Last Updated: September 21, 2026
This Business Associate Agreement (“BAA”) is entered into by and between RadOverlay, LLC (“Service Provider”) and the person or entity entering into the Agreement with Service Provider (“Customer”). Service Provider and Customer are, collectively, the “Parties” and each, individually, a “Party.”
Whereas, Customer is retaining Service Provider to provide certain services to Customer (“Services”) pursuant to RadOverlay’s Terms of Service or another services agreement between the Parties (in either case, the “Agreement”).
Whereas, if and to the extent Service Provider Processes Protected Health Information (“PHI”), provided or disclosed by Customer, for or on behalf of the Customer, then the terms of this BAA will apply to the Services that Service Provider provides to Customer. This BAA is intended to ensure that Service Provider will establish and implement appropriate safeguards for PHI that Service Provider may receive, create, maintain, use, or disclose in connection with the Services that Service Provider provides to Customer pursuant to the Agreement.
Now, therefore, for good and valuable consideration, which Service Provider and Customer acknowledge is sufficient to induce them to enter into this BAA, Service Provider and Customer acknowledge and agree as follows:
1.1 “Breach of PHI” with respect to PHI within the possession, custody, or control of Service Provider, refers to a successful Security Incident or a Breach of Unsecured PHI, as those terms are defined under HIPAA.
1.2 “De-Identify” means to Process information so that: (a) if the information is PHI, it meets the de-identification standards set forth in 45 C.F.R. § 164.514(a) and (b); and (b) otherwise, it cannot reasonably be used, alone or in combination with other reasonably available information, to identify an individual.
1.3 “De-Identified Data” means information that has been De-Identified.
1.4 “HIPAA” means the Health Insurance Portability and Accountability Act of 1996, including the Health Information Technology for Economic and Clinical Health Act of 2009 (“HITECH Act”) and the rules and regulations promulgated thereunder, as amended.
1.5 “HIPAA Terms” means capitalized terms used in this BAA that are not defined herein and that have the meanings ascribed to them in HIPAA, including, but not limited to, the following: Breach; Designated Record Set; Disclosure; Notice of Privacy Practices; Required by Law; Security Incident; and Unsecured PHI.
1.6 “Protected Health Information” or “PHI” has the definition given to it under HIPAA, and for the purposes of this BAA is limited to PHI that Service Provider receives from Customer or Processes for or on behalf of Customer.
1.7 “Process” means any operation performed on or with PHI, including, but not limited to, the following: creation; collection; receipt; recording; storage; organization; management; adaptation; alteration; transformation; access; retrieval; consultation; use; analysis; disclosure; transmission; transportation; making available; making accessible; aggregation; combination; de-identification; restriction; deletion; destruction; and erasure.
1.8 “HIPAA Rules” mean the privacy, security, breach notification, and enforcement rules at 45 C.F.R. Part 160 and Part 164, as amended.
1.9 “Sub-Processor” means any subcontractor, as defined under HIPAA, that Processes PHI by, for, or on behalf of Service Provider arising out of or related to Service Provider’s performance of its obligations under the Agreement.
Customer is a Covered Entity, a Business Associate, or a Business Associate’s Service Provider under HIPAA. Service Provider is a Business Associate under HIPAA.
Unless otherwise agreed between the Parties, Service Provider is permitted to Process PHI: (i) in connection with performing its obligations and exercising its rights under the Agreement; (ii) as permitted or required by the Agreement or this BAA; or (iii) as Required by Law.
To the extent that Service Provider Processes PHI to provide the Services, Service Provider shall use reasonable efforts to limit PHI to the minimum necessary in order to provide the Services to Customer.
If and to the extent PHI is uploaded to the Services, Service Provider will either: (i) make reasonable efforts to detect such PHI and delete it within 60 days of its detection; or (ii) De-Identify such PHI. The limited retention of PHI serves to enable diagnostic, debugging, and support operations while minimizing accumulation of PHI over time.
Service Provider will not Process PHI in a manner that would violate HIPAA or this BAA. In addition, Service Provider will not use PHI to train artificial intelligence models.
Service Provider may Process PHI for its proper management and administration and to carry out its legal responsibilities, provided that any disclosure of PHI for such purposes may only occur if: (i) Required by Law; or (ii) Service Provider obtains written reasonable assurances from the person or entity to whom PHI will be disclosed that it will be held in confidence, used only for the purpose for which it was disclosed, and that Service Provider will be notified of any Breach of PHI.
Service Provider shall mitigate, to the extent practicable, any harmful effect known to Service Provider of a use or disclosure of PHI by Service Provider in violation of this BAA.
Customer represents and warrants that: (i) any PHI provided or disclosed by Customer to Service Provider as part of the Services is either owned by Customer or Customer otherwise has legal authorization to provide such PHI to Service Provider; and (ii) Service Provider’s authorized Processing of such PHI will not violate the Agreement, this BAA, or HIPAA.
Customer will notify Service Provider, to the extent it may affect Service Provider’s Processing of PHI, of: (i) any limitation under 45 C.F.R. § 164.520 in the Notice of Privacy Practices of Customer or of any Covered Entity on whose behalf Customer provides PHI; (ii) any change in, or revocation of, permission by an individual to use or disclose PHI; and (iii) any restriction on the Processing of PHI that Customer, or any Covered Entity or Business Associate on whose behalf Customer provides PHI, has agreed to or is required to abide by under 45 C.F.R. § 164.522. Customer will provide notice before submitting affected PHI and promptly after learning of any relevant change. If a limitation or restriction would materially impair Service Provider’s ability to perform under the Agreement or this BAA, the Parties will agree on any necessary modification of Service Provider’s obligations.
