Business Associate Agreement

Last updated: 24 September 2026

This BAA is entered into between the Covered Entity named on the relevant insurance verification request form submitted and Aroa Biosurgery Incorporated (the “BA”) (each a “Party” and collectively the “Parties”) and takes effect on the date that the Covered Entity first accepts, or is otherwise bound by, this BAA.

The purpose of this BAA is to address the measures that the BA will take to protect the confidentiality of certain health information that Covered Entity may deliver to the BA or that the BA create, receive or maintain on behalf of the Covered Entity in the performance of the BA’s services.

The terms and provisions of this BAA will supersede any conflicting or inconsistent terms in any other agreement between the Parties.

This BAA may be updated by BA from time to time in accordance with Section 5(b) (Amendment) below. The version of this BAA in effect at the relevant time is the version published at aroa.com/ivr-baa at that time.

1. Definitions

Except as otherwise defined in this BAA, capitalized terms will have the definitions set forth in HIPAA:

  • “BAA” means this BAA and all riders, exhibits or other documents attached to it or incorporated into it by reference.
  • “Breach Notification Rule” means the Breach Notification for Unsecured Protected Health Information Final Rule.
  • “BA” or “Business Associate” will have the same meaning as the term “business associate” in 45 CFR § 160.103 of HIPAA.
  • “Covered Entity” will have the same meaning as the term “covered entity” in 45 CFR § 160.103 of HIPAA.
  • “Privacy Rule” means the Standards for Privacy of Individually Identifiable Health Information.
  • “PHI” or “Protected Health Information” will have the same meaning as the term “protected health information” in 45 CFR § 160.103 of HIPAA, provided that it is limited to such protected health information that is received by BA from, or created, received, maintained, or transmitted by BA on behalf of, the Covered Entity.
  • “Security Rule” means the Security Standards for the Protection of Electronic Protected Health Information.
  • “Services” means the insurance verification (and any related) services provided to Covered Entity by (or on behalf of) the BA.

2. Permitted Uses and Disclosures of PHI

  1. BA Services. Except as otherwise limited in this BAA, BA may Use and Disclose PHI for, or on behalf of, Covered Entity as specified in this BAA; provided that any such Use or Disclosure would not violate HIPAA if done by Covered Entity, unless expressly permitted under Section 2(b).
  2. Management, Administration, and Legal Responsibilities. Except as otherwise limited in this BAA, BA may Use and Disclose PHI for the proper management and administration of BA and/or to carry out the legal responsibilities of BA, provided that any Disclosure may occur only if:
    1. Required by Law; or
    2. BA obtains written reasonable assurances from the person to whom the PHI is Disclosed that it will be held confidentially and Used or further Disclosed only as Required by Law or for the purpose for which it was Disclosed to the person, and the person notifies BA of any instances of which it becomes aware in which the confidentiality of the PHI has been breached.

3. Responsibilities of the Parties with Respect to PHI

  1. BA’s Responsibilities. To the extent BA is acting as a Business Associate, BA agrees to the following:
    1. Limitations on Use and Disclosure. BA will not Use and/or Disclose the PHI other than as permitted or required by this BAA or as otherwise Required by Law; BA will not disclose, capture, maintain, scan, index, transmit, share or Use PHI for any activity not authorized under this BAA or any other agreement between the Parties. BA will not use PHI for any advertising, Marketing or other commercial purpose of BA or any third party. BA will not violate the HIPAA prohibition on the sale of PHI. BA will make reasonable efforts to Use, Disclose, and/or request the minimum necessary PHI to accomplish the intended purpose of such Use, Disclosure, or request.
    2. Safeguards. BA will: (1) use reasonable and appropriate safeguards to prevent inappropriate Use and Disclosure of PHI other than as provided for in this BAA; and (2) comply with the applicable requirements of 45 CFR Part 164 Subpart C of the Security Rule.
    3. Reporting. BA will report to Covered Entity: (1) any Use and/or Disclosure of PHI that is not permitted or required by this BAA or any other agreement between the Parties, of which BA becomes aware; (2) any Security Incident of which it becomes aware, provided that notice is hereby deemed given for Unsuccessful Security Incidents and no further notice of such Unsuccessful Security Incidents will be given; and/or (3) any Breach of Covered Entity’s Unsecured PHI that BA may discover (in accordance with 45 CFR § 164.410 of the Breach Notification Rule). Notification of a Breach will be made without unreasonable delay, but in no event more than thirty (30) calendar days after discovery of a Breach. Taking into account the level of risk reasonably likely to be presented by the Use, Disclosure, Security Incident, or Breach, the timing of other reporting will be made consistent with BA’s and Covered Entity’s legal obligations.For purposes of this Section 3(a)(iii), “Unsuccessful Security Incidents” mean, without limitation, pings and other broadcast attacks on BA’s firewall, port scans, unsuccessful log-on attempts, denial of service attacks, and any combination of the above, as long as no such incident results in unauthorized access, acquisition, Use, or Disclosure of PHI. Notification(s) under this Section 3(a)(iii), if any, will be delivered to contacts identified by Covered Entity pursuant to Section 3(b)(ii) (Contact Information for Notices) of this BAA by any means BA selects, including through e-mail. BA’s obligation to report under this Section 3(a)(iii) is not and will not be construed as an acknowledgement by BA of any fault or liability with respect to any Use, Disclosure, Security Incident, or Breach.
    4. Subcontractors. In accordance with 45 CFR §§ 164.502(e)(1)(ii) and 164.308(b)(2) of HIPAA, BA will require its Subcontractors who create, receive, maintain, or transmit PHI on behalf of BA to agree in writing to:
      1. the same or more stringent restrictions and conditions that apply to BA with respect to such PHI;
      2. appropriately safeguard the PHI; and
      3. comply with the applicable requirements of 45 CFR Part 164 Subpart C of the Security Rule.

