Legal

Business Associate Agreement

HIPAA requires a written agreement between your practice and any company that handles patient information for it. This is ours. It is part of the Service and you accepted it with the Terms of Service, so there is nothing extra for you to sign and nothing to request.

Last updated: September 14, 2026

1. What this agreement is, and how you accepted it

This Business Associate Agreement is part of your agreement with Practice Evolved, Inc. and takes effect on the first of these to happen: you accept the Terms of Service, you enter a setup code, or you connect a practice management system to the Service. It is a written contract for the purposes of 45 CFR 164.502(e) and 164.504(e). There is nothing further for you to sign and nothing for you to request. Clause 21 of the Terms makes your electronic acceptance your signature. Where you accepted on our website or in the dashboard, we record the date, the time, the account, the person, and the version of the document you accepted, and we can produce that record. This agreement applies from the moment we could receive protected health information from you, not from the moment we first do, and it applies whether or not you use every part of the Service. If your practice needs a countersigned paper copy for its own records, email support@practiceevolved.com and we will provide one; the protections below apply either way and do not wait for it.

2. The words used here

Protected health information, electronic protected health information, covered entity, business associate, subcontractor, breach, security incident, designated record set, individual, required by law, and unsecured protected health information have the meanings given to them in 45 CFR Parts 160 and 164, as amended, which this agreement calls HIPAA. In this agreement, you and your practice mean the covered entity that accepted it, we and us mean Practice Evolved, Inc. acting as your business associate, the Service means what the Terms of Service describe, and your patient information means protected health information that we create, receive, maintain, or transmit for you. Three further words are used in clause 5 and clause 6 and are defined here, because the whole of what our software may write turns on them. A practice record write means an instruction our software sends to your practice management system that causes it to create or change a record; reading is not a practice record write, and recording something in our own system is not a practice record write. A posting means our reading of a payer's answer to one of your claims: what the payer paid, under what payment reference, on what date, against which claim, and the adjustment amounts the payer itself stated; a posting is a reading of a document, not a decision about what you are owed. De-identified information means information that no longer identifies an individual and about which there is no reasonable basis to believe it can be used to identify an individual, determined under 45 CFR 164.514(b) either by removing the identifiers that section lists or by a documented determination by a qualified expert. Where a term is defined both here and in the Terms, the definition here governs for protected health information.

3. What we may use your patient information for

We may use and disclose your patient information only to provide and support the Service for your own practice as the Terms describe, to carry out our own proper management and administration, to carry out our legal responsibilities, and where the law requires it. Providing and supporting the Service includes reading your practice management system, computing the postings clause 2 defines, presenting them to you, and, where you have turned it on, making the practice record writes clause 5 permits. We may disclose your patient information for our own management and administration only where the law requires the disclosure, or where we first obtain written assurances from the person receiving it that they will keep it confidential, use or further disclose it only as required by law or for the purpose we gave it to them, and tell us of any breach of its confidentiality. Apart from the uses for our own management and administration and to carry out our legal responsibilities that this clause permits, which 45 CFR 164.504(e)(4) expressly allows a business associate, any use or disclosure we make would be permitted under HIPAA if your practice made it. We may also create and use de-identified information as clause 18 describes. Nothing in this agreement asks you to permit a use we could not lawfully make.

4. What we will not do with it

We will not use or disclose your patient information other than as this agreement permits or the law requires. We will not sell it, and creating de-identified information under clause 18 is not a sale of it. We will not use it for marketing, for fundraising, or for advertising, ours or anyone else's. We will not use your patient information to train a general purpose model, and we do not permit a vendor we use to train on your patient information. We will not combine your patient information with another practice's patient information in a way that lets anyone see one practice's patients in another practice's dashboard, and every record we hold about a patient is scoped to the practice it came from. We will not disclose your patient information to another practice or to a competitor of yours. Clause 18 says what we may do with information after it has been de-identified, and that clause is the only qualification on this one.

