Business Associate Agreement

This Business Associate Agreement is entered into by the clinic, practice, facility, health plan, clearinghouse, or other covered entity or business associate that accepts it through Tickmark, and NOMOI Technologies. The accepting organization is referred to as Covered Entity. NOMOI Technologies is referred to as Business Associate.

The person accepting this agreement represents that they are authorized to bind the Covered Entity to this Business Associate Agreement.

Covered Entity uses Tickmark to upload superbills, tick sheets, CMS 1500 forms, and related medical billing documents. Business Associate processes those documents to extract structured billing rows, including codes, units, modifiers, diagnosis information when selected, pricing fields when selected, and related operational metadata.

This agreement applies only to protected health information received, created, maintained, or transmitted by Business Associate for Tickmark services.

Business Associate may use and disclose protected health information only to provide Tickmark services, operate and secure the service, troubleshoot extraction failures, prevent abuse, comply with law, and perform responsibilities allowed by HIPAA and this agreement.

Business Associate may use aggregated or deidentified information that does not identify patients and does not identify Covered Entity, provided the information meets HIPAA deidentification requirements or otherwise contains no protected health information.

Business Associate will not sell protected health information. Business Associate will not use protected health information for advertising. Business Associate will not use uploaded documents or extracted patient information to train models.

Business Associate will not use or disclose protected health information in a manner that would violate HIPAA if done by Covered Entity, except as expressly permitted for Business Associate management, administration, legal responsibilities, and data aggregation allowed by HIPAA.

Business Associate will use reasonable administrative, physical, and technical safeguards to protect protected health information. Business Associate will use reasonable safeguards to prevent uses or disclosures not permitted by this agreement.

Single-file, stream, and batch extraction process uploaded source files transiently and do not retain them as customer document storage after extraction. Folder mode retains account-scoped extracted rows for resumable processing and may retain uploaded source QA samples in a private BAA-covered corpus. Covered Entity should not use folder mode when transient-only source processing is required.

Business Associate may use subcontractors that create, receive, maintain, or transmit protected health information for Tickmark services only if the subcontractor agrees to restrictions and safeguards that are at least as protective as those in this agreement.

Tickmark processing runs on Google Cloud infrastructure. NOMOI maintains its own Business Associate Agreement with Google for Google Cloud as a subcontractor.

Business Associate will notify Covered Entity without unreasonable delay after discovering a breach of unsecured protected health information. The notice will include information reasonably available to Business Associate that Covered Entity needs to assess notification duties under HIPAA.

Business Associate will cooperate with Covered Entity in investigation, mitigation, and required notifications related to such breach.

Business Associate will report to Covered Entity any use or disclosure of protected health information not permitted by this agreement of which Business Associate becomes aware.

Business Associate will mitigate, to the extent practicable, harmful effects known to Business Associate from a use or disclosure not permitted by this agreement.

To the extent Business Associate maintains protected health information in a designated record set for Covered Entity, Business Associate will make such information available as required for access, amendment, and accounting requests under HIPAA.

Covered Entity remains responsible for receiving, validating, and responding to individual requests unless the parties agree otherwise in writing.

At termination of Tickmark services, Business Associate will return or delete protected health information that it maintains for Covered Entity where feasible and where not prohibited by law.

If return or deletion is not feasible, Business Associate will continue to protect the information and limit further uses and disclosures to the purpose that makes return or deletion infeasible.

Covered Entity remains responsible for its own HIPAA obligations, including obtaining required permissions, limiting uploads to the minimum necessary information, managing user access, maintaining notices of privacy practices, honoring individual rights, and reviewing billing output before submission.

Covered Entity will not request Business Associate to use or disclose protected health information in a way that would violate HIPAA if done by Covered Entity.

This agreement begins when an authorized representative accepts it in Tickmark. It remains in effect while Business Associate creates, receives, maintains, or transmits protected health information for Covered Entity through Tickmark.

Either party may terminate this agreement for material breach if the breach is not cured within a reasonable period after written notice.

This self serve Business Associate Agreement is intended to make lawful onboarding available without a sales call. It is not legal advice. Covered Entity should have counsel review this agreement before relying on it.