Business Associate Agreement

Version 1.0 (November 5, 2026)

This Business Associate Agreement ("Agreement") is between ______________________________ (the company signing in NEMT Pilot) ("Customer") and Creative Lab 1, 201 W Ash Ave, Burbank, CA 91502, USA ("Business Associate"), which provides the NEMT Pilot service (the "Service"). It takes effect on the date Customer signs it (the "Effective Date").

1. Why this Agreement exists

Customer uses the Service to plan and manage non-emergency medical transportation. To do that, Business Associate creates, receives, keeps or sends Protected Health Information for Customer. HIPAA requires a written agreement setting out how Business Associate protects that information. This Agreement is that agreement.

Customer may itself be a Covered Entity, or a business associate of a Covered Entity (for example, a transportation provider working for a health plan or a transportation broker). If Customer is a business associate, this Agreement is a subcontractor business associate agreement, and Business Associate will meet the same restrictions and conditions that apply to Customer for that information.

2. Definitions

Words with capital letters that are not defined here (such as Breach, Covered Entity, Data Aggregation, Designated Record Set, Health Care Operations, Individual, Minimum Necessary, Required By Law, Secretary, Security Incident, Subcontractor and Unsecured Protected Health Information) have the meanings given in the HIPAA Rules.

3. What Business Associate agrees to do

Business Associate will:

  1. Not use or disclose PHI other than as allowed by this Agreement or as Required By Law.
  2. Use appropriate administrative, physical and technical safeguards, and comply with Subpart C of 45 CFR Part 164 (the Security Rule) for electronic PHI, to prevent use or disclosure of PHI other than as this Agreement allows. This includes encrypting PHI while it is stored and while it is sent over networks.
  3. Report to Customer any use or disclosure of PHI not allowed by this Agreement, including any Breach of Unsecured PHI as required by 45 CFR 164.410, and any Security Incident it becomes aware of. Reports will be made without unreasonable delay and no later than ten (10) business days after discovery. A Breach report will include, as far as it is known, the Individuals affected and the other information Customer needs to give notices under 45 CFR 164.404. Customer agrees that this paragraph is notice, with no further report required, of attempted but unsuccessful Security Incidents that happen routinely, such as pings, port scans, blocked sign-in attempts and denial-of-service attempts, as long as none of them results in unauthorized access to, or use or disclosure of, PHI.
  4. Under 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2), make sure any Subcontractor that creates, receives, maintains or transmits PHI for Business Associate agrees in writing to the same restrictions, conditions and requirements that apply to Business Associate. For example, Business Associate hosts the Service with Amazon Web Services under Amazon's business associate addendum.
  5. Within fifteen (15) days of Customer's request, make PHI in a Designated Record Set available to Customer so Customer can meet its obligations under 45 CFR 164.524 (an Individual's right of access).
  6. Within fifteen (15) days of Customer's request, make amendments to PHI in a Designated Record Set that Customer directs or agrees to under 45 CFR 164.526.
  7. Keep, and within fifteen (15) days of Customer's request give Customer, the information needed for Customer to provide an accounting of disclosures under 45 CFR 164.528.
  8. To the extent Business Associate carries out any of Customer's obligations under Subpart E of 45 CFR Part 164 (the Privacy Rule), comply with the requirements of Subpart E that apply to Customer in carrying them out.
  9. Make its internal practices, books and records about PHI available to the Secretary so the Secretary can determine compliance with the HIPAA Rules.
  10. Pass on to Customer, within five (5) business days, any request it receives directly from an Individual about access, amendment or an accounting, and not answer it except as Customer directs.