5. Only what is needed, and what our software writes into your practice software

When we use, disclose, or request your patient information, we limit it to the minimum necessary for the purpose, as 45 CFR 164.502(b) and 164.514(d) require. In practice this shapes the product and not only the paperwork. 5.1 Reading. Our software reads your practice management system read only. Every database query it sends passes through one piece of code that checks it before it is sent, and anything that is not a read is refused. One statement is sent per call, so a write cannot be hidden behind a read. Where we read through your system's own programming interface instead of its database, that reading path is fixed so that it can only ever fetch, and it refuses any other kind of request before it makes one. 5.2 What a practice record write is, and the rule that governs all of them. Separately from reading, our software can make a practice record write. A practice record write is an instruction our software sends to your practice management system to create, update, or annotate a record in it, on your behalf and at your direction, through the Service. You authorize us to make practice record writes of the kinds the Service makes available to you, which include an insurance payment and a patient payment, a claim's status, an account or chart note, a document or an attachment, insurance and benefit information, and such other records as the Service makes available. Every one of them is subject to three things, and each of them binds us. First, your own controls inside the Service: nothing is written for your practice unless your practice is entitled to that kind of write, the go-ahead your practice has chosen has been given, the daily limit that applies has not been reached, and no off switch is on. Second, a complete record with a read back: every write is recorded before it is made, it carries a mark in your system that identifies it as ours, and what was written is read back and checked afterwards. Third, the minimum necessary standard in the first sentence of this clause: we write only what the task genuinely needs, and never more of your patient information than that. This clause no longer names a closed list of permitted writes, and that is a deliberate change from the previous version. A list of that kind goes out of date the moment the Service can do something useful the list does not mention, and while it was out of date your team finished by hand the work you had asked us to do for you. What limits a practice record write now is your own control over it and the record we keep of it, not a sentence we have to rewrite. We will never treat this clause as permission to write something you have not switched on, and clause 6 says what has to be true before anything is written at all. A practice record write is made by a separate, narrowly scoped part of our software, which holds a fixed list of the exact things it is allowed to ask your system to do. That list is checked in code, and anything outside it is refused before any request leaves the computer in your office. The reading path cannot make one. Where we write to a database directly rather than through your system's own interface, the write is made on a separate connection of its own. 5.3 A note. Where your practice has it turned on, and only for a practice management system we support for this purpose, which today means Open Dental, a note your team writes in the dashboard can be posted back into the patient record so your practice software stays the single record of what happened. Every note that reaches your record was typed by a person at your practice. Some go there because that person chose to send them, and some because they were written as a comment on a claim, and a comment on a claim is filed to the record as a matter of course. So treat anything your team types into a claim comment as something that becomes part of that patient's record, including a remark meant only for a colleague. This is on by default on Open Dental and you can turn it off at any time by telling us, and we will not turn it back on. 5.4 An insurance payment a payer has stated. Where a payer has answered one of your claims, and only where you have asked us to turn this on, our software can enter that answer into your practice management system against the claim it belongs to. What it enters is what the payer said and nothing else: the amount the payer paid, the payment or check reference it paid under, the date it paid, the claim and the service lines it paid against, and the adjustment amounts the payer itself stated on that answer, which are the contractual adjustment, the deductible, the