      BA remains responsible for its subcontractors’ compliance with obligations in this BAA.

    5. Disclosure to the Secretary. BA will make available its internal practices, records, and books relating to the Use and/or Disclosure of PHI received from Covered Entity to the Secretary of the Department of Health and Human Services for purposes of determining Covered Entity’s compliance with HIPAA, subject to attorney-client and other applicable legal privileges. BA will respond to any such request from the Secretary.
    6. Access. If BA maintains PHI in a Designated Record Set for Covered Entity, then BA, at the request of Covered Entity, will within fifteen (15) days make access to such PHI available to Covered Entity in accordance with 45 CFR § 164.524 of the Privacy Rule.
    7. Amendment. If BA maintains PHI in a Designated Record Set for Covered Entity, then BA, at the request of Covered Entity, will make available such PHI to Covered Entity for amendment and incorporate any reasonably requested amendment in the PHI in accordance with 45 CFR § 164.526 of the Privacy Rule.
    8. Accounting of Disclosure. BA, at the request of Covered Entity, will within fifteen (15) days make available to Covered Entity such information relating to Disclosures made by BA as required for Covered Entity to make any requested accounting of Disclosures in accordance with 45 CFR § 164.528 of the Privacy Rule.
    9. Performance of a Covered Entity’s Obligations. To the extent BA is to carry out a Covered Entity obligation under the Privacy Rule, BA will comply with the requirements of the Privacy Rule that apply to Covered Entity in the performance of such obligation.
  2. Covered Entity Responsibilities.
    1. No Impermissible Requests. Covered Entity will not request BA to Use or Disclose PHI in any manner that would not be permissible under HIPAA if done by a Covered Entity (unless permitted by HIPAA for a Business Associate).
    2. Contact Information for Notices. Covered Entity hereby agrees that any reports, notification, or other notice by BA pursuant to this BAA may be made electronically using the Covered Entity’s BAA contact details set out on the most recent insurance verification request submitted by or behalf of the Covered Entity. If any of those details are no longer accurate or appropriate, the Covered Entity will provide replacement information to the BA by emailing contracts@aroa.com with a copy to reimbursement@aroa.com.
    3. Safeguards and Appropriate Use of PHI. Covered Entity is responsible for implementing appropriate privacy and security safeguards to protect its PHI in compliance with HIPAA. Without limitation, it is Covered Entity’s obligation to Implement privacy and security safeguards in the systems, applications, and software Covered Entity controls, configures, and uploads into the Services.

4. Term and Termination

  1. Term. This BAA will continue in effect until the earlier of (1) termination by a Party for breach as set forth in Section 4(b), below, or (2) the date that BA completed provision of the relevant Services to Covered Entity.
  2. Termination for Breach. Upon written notice, either Party immediately may terminate the BAA if the other Party is in material breach or default of any obligation in this BAA. Either party may provide the other a thirty (30) calendar day period to cure a material breach or default within such written notice.
  3. Return, Destruction, or Retention of PHI Upon Termination. Upon expiration or termination of this BAA, BA will return or destroy all PHI in its possession, if it is feasible to do so. If it is not feasible to return or destroy any portions of the PHI upon termination of this BAA, then BA will extend the protections of this BAA, without limitation, to such PHI and limit any further Use or Disclosure of the PHI to those purposes that make the return or destruction infeasible for the duration of the retention of the PHI.

5. Miscellaneous

  1. Interpretation. The Parties intend that this BAA be interpreted consistently with their intent to comply with HIPAA and other applicable federal and state law. All other terms and conditions of the BAA remain unchanged. Any captions or headings in this BAA are for the convenience of the Parties and will not affect the interpretation of this BAA.
  2. Amendment; Waiver. BA may modify or amend this BAA at any time by posting an updated version at Aroa.com/IVR BAA. BA will use reasonable efforts to provide advance notice of material changes, which may include notice via email to the contact details provided in accordance with Section 3(b)(ii) or a notice posted on BA’s website. Covered Entity’s continued use of any BA’s services following the effective date of any updated BAA constitutes acceptance of that updated BAA. If Covered Entity does not agree to an updated BAA, Covered Entity must cease use of the services and terminate the BAA in accordance with its terms. A waiver with respect to one event will not be construed as continuing, as a bar to, or as a waiver of any right or remedy as to subsequent events.
  3. No Third Party Beneficiaries. Nothing express or implied in this BAA is intended to confer, nor will anything in this BAA confer, upon any person other than the Parties, and the respective successors or assigns of the Parties, any rights, remedies, obligations, or liabilities whatsoever.
  4. Severability. In the event that any provision of this BAA is found to be invalid or unenforceable, the remainder of this BAA will not be affected thereby, but rather the remainder of this BAA will be enforced to the greatest extent permitted by law.
  5. No Agency Relationship. It is not intended that an agency relationship (as defined under the Federal common law of agency) be established hereby expressly or by implication between Covered Entity and BA under HIPAA or the Privacy Rule, Security Rule, or Breach Notification Rule. No terms or conditions contained in this BAA be construed to make or render BA an agent of Covered Entity.