Medical Copilot Business Associate Agreement

Version 1.0. Effective October 14, 2026.

Last updated: October 14, 2026

This Business Associate Agreement ("BAA") is between Optimize AI Tech ("Business Associate") and the healthcare organization that accepts the Medical Copilot Terms of Service ("Covered Entity"). It forms part of the Terms of Service and applies whenever Business Associate creates, receives, maintains, or transmits Protected Health Information on behalf of Covered Entity, including during demonstrations, pilots, and evaluations.

1. Definitions

Capitalized terms used but not defined in this BAA have the meanings given in the HIPAA Rules, including Breach, Data Aggregation, Designated Record Set, Disclosure, Individual, Minimum Necessary, Notice of Privacy Practices, Protected Health Information ("PHI"), Required by Law, Secretary, Security Incident, Subcontractor, Unsecured Protected Health Information, and Use. "HIPAA Rules" means the Privacy, Security, Breach Notification, and Enforcement Rules at 45 CFR Parts 160 and 164. "Services" means the Medical Copilot services described in the Terms of Service.

2. Obligations of Business Associate

Business Associate agrees to:

  1. Not use or disclose PHI other than as permitted or required by this BAA or as Required by Law.
  2. Use appropriate safeguards, and comply with Subpart C of 45 CFR Part 164 with respect to electronic PHI, to prevent use or disclosure of PHI other than as provided for by this BAA.
  3. Report to Covered Entity any use or disclosure of PHI not provided for by this BAA of which it becomes aware, including Breaches of Unsecured PHI as required by 45 CFR 164.410, and any Security Incident of which it becomes aware. Breach notifications will be made without unreasonable delay and within the time required by 45 CFR 164.410.
  4. In accordance with 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2), ensure that any Subcontractors that create, receive, maintain, or transmit PHI on behalf of Business Associate agree in writing to the same restrictions, conditions, and requirements that apply to Business Associate with respect to such information.
  5. Make available PHI in a Designated Record Set to Covered Entity as necessary to satisfy Covered Entity's obligations under 45 CFR 164.524.
  6. Make any amendment to PHI in a Designated Record Set as directed or agreed to by Covered Entity under 45 CFR 164.526, or take other measures as necessary to satisfy Covered Entity's obligations under 45 CFR 164.526.
  7. Maintain and make available the information required to provide an accounting of disclosures to Covered Entity as necessary to satisfy Covered Entity's obligations under 45 CFR 164.528.
  8. To the extent Business Associate carries out one or more of Covered Entity's obligations under Subpart E of 45 CFR Part 164, comply with the requirements of Subpart E that apply to Covered Entity in the performance of such obligations.
  9. Make its internal practices, books, and records available to the Secretary for purposes of determining compliance with the HIPAA Rules.

The parties agree that this section satisfies notice for unsuccessful Security Incidents, such as pings, port scans, denied log-in attempts, and similar events that do not result in unauthorized access, use, or disclosure of PHI. No further notice of such unsuccessful attempts is required.

3. Permitted Uses and Disclosures

  1. Business Associate may use or disclose PHI as necessary to perform the Services for Covered Entity.
  2. Business Associate may de-identify PHI in accordance with 45 CFR 164.514(a) through (c), solely to maintain security, measure performance, maintain reliability, evaluate accuracy, and troubleshoot the Services.
  3. Business Associate will not use PHI, or data de-identified from PHI, to train or fine-tune artificial intelligence models.
  4. Business Associate may use or disclose PHI as Required by Law.
  5. Business Associate agrees to make uses, disclosures, and requests for PHI consistent with Covered Entity's minimum necessary policies and procedures.
  6. Business Associate may not use or disclose PHI in a manner that would violate Subpart E of 45 CFR Part 164 if done by Covered Entity, except for the specific uses and disclosures in paragraphs 7 and 8 below.
  7. Business Associate may use PHI for the proper management and administration of Business Associate or to carry out its legal responsibilities.
  8. Business Associate may disclose PHI for the proper management and administration of Business Associate or to carry out its legal responsibilities, provided the disclosures are Required by Law, or Business Associate obtains reasonable assurances from the person to whom the information is disclosed that it will remain confidential, be used or further disclosed only as Required by Law or for the purposes for which it was disclosed, and that the person will notify Business Associate of any instances of which it is aware in which the confidentiality of the information has been breached.

4. Obligations of Covered Entity

Covered Entity shall:

  1. Notify Business Associate of any limitation in its Notice of Privacy Practices under 45 CFR 164.520, to the extent such limitation may affect Business Associate's use or disclosure of PHI.
  2. Notify Business Associate of any changes in, or revocation of, the permission by an Individual to use or disclose PHI, to the extent such changes may affect Business Associate's use or disclosure of PHI.
  3. Notify Business Associate of any restriction on the use or disclosure of PHI that Covered Entity has agreed to or is required to abide by under 45 CFR 164.522, to the extent such restriction may affect Business Associate's use or disclosure of PHI.
  4. Not request Business Associate to use or disclose PHI in any manner that would not be permissible under Subpart E of 45 CFR Part 164 if done by Covered Entity.

5. Term and Termination

  1. Term. This BAA takes effect when Covered Entity accepts the Terms of Service and continues until all PHI is returned or destroyed under this section.
  2. Termination for cause. If Business Associate violates a material term of this BAA, Covered Entity may terminate this BAA and the Services, provided Business Associate has not cured the violation within 30 days of written notice.
  3. Effect of termination. On termination, Business Associate shall return to Covered Entity or destroy all PHI it maintains in any form, including PHI held by its Subcontractors, and retain no copies. Where return or destruction is infeasible, Business Associate shall extend the protections of this BAA to that PHI and limit further uses and disclosures to the purposes that make return or destruction infeasible, for as long as it retains the PHI.
  4. Survival. The obligations of Business Associate under this section survive termination.

6. Miscellaneous

  1. Regulatory references. A reference in this BAA to a section of the HIPAA Rules means the section as in effect or as amended.
  2. Amendment. The parties agree to amend this BAA as necessary to comply with the HIPAA Rules. Business Associate may update this online BAA by posting a new version. The version accepted by Covered Entity applies until Covered Entity accepts an updated version, except where an update is Required by Law.
  3. Interpretation. Any ambiguity in this BAA shall be resolved to permit compliance with the HIPAA Rules.
  4. Order of precedence. For matters involving PHI, this BAA prevails over the Terms of Service to the extent of any conflict. A Business Associate Agreement signed by both parties prevails over this online BAA.
  5. Other terms. Limitation of liability, indemnification, governing law, and all other terms not addressed in this BAA are governed by the Terms of Service.
  6. No third-party beneficiaries. Nothing in this BAA confers any rights on any person other than the parties.
  7. Contact. Notices under this BAA go to privacy@medcopilot.co.