coinsurance, the copay, the non covered amount and the denied amount. We enter what a payer stated. We do not decide what you are owed, we do not choose an amount, and we do not write a figure we calculated ourselves. It is off for every practice until that practice asks for it, we will tell you when it becomes available for the system you run, and there is no setting anywhere in the Service that turns it on for a practice that did not ask. 5.5 What your own software then does, and what we may finish ourselves. A practice management system recalculates when a payment is entered, exactly as it would if a member of your team had keyed the same payment by hand. A claim balance moves. An account balance moves. Those movements are your software's arithmetic following from the entry in clause 5.4. Where your software leaves a step for a person to finish, and the Service offers to finish it for you, we may make that change ourselves, subject in full to clause 5.2 and clause 6. The clearest example is a claim's status. On some systems a paid claim stays marked as sent until somebody opens it and saves it as received, so where you have turned this on we can mark that one claim received after its own payment has landed and been read back, and we do it only for a claim we entered a payment on. The previous version of this agreement said a claim status was never a separate instruction from us. It is one now, where you have asked for it, and we would rather change the sentence than leave your team finishing our entries by hand. What protects you is the same thing that protects every other write: your own switches, your own go-ahead, a limit, an off switch, a record of every write, and a read back afterwards. 5.6 What we still will not do. Our software writes only the kinds of record the Service offers and your practice has turned on. It does not go looking for other records to change. It does not delete anything. It does not change an entry a person at your practice made, except where you have asked the Service to finish that entry and the change is the one you asked for. It does not write a figure we calculated and present it as a payer's or a patient's own: every amount we enter is one a payer stated, one a document your office gave us stated, or one a person at your practice typed. It does not split a payment across service lines by a division of our own working out. On a practice management system we do not support for a given write, our software refuses that write outright rather than merely hiding the button. Where a kind of write exists for your system but your practice has not turned it on, or has not accepted the current version of this agreement, our software refuses it and says so plainly rather than writing anything. 5.7 Identifiers. We hold identifiers only where a task genuinely needs them, and our software reports counts rather than values when it records what it read. 5.8 Acting with a payer or a clearinghouse on your behalf, which is a different thing. Clauses 5.2 to 5.6 are about your own practice management system. This one is about somebody else's, and we separate them because the risks are not the same: an entry in your own software can be corrected by you, and a claim in front of a payer cannot be unsent. Where you have turned it on, our software can sign into your own clearinghouse or payer portal, using credentials your practice gave us, and read what is there. That is a read, and it is what the Service uses to tell you what a payer has said about your claims. Where you have separately turned that on, our software can also file one of your claims with a payer, through your own clearinghouse account, from a computer in your own office. Filing a claim is irreversible. It creates a permanent record in a payer's system, it discloses your patient's information to that payer, and it can earn a duplicate denial that ages the original claim. So it is off for every practice until that practice asks for it, it is a separate decision from every other permission in this agreement, and the controls in clause 6 apply to it in full. A disclosure we make to a payer in filing your claim is a disclosure your practice could lawfully make itself for payment purposes, and clause 3 is what permits it. Your clearinghouse and portal credentials are held on your own computer, in your own office, and are used only to sign into your own account. We do not sign into an account that is not yours. Where a claim of yours is filed with a payer, it is filed through your own clearinghouse account and not through one of ours. We will never require you to change where your payers deliver your remittances in order to use the Service.

