable to its practice.

8. Term and termination

This Agreement is effective on the date Provider accepts it electronically through the Compounding Finder provider tools and remains in effect while Compounding Finder maintains PHI on behalf of Provider or while Provider uses the Services, unless terminated earlier.

Provider may terminate this Agreement if Compounding Finder materially breaches this Agreement and fails to cure the breach within a reasonable time after written notice, unless cure is not feasible. Compounding Finder may suspend or terminate the Services if Provider materially breaches the applicable terms of use or this Agreement.

Upon termination, if feasible, Compounding Finder will return or destroy PHI received from Provider or created, received, maintained, or transmitted by Compounding Finder on behalf of Provider. If return or destruction is not feasible or if retention is required by law, Compounding Finder will continue to protect the retained PHI and limit further uses and disclosures to the purposes that make return or destruction infeasible or legally required. Prescription Information already released to a pharmacy at the patient's selection remains with that pharmacy under its own obligations.

The obligations that by their nature should survive termination, including confidentiality, safeguards, return or destruction, and limits on retained PHI, will survive termination.

9. Miscellaneous

A reference in this Agreement to a section of the HIPAA Rules means the section as in effect or as amended.

The parties will take reasonable action necessary to amend this Agreement as needed for compliance with the HIPAA Rules or other applicable law.

Any ambiguity in this Agreement will be interpreted to permit compliance with the HIPAA Rules.

This Agreement may be accepted electronically. The individual accepting this Agreement on behalf of Provider represents that they are authorized to bind Provider. Electronic acceptance is intended to create a legally binding agreement to the fullest extent permitted by applicable law.

If this Agreement conflicts with any other agreement between the parties, this Agreement controls with respect to PHI and HIPAA matters. All non-HIPAA service terms remain governed by the Compounding Finder terms of use or any separate service agreement.