Version 2026-10-22.

This agreement is between Clinihealth LLC, a Georgia limited liability company ("Business Associate", "we") and the practice ("Covered Entity", "you"). It follows the sample business associate provisions published by the U.S. Department of Health and Human Services (HHS), in plain words, and adds the uses that Practice KPIs and our services need. Your own counsel may wish to compare it with the current HHS sample.

Why every practice gets one. Practice KPIs runs on your own PC and keeps your patient data there. The app alone does not send us protected health information (PHI). But some of what we do for you can bring us close to PHI: helping on a shared screen, reading a diagnostics file, receiving something you send by mistake, reviewing a practice summary you choose to share, and AI features you choose to turn on. This agreement covers all of them, so you and we are covered from the first day.

How it starts. You accept this agreement when you sign up: by typing your full name and title and ticking "I agree to the Business associate agreement for [your practice], and I am authorized to sign it for the practice." We record who accepted, when, and this version, and email you a copy. You may also accept it by email to [email protected], or by signing a copy we send. Your acceptance is an electronic signature, and it binds the practice. It covers the practice named in the sentence you tick, and uses the version shown at the top on the day you accept. Each practice you add later signs its own.

1. Definitions

Words in capitals not defined here have the meaning given in the HIPAA Rules (45 CFR Parts 160 and 164).

Business Associate means Clinihealth LLC.
Covered Entity means the practice that accepts this agreement.
HIPAA Rules means the Privacy, Security, Breach Notification and Enforcement Rules at 45 CFR Part 160 and Part 164.
PHI means protected health information, including electronic PHI, that the Business Associate creates, receives, maintains or transmits for the Covered Entity.
Practice summary means a file of totals that Practice KPIs builds on your PC and that you choose to share with us: for example charges, payments, denials, visits and money owed, by day or month, provider, insurer, code, drug and location. It has no patient names, birth dates, addresses, phone numbers, account, claim or record numbers. Because a small daily count could in rare cases point to a person, we treat it as PHI under this agreement.
AI feature means a part of Practice KPIs, or of our services, that sends a question or data to an artificial intelligence model run by a Subcontractor, and that you have turned on.
Subcontractor means a company that creates, receives, maintains or transmits PHI for us, such as our email provider or an AI provider.
De-identified means de-identified as 45 CFR 164.514(a) to (c) requires.
Secretary means the Secretary of the U.S. Department of Health and Human Services.

2. What the Business Associate may do with PHI

The Business Associate may use and disclose PHI only for the purposes below, as the HIPAA Rules allow, and only the minimum PHI needed for each.

Setup and support. To see PHI while helping you at your request, for example on a screen share or a remote session, during setup or support. We keep no copy unless item 2 or 3 applies.
Diagnostics. To receive a diagnostics file, report file, screenshot or similar that you choose to send us, and use it only to find and fix the problem you asked about. We delete it within 30 days after the problem is closed.
PHI sent without our asking. If you or anyone working for you sends us PHI we did not ask for (for example a screenshot, a report file, or a patient's name in an email), we may receive it and keep it only as long as we need to answer you, use it only to answer you, and then delete it within 30 days. Receiving it this way is a use this agreement permits.
Practice summary and reviews. If you choose to share a practice summary, to receive it, keep it, and analyze it to review your practice with you, diagnose problems, answer your questions, and give you reports, comparisons and advice that you ask for.
AI features. If you turn on an AI feature, to send only what that feature needs (for example your question and the totals it is about) to an AI provider that has signed a business associate agreement with us. Our own staff may use AI tools on your PHI to provide the services in this agreement only where the tool's provider has signed a business associate agreement with us; with any other AI tool we use only de-identified data. You can turn an AI feature off at any time.
Combining with other practices' data. To combine your PHI with PHI from other covered entities we serve, to give data analyses that relate to the health care operations of those covered entities (45 CFR 164.504(e)(2)(i)(B)), for example how your denial rate compares with similar practices. Results shared with anyone other than you are de-identified and never name your practice.
De-identifying. To de-identify PHI, and to use and disclose de-identified data for any lawful purpose, including comparisons across practices, research and improving Practice KPIs. We will not try to re-identify anyone, and we will not name your practice outside Clinihealth without your written permission.
Running our business and the law. To use PHI for our own proper management and administration and to meet our legal duties. We may disclose it for those purposes only if the law requires it, or if we get reasonable assurance from the person receiving it that it will be kept confidential, used or disclosed further only as the law requires or for the purpose it was given, and that the person will tell us about any breach of confidentiality.
What we never do. We never sell PHI, never use it for marketing, and never use it, or let a Subcontractor use it, to train artificial intelligence models. We do not use or disclose PHI in a way that would break the Privacy Rule if you did it, except as items 6 to 8 allow.