6. What has to be true before we write anything

Clause 5 says what may be written. This clause says what has to be true first. Each of these is a control we build and run rather than a policy we recite, and you can ask us to show you any of them under clause 19. 6.1 You turn it on. Every practice record write clause 5 permits, other than the note in clause 5.3, and every claim filing in clause 5.8, is off for your practice until you ask for it. Each kind is its own decision: turning one on never turns another on. There is no default that turns one on, and no setting anywhere in the Service that turns one on for a practice that did not ask. 6.2 A person decides, or you decide the rule. A note under clause 5.3 is composed by a person at your practice and sent by that person. A payment under clause 5.4 is entered in one of two ways and you choose which. Either every payment waits for a person at your practice to approve it, which is where every practice starts. Or, where you have told us to, a payment is entered without waiting for a person when it clears the tests you agreed with us, and never otherwise. Those tests always include all of the following, and we will not remove one at your request: the payer's own arithmetic on the answer reconciles to the cent; the payer's answer is matched to exactly one of your claims and not to two; and the answer is one the payer itself settles, rather than a denial, a takeback or a reversal. Any of those goes to a person however confident we are. We do not read confidence as permission. Where an answer looks like money we may already have entered, it goes to a person too. 6.3 A hold you can cancel. An approved payment does not leave our system immediately. It waits for a hold period, and during that period anyone at your practice can cancel it and nothing is written. 6.4 Once, and only once. Every payment we write carries a key made from your practice, the payer's payment reference, the payer's own claim number, the payer's own verdict on that claim, and the claim it is being written against. That key is unique in our system, so the same payment cannot be written twice, and a retry after a lost answer writes nothing. Where the practice management system we are writing to has no way of its own to make a write repeat safe, our software reads before it writes and stops if what it was going to write is already there. 6.5 A mark on everything we wrote. We do not make a practice record write that cannot be identified as ours afterwards. Every record our software writes into your practice management system carries a mark that identifies it as ours and ties it to the entry in our own records that produced it, so you can find everything we ever wrote, and so can we. 6.6 A record of every write. We keep an entry for every practice record write we make and for every one we attempt: what was written, against which claim, from which payer answer where there is one, on whose approval, at what time, what the result was, and whether we read it back afterwards and found it. For a note, that entry is written on the computer in your own office that made the write, and it is added to and never rewritten. For a payment, it is kept in our own system, where a correction is a new entry and a reversal is a new entry rather than a change to an old one. We will give you a copy of what we hold for your practice on request. 6.7 A small blast radius. Our software writes a small, fixed number of payments in any one pass, so a systemic misreading affects a handful of entries and not your whole book. We stop and hold everything when a write fails in a way that suggests the problem is not with that one payment. 6.8 An off switch that is ours to hold and yours to pull. You can turn any write off at any time by telling us, in writing or through your support contact, and we will do it and it stays off until you ask for it back. For the payment and the claim filing described in clauses 5.4 and 5.8 we also hold a switch that stops them across every practice at once, which we use if we ever have reason to doubt the Service is reading a payer correctly; a note under clause 5.3 is switched off for your practice, on the computer in your own office that makes the write, because that is where that setting lives. Turning a write off never turns off the reading, the dashboard, or anything else you rely on. 6.9 Your book is yours. Your practice management system is your system of record, not ours. Nothing in clause 5 or this clause makes us your bookkeeper, your billing service, or the person responsible for whether your ledger is right. You remain responsible for reviewing what is entered against your own records, and clause 13 says more about that.

7. How we protect it

We use appropriate administrative, physical, and technical safeguards to prevent any use or disclosure of your patient information that this agreement does not permit, and we comply with Subpart C of 45 CFR Part 164, the Security Rule, with respect to electronic protected health information, as 45 CFR 164.314(a) and 164.504(e)(2)(ii)(B) require. Your patient information is encrypted in transit whenever it leaves your practice's own network, and in our systems it is encrypted at rest, with the database encrypted using a key we manage. Access is restricted to the people who need it to run the Service, and every record we hold about a patient is scoped to your practice. Two things about the software that runs on your own computer are worth stating plainly rather than leaving to be discovered. It reads your practice management system over your own network, on the machine and the network you control, using what the connection your system offers provides; that traffic never leaves your premises and it is protected by your own security rather than by ours. And it keeps working files there so it does not have to read the same records again every time, on that same machine, again inside your own network; those files hold nothing your practice management system on that same machine does not already hold. We do not write patient identifiers or note text into our application logs, our email, or our audit trails. Where the Service displays your information to your staff, it does so inside your own authenticated dashboard. Where a member of our staff signs into your dashboard to support you, that sign in is restricted to our own senior staff, requires a second authentication step, and is recorded in an audit entry written before access is granted; clause 10 of the Terms applies to it and this agreement governs anything seen during it.

