HIPAA Compliance

BUSINESS
ASSOCIATE
AGREEMENT

Version 1.0 — Effective upon execution

1. Definitions

Terms used but not defined in this BAA have the meanings given to them in the HIPAA Rules (45 CFR Parts 160 and 164).

• “HIPAA Rules” means the Privacy, Security, Breach Notification, and Enforcement Rules at 45 CFR Parts 160 and 164.
• “PHI” means Protected Health Information as defined at 45 CFR §160.103, including Electronic PHI (“ePHI”).
• “Services” means the API infrastructure and processing services provided by RGX Systems under the Master Service Agreement.
• “Subcontractor” means an entity that creates, receives, maintains, or transmits PHI on behalf of a Business Associate.

2. Obligations of Business Associate (RGX Systems)

2.1 Permitted Uses and Disclosures

RGX Systems may use or disclose PHI only as follows:

• To perform the Services described in the Master Service Agreement on behalf of Covered Entity
• As required by law
• For RGX Systems’ proper management and administration, or to carry out its legal responsibilities, provided disclosures are required by law or RGX Systems obtains reasonable assurances of confidentiality
• To provide data aggregation services relating to the health care operations of Covered Entity, as permitted by 45 CFR §164.504(e)(2)(i)(B)

2.2 Prohibited Uses

RGX Systems shall not use or disclose PHI in any manner that would violate HIPAA Rules if done by Covered Entity. RGX Systems shall not:

• Use PHI for its own marketing or commercial purposes
• Sell PHI to third parties
• Use PHI to train machine learning models or improve its own products
• Disclose PHI to any third party except as permitted in this BAA or as required by law

2.3 Appropriate Safeguards

RGX Systems shall implement and maintain appropriate administrative, physical, and technical safeguards to protect the confidentiality, integrity, and availability of ePHI, including:

• In-memory PHI scrubbing prior to any LLM inference call — raw PHI is never transmitted to the LLM provider; the LLM receives only anonymized text containing {{REDACTED_PHI_N}} token placeholders
• Person names are tokenized separately as [NAME_N], independent of the PHI patterns above — applied whether RGX or Covered Entity's own model performs the inference. Name tokens are rehydrated back to the real name only in RGX-hosted responses, using a mapping held solely in process memory and purged within 30 minutes of inactivity; the mapping is never written to disk, logs, or the database, and is never rehydrated at all when Covered Entity runs its own model
• Zero persistence of raw text prompts to central logging servers — raw PHI is never written to database storage, log files, message queues, or any external service; only redaction metadata (pattern types, token counts — no PHI values) is logged to the compliance_redaction_events audit table
• Automated, programmatic PII/PHI interception at the data layer, applied to every /api/v1/process request matching the healthcare industry profile — no manual intervention required; scrubbing cannot be bypassed by API callers, including when Covered Entity routes inference to its own model via passthrough: true
• TLS 1.3 encryption for all data in transit
• AES-256-GCM encryption for sensitive configuration data at rest
• Workspace Security Token hashing (SHA-256) — plaintext tokens are never stored
• Infrastructure hosted on Render, which operates under a signed HIPAA BAA with RGX Systems
• Access to production systems restricted to authorised personnel only
• Annual security review and vulnerability assessment

2.4 Reporting of Security Incidents and Breaches

RGX Systems shall:

• Report to Covered Entity any use or disclosure of PHI not provided for by this BAA within 72 hours of becoming aware of such use or disclosure
• Report to Covered Entity any Security Incident (as defined by 45 CFR §164.304) of which RGX Systems becomes aware, without unreasonable delay and in no case later than 60 calendar days following discovery
• Provide sufficient information to enable Covered Entity to fulfill its breach notification obligations under 45 CFR §§164.400–414
• Cooperate with Covered Entity in investigating any incident and in notifying affected individuals

2.5 Subcontractors

RGX Systems shall require any subcontractor that creates, receives, maintains, or transmits PHI on its behalf to agree, in writing, to the same restrictions, conditions, and requirements that apply to RGX Systems under this BAA.