Customer will not request that Service Provider Process PHI in any manner that would not be permissible under HIPAA if done by Customer (if Customer is a Covered Entity) or by the Covered Entity to which Customer is a Business Associate (unless expressly permitted under HIPAA for a Business Associate).
Customer shall take reasonable steps to mitigate, to the extent practicable, any harmful effects known to Customer of a breach of this BAA by Customer.
Each Party represents and warrants that its employees, agents, representatives, and workforce members whose services may be used to fulfill its obligations under this BAA are or will be appropriately informed of the confidential nature of PHI, have received appropriate training on their responsibilities concerning such information, and are contractually required to maintain the confidentiality of such PHI.
Service Provider will implement and maintain reasonable physical, technological, and administrative controls designed to safeguard the confidentiality, integrity, and availability of PHI to comply with applicable HIPAA Rules.
When Service Provider engages a Sub-Processor, Service Provider shall ensure that any Sub-Processor that Processes PHI on its behalf enters into a written agreement requiring the Sub-Processor to comply with the same restrictions, conditions, and requirements that apply to Service Provider under this BAA with respect to PHI, including this BAA’s prohibition on using PHI to train artificial intelligence models. Service Provider shall only retain Sub-Processors that are capable of appropriately protecting the privacy, confidentiality, and security of PHI.
Service Provider shall provide to Customer reasonable information pertaining to Sub-Processors reasonably requested by Customer, including information demonstrating the physical, technological, and administrative controls implemented by Sub-Processors to safeguard the confidentiality, integrity, and availability of PHI, subject to applicable confidentiality obligations and third-party restrictions. Service Provider shall remain liable to Customer for acts or omissions of any Sub-Processor that violate the Agreement or the BAA.
Service Provider will document disclosures of PHI by Service Provider and provide an accounting of such disclosures to Customer as and to the extent required of a Business Associate under HIPAA and in accordance with the requirements applicable to a Business Associate under HIPAA.
Service Provider will make its internal practices, books, and records relating to the use and disclosure of PHI received from Customer, or created or received by Service Provider on behalf of Customer, available to the Secretary of the U.S. Department of Health and Human Services for purposes of determining compliance with the HIPAA Rules.
To the extent Service Provider maintains PHI in a Designated Record Set, Service Provider agrees to make such PHI available to the Customer as necessary to satisfy Customer’s obligations under 45 C.F.R. § 164.524. Service Provider agrees to make any amendments to such PHI as directed or agreed to by the Customer pursuant to 45 C.F.R. § 164.526, or to take other measures as necessary to satisfy Customer’s obligations under 45 C.F.R. § 164.526.
To the extent Service Provider is to carry out any of Customer’s obligations under Subpart E of 45 C.F.R. Part 164, Service Provider will comply with the requirements of Subpart E that apply to Customer in the performance of those obligations.
Service Provider will notify Customer of a Breach of PHI or any Processing of PHI not authorized by this BAA or the Agreement without unreasonable delay, and in no event later than five (5) days after Service Provider discovers that such breach occurred. At the time of such initial notification and continuing thereafter, Service Provider will disclose to Customer non-privileged information that Service Provider has or receives concerning such breach, including, but not limited to, the following: (i) names and other information available about individuals affected by the breach; (ii) the nature and scope of information compromised or potentially compromised in the breach or as a result of the breach; (iii) timing, manner, and cause of the breach; and (iv) acts taken in response to the breach.
Service Provider will provide Customer with assistance and cooperation reasonably requested by Customer related to such breach, and shall follow and comply with reasonable requests made by Customer related to such breach.
Notwithstanding the foregoing, Customer and Service Provider acknowledge the ongoing existence and occurrence of attempted but unsuccessful security incidents involving trivial and routine incidents, such as port scans, attempts to log-in with an invalid password or user name, denial of service attacks that do not result in a server being taken off-line, malware, and pings, or other similar types of events that do not compromise the security or privacy of PHI (“Unsuccessful Security Incidents”). This Section constitutes notice to Customer of such Unsuccessful Security Incidents, and no further notice of them is required.
Each Party is responsible for liability arising from a Breach of PHI to the extent caused by that Party or its workforce, agents, or subcontractors, including, for Service Provider, its Sub-Processors. All liability arising under or relating to this BAA is subject to the limitations of liability in the Agreement.
This BAA becomes effective on the effective date of the Agreement and will terminate simultaneously and automatically with the termination of the Agreement. In the event of termination of the Agreement, the Parties’ obligations under this BAA will continue until Service Provider has destroyed all PHI. Once Service Provider has done so, the Parties’ obligations under this BAA will terminate. Accrued rights and liabilities, and provisions that by their nature should survive, survive termination or expiration.
Either Party may immediately terminate this BAA, or the Agreement, if the other Party materially breaches a term of this BAA and fails to cure such material breach within 30 days after written notice from the non-breaching Party about such breach. Without limiting the foregoing, the termination provisions set forth in the Agreement shall apply equally to this BAA.
If this BAA is terminated for any reason, Customer shall immediately stop using the Services and shall not transmit or disclose any PHI to Service Provider. Within 60 days after termination or expiration, Service Provider will securely destroy all PHI that it or its Sub-Processors maintain in any form, retain no copies, and upon Customer’s written request certify destruction. If destruction is infeasible, Service Provider will extend the protections of this BAA to the retained PHI, limit further uses and disclosures to the purposes that make destruction infeasible, and destroy the PHI when feasible.
This BAA may be amended only as permitted by the Agreement.
Nothing expressed or implied in this BAA is intended to confer, nor anything herein shall confer, upon any person other than the Parties any rights, remedies, obligations, or liabilities whatsoever.