8. The people and companies we use

We may use subcontractors to help provide the Service. Where a subcontractor creates, receives, maintains, or transmits your patient information on our behalf, we will first enter into a written agreement with it that imposes the same restrictions and conditions that this agreement imposes on us, as 45 CFR 164.502(e)(1)(ii) and 164.308(b) require, and we remain responsible to you for what it does with that information. We will not route your patient information through a vendor that will not sign a business associate agreement. Our infrastructure runs on Amazon Web Services under an executed business associate agreement with Amazon, using services Amazon designates as HIPAA eligible. If you ask us in writing, we will tell you which subcontractors currently handle your patient information, and we will keep that list current. We may change a subcontractor. Where we add one that will handle your patient information, we will tell you before it starts, and if you object on reasonable grounds related to its handling of patient information we will discuss it with you; if we cannot resolve it, your remedy is to stop using the affected part of the Service or to terminate under clause 14.

9. Telling you when something goes wrong

We will report to you any use or disclosure of your patient information that this agreement does not permit, any security incident affecting it, and any breach of unsecured protected health information, as 45 CFR 164.504(e)(2)(ii)(C) and 164.410 require. Breach notification works in two steps, because a single deadline forces a choice between telling you early and telling you accurately, and you need both. First, we will give you an initial notice without unreasonable delay and in any event no later than ten business days after we discover a breach of unsecured protected health information. Discovery has the meaning HIPAA gives it in 45 CFR 164.410(a)(2): the first day on which the breach is known to us, or by exercising reasonable diligence would have been known to us. That initial notice will tell you what we know at the time, including what happened, when, what information we believe was involved, and what we are doing. Second, we will give you the rest as we learn it, and in any event no later than thirty calendar days after the initial notice, or sooner where the deadline your practice is working to requires it. That will identify each individual whose information we believe was involved and will give you the other information HIPAA requires you to include in your own notice, to the extent we have it or can obtain it. We will keep you updated as we learn more rather than waiting until we know everything. Both of those deadlines sit inside the outer limit HIPAA sets, which is sixty calendar days from discovery, and they are meant to leave your practice time to meet its own notification duties. Nothing in this clause is an attempt to change what HIPAA requires of us, and where this clause and 45 CFR 164.410 differ, 164.410 governs. Attempted and unsuccessful security incidents that do not result in unauthorized access, use, disclosure, modification, or destruction, such as scans, pings, port probes, blocked traffic, and failed log in attempts, are reported to you by this sentence and we will not send a separate notice for each one.

10. A patient's own rights

Your practice, not us, holds the designated record set for your patients, and we hold a copy of part of it in order to run the Service. To the extent we hold your patient information in a designated record set, we will make it available to you so that you can meet your obligations under 45 CFR 164.524 when a patient asks for access, we will make it available for amendment and will incorporate any amendment you direct so that you can meet 45 CFR 164.526, and we will make available the information you need to give a patient an accounting of disclosures under 45 CFR 164.528. We will do each of those within ten business days of your written request, or sooner where the deadline you are working to requires it, and we will tell you promptly if we cannot. If a patient comes to us directly with one of these requests we will not answer it ourselves; we will forward it to you and tell the patient we have done so.

11. Where we carry out your obligations

To the extent we agree to carry out one of your obligations under Subpart E of 45 CFR Part 164, the Privacy Rule, we will comply with the requirements of Subpart E that apply to you when you carry out that obligation, as 45 CFR 164.504(e)(2)(ii)(H) requires. We do not otherwise take on your obligations, and nothing in this agreement or in the Terms makes us responsible for your practice's own compliance.

12. Making our records available to the government

We will make our internal practices, books, and records relating to the use and disclosure of your patient information available to the Secretary of the United States Department of Health and Human Services for the purpose of determining your practice's compliance with HIPAA, as 45 CFR 164.504(e)(2)(ii)(I) requires. We will tell you when we do, unless the law prevents us from telling you.