Current infrastructure subcontractors with executed HIPAA BAAs:

• Render Services, Inc. — Cloud infrastructure and PostgreSQL database hosting
• Anthropic, PBC — LLM provider (receives only scrubbed, de-identified text — no raw PHI, no raw patient or client names)

2.6 Individual Rights

To the extent RGX Systems holds PHI in a Designated Record Set, RGX Systems shall make PHI available to Covered Entity as necessary for Covered Entity to fulfill individuals’ rights to access (45 CFR §164.524), amendment (45 CFR §164.526), and accounting of disclosures (45 CFR §164.528). Given that RGX Systems processes PHI in-memory without persistent storage of raw PHI, no Designated Record Set is maintained by RGX Systems in the ordinary course of operations.

2.7 Minimum Necessary

RGX Systems shall use, disclose, and request only the minimum amount of PHI necessary to accomplish the purpose of each use, disclosure, or request.

2.8 Return or Destruction of PHI

Upon termination of the Master Service Agreement, RGX Systems shall, within 30 days of written request:

• Return to Covered Entity or destroy all PHI received from or created on behalf of Covered Entity that RGX Systems still maintains
• If return or destruction is not feasible, extend the protections of this BAA to retained PHI and limit further use or disclosure to the purposes that make return or destruction infeasible
• Certify in writing that all PHI has been returned or destroyed

Note: Given that RGX Systems does not persist raw PHI in the ordinary course of operations, termination data return obligations primarily apply to usage metadata logs, which are purged within 30 days upon written request.

3. Obligations of Covered Entity

3.1 Notice of Privacy Practices

Covered Entity shall notify RGX Systems of any limitation in its notice of privacy practices that affects RGX Systems’ permitted uses or disclosures of PHI.

3.2 Individual Permissions

Covered Entity shall notify RGX Systems of any changes in, or revocation of, permission from an individual regarding use or disclosure of PHI, to the extent such changes affect RGX Systems’ permitted uses or disclosures.

3.3 Restriction Agreements

Covered Entity shall notify RGX Systems of any restriction agreed to with individuals under 45 CFR §164.522 that restricts a use or disclosure otherwise permitted under this BAA.

3.4 Lawful Requests Only

Covered Entity shall not request RGX Systems to use or disclose PHI in any manner that would not be permissible under the HIPAA Rules if done by Covered Entity.

3.5 Minimum Necessary

Covered Entity shall ensure that PHI transmitted to RGX Systems is limited to the minimum necessary to accomplish the intended purpose of each request.

4. Term and Termination

4.1 Term

This BAA shall be effective upon execution and shall remain in effect until the termination of the Master Service Agreement, unless earlier terminated as provided herein.

4.2 Termination for Cause

Either party may terminate this BAA and the underlying Master Service Agreement upon 30 days’ written notice if the other party materially breaches any provision of this BAA and fails to cure such breach within the notice period. Covered Entity may terminate immediately if RGX Systems violates any material term and cure is not possible.

4.3 Effect of Termination

Upon termination, the provisions of Section 2.8 (Return or Destruction of PHI) shall apply. Sections 1, 4, 5, and 6 shall survive termination of this BAA.

5. Miscellaneous

5.1 Regulatory References

Any reference in this BAA to a section of the HIPAA Rules shall mean the section as in effect or amended at the time of the relevant use or disclosure, including any successor provision.

5.2 Entire Agreement

This BAA, together with the Master Service Agreement, constitutes the entire agreement between the parties with respect to PHI and supersedes all prior agreements relating to the same subject matter. In the event of a conflict between this BAA and the Master Service Agreement with respect to PHI, this BAA shall control.

5.3 Amendment

This BAA may be amended only by a written instrument signed by both parties. RGX Systems may amend this BAA unilaterally to the extent necessary to comply with changes in applicable law, with 30 days’ notice to Covered Entity.

5.4 No Third-Party Beneficiaries

This BAA is made for the exclusive benefit of the parties. Nothing herein is intended to, or shall, create any rights in any third party.

5.5 Governing Law

This BAA shall be governed by federal law to the extent applicable. To the extent state law applies, this BAA shall be governed by the laws of the State of Delaware, without regard to conflict of law principles.

5.6 Indemnification

Each party shall indemnify and hold the other harmless from and against any claims, damages, penalties, or costs arising from its breach of this BAA or violation of the HIPAA Rules, to the extent caused by such party’s acts or omissions.

6. Execution