4. How Business Associate may use and disclose PHI

  1. Business Associate may use and disclose PHI only as needed to provide the Service to Customer under the NEMT Pilot terms of service and Customer's instructions. This includes reading Customer's trips and runs from its MediRoutes account, suggesting assignments, calculating driver pay, keeping driver records, and support.
  2. Business Associate will use, disclose and request only the Minimum Necessary PHI for the purpose, following Customer's Minimum Necessary policies where Customer has told it about them.
  3. Business Associate will not use or disclose PHI in any way that would break Subpart E of 45 CFR Part 164 if Customer did it, except for the purposes in paragraphs (d) to (f) below.
  4. Business Associate may use PHI for its own proper management and administration, or to carry out its legal responsibilities.
  5. Business Associate may disclose PHI for its proper management and administration, or to carry out its legal responsibilities, if the disclosure is Required By Law, or if Business Associate gets reasonable written assurances from the person receiving it that (1) the information will be kept confidential and used or further disclosed only as Required By Law or for the purpose it was disclosed for, and (2) the person will tell Business Associate about any case it knows of in which the confidentiality of the information has been breached.
  6. Business Associate may provide Data Aggregation services relating to Customer's Health Care Operations, if Customer asks for them.
  7. Business Associate may report violations of law to the appropriate federal and state authorities, consistent with 45 CFR 164.502(j)(1).
  8. Business Associate will not sell PHI, and will not use or disclose PHI for marketing or advertising.

5. What Customer agrees to do

  1. Tell Business Associate about any limitation in Customer's notice of privacy practices (45 CFR 164.520), any change in or revocation of an Individual's permission to use or disclose PHI, and any restriction Customer has agreed to under 45 CFR 164.522, to the extent it may affect Business Associate's use or disclosure of PHI.
  2. Not ask Business Associate to use or disclose PHI in any way that would not be allowed under Subpart E of 45 CFR Part 164 if Customer did it, except as allowed in section 4(d) to (f).
  3. Give Business Associate only the PHI needed to provide the Service, and keep Customer's own sign-ins to the Service secure.

6. Term and ending this Agreement

  1. Term. This Agreement starts on the Effective Date and lasts as long as Customer uses the Service, or until it is ended under this section.
  2. Ending for a breach. If either party learns that the other has materially breached this Agreement, it will give written notice and thirty (30) days to fix the breach. If the breach is not fixed within that time, the party that gave notice may end this Agreement and Customer's use of the Service.
  3. What happens to PHI at the end. When this Agreement ends, Business Associate will, within sixty (60) days, return to Customer (as an export of Customer's data) or destroy all PHI it keeps for Customer, as Customer chooses, and will keep no copies, including in Subcontractors' hands. Backups will be destroyed on their normal schedule. If returning or destroying some PHI is not feasible, Business Associate will tell Customer why, will keep protecting that PHI under this Agreement, and will limit further use and disclosure to the purposes that make return or destruction infeasible, for as long as it keeps it.
  4. Survival. Section 6(c) and any other obligations that by their nature continue survive the end of this Agreement.

7. General terms

  1. Law references. A reference to a section of the HIPAA Rules means that section as in effect or as amended.
  2. Changes in the law. The parties will amend this Agreement as needed for either of them to comply with changes to the HIPAA Rules. Business Associate may publish an updated version for Customer to sign in the Service.
  3. Interpretation. Any unclear wording will be read so that it permits compliance with the HIPAA Rules.
  4. Order of priority. If this Agreement conflicts with the NEMT Pilot terms of service or any other agreement between the parties about PHI, this Agreement controls.
  5. No third-party rights. Nothing in this Agreement gives any right or remedy to anyone other than Customer and Business Associate.
  6. Notices. Notices under this Agreement are given by email: to Customer at the email address of the person who signed this Agreement (or another owner on Customer's account), and to Business Associate at 1saif.ayoob@gmail.com.
  7. Governing law. This Agreement is governed by federal law and, where state law applies, by the laws of the State of California.
  8. Electronic signature. The parties agree to sign this Agreement electronically. Customer signs by entering the name and title of its authorized representative and confirming its agreement in the Service. Business Associate signs by offering this Agreement in the Service, and it is bound when Customer signs. Each party may keep and print a copy.

Customers sign this agreement in NEMT Pilot under Settings, after creating their company account.