This Business Associate Agreement governs the handling of Protected Health Information between your organization ("Covered Entity") and CriteriaIQ, LLC ("Business Associate") in connection with your use of CriteriaIQ RCM. Effective upon account creation.

Key Obligations of CriteriaIQ

• PHI used only as necessary to provide the platform and as required by law.
• Full HIPAA Security Rule compliance — administrative, physical, and technical safeguards.
• Breach notification within 30 days of Discovery per 45 CFR § 164.410.
• AI analysis processes PHI in-memory only — never stored in any AI model or training dataset.
• PHI access and amendment within 5 business days per 45 CFR §§ 164.524 and 164.526.
• Upon termination, all PHI returned or destroyed within 30 days with written confirmation.
• Covered Entity owns all PHI under this Agreement.

Key Obligations of Covered Entity

• Notify CriteriaIQ of any changes to individual PHI authorization or restrictions.
• Ensure authorized users comply with applicable HIPAA requirements.
• Not request uses or disclosures of PHI that would violate the Privacy Rule.

Indemnification liability capped at 6 months of fees paid. Neither party liable for consequential damages. Notices to CriteriaIQ: compliance@criteriaiq.com