HIPAA Business Associate Agreement

Effective October 30, 2026 · version 2026-10-30

Parties and purpose

This Business Associate Agreement ("BAA") is between the pharmacy that enrolls in Pharma OS (the "Covered Entity") and Joshi Ventures, Inc. d/b/a Pharma OS (the "Business Associate"). It takes effect when the Covered Entity accepts it at enrollment and applies to all protected health information ("PHI") the Business Associate creates, receives, maintains or transmits for the Covered Entity through Pharma OS. Terms used here have the meanings given in the HIPAA Rules (45 CFR Parts 160 and 164).

1. Permitted uses and disclosures

• The Business Associate may use and disclose PHI only to provide the Pharma OS services described in the Terms of Service, as required by law, and as permitted by this BAA.
• It may use PHI for its proper management and administration and to carry out its legal responsibilities, and may disclose PHI for those purposes if required by law or if it obtains reasonable assurances that the recipient will keep it confidential and report any breach of confidentiality.
• It will use, disclose and request only the minimum necessary PHI, and will not sell PHI or use it for marketing.
• It may de-identify PHI in accordance with 45 CFR 164.514.

2. Safeguards

The Business Associate will use appropriate administrative, physical and technical safeguards and comply with Subpart C of 45 CFR Part 164 (the Security Rule) for electronic PHI, including encryption in transit and at rest, access controls, audit logging and workforce training.

3. Reporting

The Business Associate will report to the Covered Entity, without unreasonable delay and no later than 10 business days after discovery: any use or disclosure of PHI not allowed by this BAA, any security incident affecting the Covered Entity's PHI, and any breach of unsecured PHI, with the information required by 45 CFR 164.410 as it becomes available. Unsuccessful attempts that do not lead to unauthorized access (such as blocked log-in attempts and network scans) are hereby reported and need no further notice. The Covered Entity is responsible for notifying individuals, HHS and the media, unless the parties agree in writing that the Business Associate will do so; the Business Associate will cooperate and, where the breach was caused by it, reimburse the reasonable cost of required notifications.

4. Subcontractors

The Business Associate will make sure any subcontractor that creates, receives, maintains or transmits PHI on its behalf agrees in writing to the same restrictions and conditions, as required by 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2).

5. Individuals' rights

Within 15 business days of a request from the Covered Entity, the Business Associate will make PHI in a designated record set available for access (45 CFR 164.524) and amendment (164.526), and provide the information needed for an accounting of disclosures (164.528). Requests the Business Associate receives directly from individuals will be forwarded to the Covered Entity.

6. Covered Entity's obligations carried out by the Business Associate

To the extent the Business Associate carries out an obligation of the Covered Entity under Subpart E of 45 CFR Part 164, it will comply with the requirements that apply to the Covered Entity in performing that obligation.

7. Books and records

The Business Associate will make its internal practices, books and records relating to PHI available to the Secretary of HHS to determine compliance with the HIPAA Rules.

8. Covered Entity's responsibilities

The Covered Entity will tell the Business Associate about any limitation in its notice of privacy practices, any change in or revocation of an individual's permission, and any restriction it has agreed to, to the extent it affects the Business Associate's use or disclosure of PHI; will not ask the Business Associate to use or disclose PHI in a way that would not be allowed for the Covered Entity; and will upload PHI only into features designed for it.

9. Term and termination

• This BAA lasts as long as the Business Associate holds PHI for the Covered Entity.
• If either party learns that the other has materially breached this BAA, it will give written notice and a reasonable opportunity (at least 30 days) to cure. If the breach is not cured, the non-breaching party may terminate the BAA and the Pharma OS agreement.
• When the agreement ends, the Business Associate will return or destroy all PHI (the Covered Entity may export its data before then). Where return or destruction is not feasible (for example, PHI in immutable security audit logs or in backups until they expire), the protections of this BAA continue for as long as the PHI is kept, and further uses are limited to the purposes that make return or destruction infeasible.

10. Other terms

• This BAA is interpreted to permit compliance with the HIPAA Rules and will be amended as needed to keep up with changes in the law. It controls over the Terms of Service where they conflict about PHI.
• Nothing in this BAA creates rights for anyone other than the parties.
• New York law governs this BAA except where federal law applies.

Contact for privacy and security matters

Joshi Ventures, Inc. (Pharma OS), support@pharmaos.health