BUSINESS ASSOCIATE AGREEMENT
Recall by Clickcase | Version 2026-08-19
This Business Associate Agreement ("BAA") is entered into by and between the customer legal entity identified in the applicable Agreement, Order, Recall account, signature block, or electronic acceptance record, on behalf of itself and any Covered Affiliates it is authorized to bind (collectively, "Covered Entity"), and CLICKCASE TECHNOLOGIES LLC ("Business Associate"). Recall is a service of Business Associate and is not a separate contracting party.
This BAA is incorporated into and forms part of the applicable subscription agreement, professional services agreement, order form, online terms, or other agreement governing the Services (the "Agreement"). If the parties have no separate Agreement, this BAA will operate as a standalone written contract governing Business Associate's receipt, creation, maintenance, transmission, use, and disclosure of Protected Health Information. This BAA becomes effective on the date Covered Entity signs or electronically accepts it after Business Associate has made it available for acceptance, or on the date both parties sign it, as applicable (the "Effective Date"). Covered Entity will not provide PHI to Business Associate before the Effective Date. The parties intend this BAA to satisfy 45 C.F.R. Sections 164.502(e), 164.504(e), 164.308(b), and 164.314(a), as amended.
The parties agree as follows:
1DEFINITIONS
1.1HIPAA Terms.
Unless otherwise defined in this BAA, capitalized terms including "Breach," "Data Aggregation," "Designated Record Set," "Disclosure," "Electronic Protected Health Information," "Health Care Operations," "Individual," "Minimum Necessary," "Protected Health Information," "Required by Law," "Secretary," "Security Incident," "Subcontractor," "Unsecured Protected Health Information," and "Use" have the meanings assigned under the HIPAA Rules.
1.2"HIPAA Rules"
means the Health Insurance Portability and Accountability Act of 1996, the Health Information Technology for Economic and Clinical Health Act, and their implementing Privacy, Security, Breach Notification, and Enforcement Rules at 45 C.F.R. Parts 160 and 164, in each case as amended from time to time.
1.3"Agreement"
means the applicable agreement described in the second paragraph of this BAA, together with applicable Orders and online acceptance records.
1.4"Covered Affiliate"
means an entity under common control with the customer that is a Covered Entity or Business Associate under HIPAA, receives the Services, and is identified in the Agreement, an Order, or the Recall account, but only to the extent the accepting signer is authorized to bind that entity.
1.5"Services"
means the services Business Associate provides to Covered Entity through Recall or otherwise under the Agreement, to the extent they involve PHI. The Services may include patient-contact and audience-data import, validation, processing, hosting, and management; AI-assisted drafting and editing; message personalization; setup and administration of one-time campaigns, ongoing programs, and message sequences; SMS and email transmission; delivery, reply, engagement, opt-out, and suppression processing; reporting and analytics; and related support, security, administration, and deletion activities.
1.6"De-identified Data"
means data that Business Associate has de-identified in accordance with 45 C.F.R. Section 164.514(a)-(c), using Safe Harbor or a documented Expert Determination, and that is no longer PHI under HIPAA.
1.7"Benchmark Products"
means analyses, datasets, reports, models, insights, products, or services created exclusively from De-identified Data and other non-PHI information and designed not to identify Covered Entity or any Individual.
1.8"Acceptance Record"
means the electronic record evidencing acceptance of this BAA, which may include the Covered Entity legal name, signer identity and title, authority attestation, authenticated account or user identifier, acceptance date and time, BAA version and document hash, acceptance method, and related audit information.
2RESPONSIBILITIES OF BUSINESS ASSOCIATE
With regard to PHI, Business Associate agrees to:
2.1Permitted Use.
not use or disclose PHI except as necessary to provide the Services, as permitted or required by this BAA or the Agreement, or as Required by Law. Business Associate will use PHI to provide communications and related Services on behalf of Covered Entity and will not use PHI to market Business Associate's or a third party's products or services for its own account. This restriction does not limit the rights applicable to De-identified Data and Benchmark Products under Section 4.4. To the extent Business Associate carries out a Covered Entity obligation under the Privacy Rule, Business Associate will comply with the Privacy Rule requirements that apply to Covered Entity in performing that obligation.
2.2Safeguards.
implement appropriate administrative, physical, and technical safeguards to prevent use or disclosure of PHI other than as provided by this BAA, and comply with the applicable requirements of the Security Rule with respect to Electronic Protected Health Information.
2.3Minimum Necessary.
make uses, disclosures, and requests for PHI consistent with Covered Entity's Minimum Necessary policies and procedures that are communicated to Business Associate and reasonably applicable to the Services. If Covered Entity has not communicated applicable policies, Business Associate will apply reasonable Minimum Necessary practices appropriate to the Services.