3. What the Business Associate agrees to do

Limits on use. Not to use or disclose PHI except as this agreement permits or the law requires.
Safeguards. To use appropriate safeguards, and to comply with the Security Rule (45 CFR Part 164, Subpart C) for electronic PHI, to prevent any use or disclosure not allowed by this agreement.
Reporting. To report to you, without unreasonable delay and in any case within 10 business days of finding out: any use or disclosure not allowed by this agreement; any security incident; and any breach of unsecured PHI as the Breach Notification Rule requires (45 CFR 164.410). Attempts that do not succeed, such as pings, port scans, blocked sign-in tries and blocked attacks, happen all the time on any system on the internet; this sentence is our notice of them, and we report no further about them unless they lead to access to PHI.
Subcontractors. To make sure any Subcontractor agrees in writing to the same restrictions and conditions (45 CFR 164.502(e)(1)(ii) and 164.308(b)(2)). We keep a list of our Subcontractors that handle PHI on our website, and update it before a new one starts.
Access. To make PHI it holds in a designated record set available to you, or to the individual as you direct, so you can meet 45 CFR 164.524. (We do not expect to hold a designated record set.)
Amendments. To make PHI available for amendment, and to make amendments as you direct, so you can meet 45 CFR 164.526.
Accounting of disclosures. To keep and make available the information you need to give an accounting of disclosures under 45 CFR 164.528.
Your duties. If we carry out any of your Privacy Rule duties, to follow the Privacy Rule requirements that apply to you for that duty.
Government access. To make our internal practices, books and records about PHI available to the Secretary so the Secretary can check your compliance.

4. What the Covered Entity agrees to do

To tell us about any limit in your Notice of Privacy Practices that could affect our use or disclosure of PHI.
To tell us about any change in, or withdrawal of, an individual's permission to use or disclose PHI, if it could affect us.
To tell us about any restriction on the use or disclosure of PHI that you have agreed to or must follow under 45 CFR 164.522, if it could affect us.
Not to ask us to use or disclose PHI in any way that the Privacy Rule would not allow if you did it yourself, except as items 2.6 to 2.8 allow.
To send us PHI only when we need it to help you, and only through the ways we name (a screen share, the app's own buttons, or our support email). You are responsible for the security of PHI until it reaches our systems, for example an email sent from your system.
To keep the PCs that run Practice KPIs secure, as the terms of use say (Windows sign-in, disk encryption and backups).

5. How long this lasts, and how it ends

Term. This agreement lasts as long as you have an account for Practice KPIs or use our services, and ends when all PHI we hold for you has been returned or destroyed, or, if that is not possible, when protections are extended as item 5.4 says.
Ending for cause. If one side learns that the other has broken a material term of this agreement, it may give written notice. If the breach is not fixed within 30 days of the notice, the side that gave notice may end this agreement. If fixing the breach is not possible, it may end the agreement at once.
Return or destruction. When this agreement ends, we will, within 30 days, return or destroy all PHI we still hold for you, including practice summaries, and keep no copies. De-identified data is not PHI and may be kept.
If return or destruction is not feasible. We will tell you why, keep the protections of this agreement for that PHI, and limit any further use or disclosure to the reason that makes return or destruction not feasible.

6. General

Rule references. A reference to a section of the HIPAA Rules means that section as changed from time to time.
Changing this agreement. We may update this agreement, for example to keep it in line with the HIPAA Rules or to cover a new feature. We will email you at least 30 days before a new version takes effect; if you do not agree, you may end it and your account before then. A change the law requires takes effect when the law requires.
Which way to read it. If anything here is unclear, it should be read in the way that lets both sides comply with the HIPAA Rules.
Limits. The limits of liability in the terms of use apply to this agreement, to the extent the law allows.
Survival. Items 3.3, 5.3, 5.4 and 6.4 continue after this agreement ends.
No third parties. This agreement gives rights only to you and to us.
Relationship to the terms of use. This agreement sits beside the Practice KPIs terms of use. If the two conflict about PHI, this agreement wins.
Law. This agreement is governed by the HIPAA Rules and, where they are silent, by the laws of the State of Georgia, as the terms of use say.