13. What your practice is responsible for

You will tell us of any limitation in your notice of privacy practices, of any change in or revocation of a patient's permission to use or disclose their information, and of any restriction on use or disclosure that you have agreed to under 45 CFR 164.522, in each case to the extent it affects what we may do. You will not ask us to use or disclose your patient information in a way that would not be permitted under HIPAA if your practice did it itself. You are responsible for the lawfulness of the data you connect or make available to us, for having the authority to connect it, and for your own obligations as a covered entity, including your notice of privacy practices, your workforce training, your patients' requests about their own records, and the security of your own systems, equipment, and accounts. Where you have turned on a practice record write under clause 5, you are also responsible for the following, and we are not. You are responsible for deciding that entering payments automatically is appropriate for your practice, and for telling us to stop if it stops being appropriate. You are responsible for reviewing what is entered against your own records, on your own schedule, in the way you would review the work of a member of your team. You are responsible for your own books, your own reconciliation, your own reporting to your accountant and to any payer, and for anything you file or certify on the strength of them. You are responsible for keeping the backups clause 12 of the Terms describes, and for knowing that a restore works, before you turn a write on. Your practice management system remains your system of record. We enter what a payer stated; we do not tell you what you are owed and we do not audit your ledger.

14. How long it lasts, and ending it

This agreement starts when clause 1 says it starts and continues until all of your patient information has been returned or destroyed under clause 15, or, for information we cannot feasibly return or destroy, for as long as we hold it. If either of us materially breaches this agreement, the other may give written notice describing the breach, and if it is not cured within thirty days the party who gave the notice may terminate this agreement and your use of the Service. Where a cure is not possible, either of us may terminate immediately. Nothing in that mechanic limits your right as the covered entity to terminate this agreement and your use of the Service immediately if you determine that we have violated a material term of it. That is the right 45 CFR 164.504(e)(2)(iii) requires this agreement to give you, you do not have to wait out a cure period to exercise it, and no other clause of this agreement or of the Terms cuts it down. Every clause of this agreement continues to apply to any of your patient information we still hold after termination, for as long as we hold it, as clause 15 provides; clauses 2, 4, 5, 6, 7, 9, 10, 12, 15, 16, 17, 18, 19, 20, and this clause survive in any event.

15. What happens to your information at the end

When this agreement ends, we will return or destroy all of your patient information that we still hold, including any held by a subcontractor, and keep no copies, as far as it is feasible to do so. We will do that within thirty days of the end of your use of the Service, or within thirty days of a later written request from you, whichever is later. A written request while you are still using the Service does not end it. Two parts of this are not immediately feasible and we would rather say so than write a promise we cannot keep. Encrypted backups are written on a rolling schedule and expire on their own cycle, so a copy of your patient information can remain in a backup for a period after the live data is deleted. For as long as any such copy exists, this agreement continues to apply to it, we will not use or disclose it for any purpose other than the one that makes returning or destroying it infeasible, and we will destroy it when the backup expires. If you ask, we will tell you the current backup retention period in writing. And where our software has made a practice record write for you, we keep the record of that write described in clause 6.6, because it is the evidence of what was done to your book and destroying it would leave neither of us able to answer a question about it later. That record holds identifiers, dates, dollars and claim references; we will hold it under this agreement for as long as we hold it, use it for no other purpose, and destroy it at your written request once no dispute about those entries is open. De-identified information created under clause 18 is not your patient information, is not returned or destroyed under this clause, and this clause does not apply to it.

16. How liability works for this agreement

Clause 17 of the Terms of Service caps our total liability at the greater of the fees you paid us in the twelve months before the claim or one hundred United States dollars. This clause says how that cap works for this agreement, and it does two things: it keeps a real remedy for the things that matter most, and it puts a number on what had previously been open ended. The general cap in clause 17 of the Terms does not apply to a claim arising from our breach of clause 4, clause 5, or clause 7 of this agreement, or from our own negligence or willful misconduct in handling your patient information. For those claims our total aggregate liability will not exceed the greater of two times the fees you paid us in the twelve months before the event that gave rise to the first claim, or fifty thousand United States dollars. Separately from that limit, where a breach of unsecured protected health information is caused by our act or omission, we will bear the reasonable and documented cost of the notification your practice is required to make because of it, including notifying the affected individuals, notifying the Secretary and the media where HIPAA requires it, and the credit monitoring you reasonably offer. Our total liability for those notification costs will not exceed two hundred and fifty thousand United States dollars. No limit in this clause applies to our fraud or our willful misconduct, or to any liability that applicable law does not allow to be limited. No limit in this clause and no limit in the Terms limits, reduces, or has any effect on our own direct liability to the Secretary or to any other regulator under HIPAA, which is not ours to contract about. The indemnity you give us in clause 18 of the Terms does not extend to a claim arising from our breach of this agreement, our negligence, or our willful misconduct, and we say so here so that neither of us has to argue about it later. We carry insurance appropriate to this Service and will confirm our current coverage in writing on request.