2.4Incident and Breach Reporting.
report to Covered Entity any use or disclosure of PHI not provided for by this BAA, any Breach of Unsecured Protected Health Information, and any Security Incident of which Business Associate becomes aware. A Breach will be reported without unreasonable delay and in no event later than sixty (60) calendar days after discovery, as required by 45 C.F.R. Section 164.410. Reports will include, to the extent known, the information required by 45 C.F.R. Section 164.410(c), and Business Associate will supplement the report as additional information becomes available. Routine unsuccessful attempts that do not result in unauthorized access, use, disclosure, modification, or destruction of PHI, or interference with system operations, are deemed reported on an aggregate basis and do not require individual notice.
2.5Breach Response and Notifications.
promptly investigate incidents within its control and perform any risk assessment required of Business Associate under the HIPAA Rules. Covered Entity retains responsibility for determining and providing notifications to Individuals, the Secretary, or the media, except to the extent Covered Entity delegates a notification function to Business Associate in a separate written instruction or applicable law requires otherwise. Business Associate will reasonably cooperate. To the extent a Breach results from Business Associate's material breach of this BAA, Business Associate will be responsible for reasonable, actual, direct notification costs attributable to that Breach, subject to the Agreement and applicable law.
2.6Subcontractors.
ensure that each Subcontractor that creates, receives, maintains, or transmits PHI on behalf of Business Associate agrees in writing to the same restrictions, conditions, and requirements that apply to Business Associate with respect to the PHI, including applicable Security Rule obligations, through an agreement satisfying 45 C.F.R. Sections 164.308(b), 164.314(a), and 164.504(e). If Business Associate knows of a pattern of activity or practice by a Subcontractor that constitutes a material breach or violation, Business Associate will take reasonable steps to cure the breach or end the violation and, if those steps are unsuccessful, terminate the relationship if feasible.
2.7Secretary Access.
make its internal practices, books, and records relating to the use and disclosure of PHI received from, or created or received on behalf of, Covered Entity available to the Secretary for purposes of determining compliance with the HIPAA Rules.
2.8Accounting of Disclosures.
maintain and make available to Covered Entity the information required for an accounting of disclosures as necessary to satisfy Covered Entity's obligations under 45 C.F.R. Section 164.528.
2.9Access.
make PHI in a Designated Record Set available to Covered Entity as necessary to satisfy Covered Entity's obligations under 45 C.F.R. Section 164.524.
2.10Amendment.
make PHI in a Designated Record Set available for amendment and incorporate amendments as directed or agreed to by Covered Entity, or take other measures necessary to satisfy Covered Entity's obligations under 45 C.F.R. Section 164.526.
2.11Direct Individual Requests.
promptly forward to Covered Entity any request received directly from an Individual for access, amendment, or an accounting of disclosures. Business Associate will not respond substantively to the Individual unless directed by Covered Entity or Required by Law. The parties will cooperate so Covered Entity can satisfy applicable legal deadlines.
2.12Mitigation.
mitigate, to the extent practicable, any harmful effect of a use or disclosure of PHI by Business Associate in violation of this BAA that becomes known to Business Associate.
3RESPONSIBILITIES OF COVERED ENTITY
In addition to its obligations under the Agreement and this BAA, Covered Entity:
3.1Minimum Necessary.
will provide, request, use, and disclose only the Minimum Necessary PHI reasonably required for the Services, except where the Minimum Necessary standard does not apply under HIPAA.
3.2Privacy Notices.
will notify Business Associate of any limitation in its notice of privacy practices under 45 C.F.R. Section 164.520 to the extent the limitation may affect Business Associate's use or disclosure of PHI.
3.3Permissions and Revocations.
will notify Business Associate of any change in, or revocation of, permission by an Individual to use or disclose PHI to the extent the change may affect Business Associate's use or disclosure of PHI.
3.4Restrictions.
will notify Business Associate of any restriction on the use or disclosure of PHI that Covered Entity has agreed to or is required to honor under 45 C.F.R. Section 164.522, to the extent the restriction may affect the Services.
3.5Administration of Restrictions.
Business Associate will administer restrictions, revocations, and limitations communicated under Sections 3.2 through 3.4 to the extent applicable to PHI within the Services and supported by the Services. If Business Associate cannot administer a binding restriction or limitation, it will promptly notify Covered Entity and cease the affected use or disclosure until Covered Entity provides lawful instructions or the parties agree on an alternative. If a requested limitation requires material, non-standard work, the parties may agree on reasonable additional fees or a limitation of the affected feature, but Business Associate may not disregard a binding restriction while continuing the affected processing.
3.6Permissible Instructions.
will not request Business Associate to use or disclose PHI in a manner that would violate the Privacy Rule if done by Covered Entity, except for uses and disclosures expressly permitted for Business Associate's management and administration, legal responsibilities, Data Aggregation, or de-identification under this BAA.
3.7Campaign Authority and Approval.
represents that it is legally authorized to provide PHI to Business Associate and to direct the Services. Covered Entity is responsible for determining the lawful basis for each audience and communication, including whether any HIPAA authorization, patient permission, telephone or text-message consent, email requirement, communication preference, or suppression obligation applies. AI-assisted output, including output attributed to Florence, is a draft requiring Covered Entity's human review and approval. Covered Entity is responsible for audience selection, targeting criteria, campaign purpose, medical and factual accuracy, claims, legal classification, approval of final content, and the decision to send. Business Associate may rely on Covered Entity's documented instructions unless Business Associate knows the instruction would violate applicable law, and may suspend an affected campaign that reasonably appears unlawful or creates a material privacy or security risk while the parties resolve the issue. Each party remains responsible for laws applicable to its own conduct.
3.8Opt-Outs and Suppression.
will provide current opt-out, revocation, and suppression information known to Covered Entity before a campaign is sent. Business Associate will apply opt-outs and revocations received through the Services to the applicable channel and make that information reasonably available to Covered Entity. Covered Entity remains responsible for applying preferences and suppressions received outside the Services.
4PERMITTED USES AND DISCLOSURES OF PHI
Unless otherwise limited by this BAA, Business Associate may:
4.1Services.
use and disclose PHI as necessary to provide the Services to Covered Entity and to carry out Covered Entity's documented, lawful instructions.
4.2Management, Administration, and Legal Responsibilities.
use PHI if necessary for the proper management and administration of Business Associate or to carry out its legal responsibilities. Business Associate may disclose PHI for those purposes only if the disclosure is Required by Law or Business Associate obtains reasonable written assurances from the recipient that the information will remain confidential, will be used or further disclosed only as Required by Law or for the purpose for which it was disclosed, and the recipient will notify Business Associate of any breach of confidentiality.
4.3De-identification.
de-identify PHI received from, or created or received on behalf of, Covered Entity in accordance with 45 C.F.R. Section 164.514(a)-(c), using Safe Harbor or a documented Expert Determination. Business Associate will document the applicable method and results, will not disclose any re-identification mechanism, and will not attempt to re-identify De-identified Data.
4.4Data Aggregation and Benchmark Products.
provide Data Aggregation services relating to the Health Care Operations of Covered Entity as permitted by HIPAA. After information has been properly de-identified under Section 4.3, it is not PHI under HIPAA. Subject to the Agreement and applicable law, Business Associate may retain, combine, analyze, use, disclose, and create derivative works from De-identified Data for analytics, benchmarking, security, product improvement, service development, and the creation, sale, licensing, distribution, and sublicensing of Benchmark Products. As between the parties, Business Associate owns the Benchmark Products but does not own Covered Entity's PHI. Business Associate will not represent that a Benchmark Product identifies Covered Entity or an Individual, disclose a re-identification mechanism, or attempt to re-identify the underlying information. A recipient of De-identified Data or a Benchmark Product must be subject to written restrictions appropriate to preserve de-identified status and prohibit re-identification.
4.5Required by Law and Other Permitted Disclosures.
use or disclose PHI as Required by Law. At Covered Entity's documented instruction, Business Associate may support a use or disclosure permitted under 45 C.F.R. Section 164.512, provided it is within the Services and would be permissible if made by Covered Entity.
4.6Limited Data Sets.
create or use a Limited Data Set only for a purpose permitted by HIPAA and only under a separate Data Use Agreement satisfying 45 C.F.R. Section 164.514(e). A Limited Data Set remains PHI and will not be sold, licensed, or distributed as a Benchmark Product.
4.7Privacy Rule Limitation.
not use or disclose PHI in a manner that would violate Subpart E of 45 C.F.R. Part 164 if done by Covered Entity, except for the specific uses and disclosures permitted by Sections 4.2 through 4.4.
4.8No Sale of PHI.
not sell or license PHI. For clarity, Section 4.4 applies only after information has been properly de-identified in accordance with HIPAA and does not authorize the sale or licensing of PHI or a Limited Data Set.
5TERM AND TERMINATION
5.1Term.
This BAA begins on the Effective Date and remains in effect for as long as Business Associate maintains PHI on behalf of Covered Entity, unless terminated in accordance with this BAA.
5.2Termination for Cause.
If Covered Entity determines that Business Associate has violated a material term of this BAA, Covered Entity will provide written notice describing the breach or violation. Business Associate will cure the breach or end the violation within thirty (30) days after receipt of notice, unless the breach is incapable of cure or a shorter period is required by law. If Business Associate does not timely cure or end the violation, or cure is infeasible, Covered Entity may terminate the Agreement and this BAA, or report the issue to the Secretary if termination is infeasible.
5.3Effect of Termination or Expiration.
Upon expiration or termination, Business Associate will provide Covered Entity a reasonable opportunity to export PHI maintained in an exportable form, then return to Covered Entity or destroy all PHI that Business Associate or its Subcontractors still maintain, if feasible, and retain no active copies. If return or destruction is infeasible or retention is Required by Law, Business Associate may retain only the PHI necessary for that purpose, will continue all protections under this BAA, and will limit further uses and disclosures to the purpose making return or destruction infeasible. PHI remaining in archival backups may be retained until overwritten under Business Associate's documented retention schedule and will be treated as infeasible to return or destroy during that period. De-identified Data and Benchmark Products validly created before termination are not PHI and may be retained and used under Section 4.4. Business Associate will not create new De-identified Data from retained PHI after termination except as expressly permitted by this BAA and applicable law.
5.4Cooperation.
Each party will reasonably cooperate with the other in connection with a request for information or documents from a federal or state governmental authority, or a governmental investigation, complaint, action, or inquiry relating to this BAA, subject to applicable law, privilege, confidentiality obligations, and any cost allocation in the Agreement.
6MISCELLANEOUS
6.1Regulatory References and Amendment.
References to the HIPAA Rules mean the cited provisions as in effect or as amended. The parties will take such action as is reasonably necessary to amend this BAA for continued compliance with the HIPAA Rules and other applicable law.
6.2Construction.
Any ambiguity in this BAA will be interpreted to permit compliance with the HIPAA Rules.
6.3Order of Precedence.
If this BAA conflicts with the Agreement regarding the use, disclosure, safeguarding, return, or destruction of PHI, this BAA controls. The Agreement controls on all other matters, including commercial terms and limitations of liability, to the extent permitted by law.
6.4Survival.
Sections 2.7 through 2.12, 4.3, 4.4, 4.8, 5.3, 5.4, and 6.1 through 6.8 survive expiration or termination to the extent their purpose requires.
6.5No Third-Party Beneficiaries.
Nothing in this BAA confers rights, remedies, obligations, or liabilities on any person other than the parties and their permitted successors and assigns.
6.6Electronic Execution.
This BAA may be executed in counterparts and by electronic signature or electronic acceptance. Electronic signatures and affirmative clickwrap acceptance have the same force and effect as handwritten signatures. Business Associate's act of making this BAA available for acceptance through an authenticated Recall onboarding or account flow and accepting or activating Covered Entity's Recall account constitutes Business Associate's execution and offer of this BAA; Covered Entity's affirmative acceptance following an opportunity to review and retain the BAA constitutes Covered Entity's execution. A separate countersignature is not required unless the parties agree otherwise in writing.
6.7Acceptance Record and Authority.
The parties may evidence execution through an Acceptance Record. Business Associate will preserve an accurately reproducible copy of the accepted BAA and the corresponding Acceptance Record and will make a copy reasonably available to Covered Entity. Covered Entity represents that the accepting signer is authorized to bind the identified legal entity and Covered Affiliates listed in the applicable account or Agreement.
6.8Retention.
Each party will retain this BAA and related documentation for at least six (6) years from the date of creation or the date when it last was in effect, whichever is later, or for any longer period required by applicable law or the Agreement.
6.9Notices.
Notices under this BAA will be delivered using the notice method in the Agreement. If no separate Agreement exists, notices may be delivered to the legal and privacy or security contacts maintained in the Recall account. Covered Entity is responsible for keeping those contacts current.
6.10Severability and No Waiver.
If any provision is held unenforceable, it will be enforced to the maximum extent permitted and the remaining provisions will continue in effect. Failure to enforce a provision is not a waiver of that provision or any other provision.
ACCEPTANCE AND SIGNATURES
The parties may accept this BAA electronically as described in Section 6.6. The following signature blocks may be used for manual execution.
| CLICKCASE TECHNOLOGIES LLC | COVERED ENTITY |
|---|---|
| 11046 Eaton CtFishers, Indiana 46038, USA | Legal Name: __________________________________DBA (if any): _________________________________ |
| Authorized Signature: __________________________ | Authorized Signature: __________________________ |
| Print Name: __________________________________ | Print Name: __________________________________ |
| Title: ________________________________________ | Title: ________________________________________ |
| Email: _______________________________________ | Email: _______________________________________ |
| Date: ________________________________________ | Date: ________________________________________ |
| BAA Version: _________________________________ | Covered Affiliates (if any): _____________________ |