17. Who pays for a dispute

Clause 24 of the Terms of Service says who pays the cost of a dispute between us, and it applies to a dispute about this agreement. It is mutual: the party that prevails is entitled to recover its reasonable attorneys' fees, expert fees, and costs from the other. It does not apply to your exercise of the termination right in clause 14 of this agreement, which you may exercise at no cost to you, and it does not apply to a claim you bring that arises from our breach of clause 4, clause 5, or clause 7 of this agreement. No clause of the Terms changes either of those.

18. De-identified and aggregated information

We may create de-identified information from your patient information. De-identification is done to the standard in 45 CFR 164.514(b), either by removing the identifiers that section lists or by a documented determination by a person with appropriate knowledge and experience that the risk of identification is very small. Once information has been de-identified to that standard it is no longer protected health information, as 45 CFR 164.502(d)(2) says, and this agreement does not restrict it. We may use and disclose de-identified information for any lawful purpose, including operating and improving the Service, building, training, testing and evaluating the models and rules the Service uses, producing benchmarks and industry research, and describing our business to others. Five limits apply to what we do with it, and they are limits we are prepared to be held to. We will not attempt to re-identify de-identified information, and we will not give it to anyone who has not agreed in writing not to attempt it. We will not identify your practice by name in anything we publish without your written consent. We will not publish a figure drawn from so few practices that yours could be worked out from it. We will not sell your patient information, and de-identifying information is not a sale of it. Where the Service shows you a benchmark drawn from other practices' de-identified data, it will say so on the screen.

19. Checking that we do what we say

You may ask us once in any twelve month period to confirm that we are meeting this agreement. We will answer with our current third party security report where we hold one, our completed responses to a standard security questionnaire, and a written description of the controls in clause 6 and how they are evidenced. Where that is not enough for your own compliance obligations, we will discuss what else you need. Where you require an on site or hands on audit, it happens on thirty days written notice, no more than once in any twelve month period, during business hours, at your cost, by an auditor who is not a competitor of ours and who has signed a confidentiality agreement with us, and in a way that does not give access to another customer's data or to systems shared between customers. Nothing in this clause limits or delays anything in clause 12. An audit under this clause is not a condition of anything in clause 9.

20. Disputes

The dispute provisions in clause 22 and clause 25 of the Terms of Service apply to this agreement, including the governing law, the place a dispute is brought, the waiver of a jury trial, the waiver of class and representative claims, and the agreement to arbitrate. Nothing in those provisions limits your right to terminate under clause 14 of this agreement, prevents either of us from asking a court for an order to stop an ongoing unauthorized use or disclosure of patient information, or affects anything in clause 12.

21. How this agreement fits with the others

This agreement controls over the Terms of Service and the End User License Agreement as to protected health information, and those documents govern everything else. Nothing in this agreement creates a right for any third party, and no patient or other person is a third party beneficiary of it. Any ambiguity in this agreement is resolved in favor of the meaning that complies with HIPAA. If HIPAA changes in a way that requires a change here, we will amend this agreement to comply, we will publish the amended version with a new version identifier and a new last updated date, and we will tell you before it takes effect; if you do not accept an amendment that the law requires, either of us may terminate under clause 14. Where a change to this agreement materially reduces the protections it gives your patient information, or materially widens what our software may write into your practice management system, we will ask you to accept it before it applies to you rather than treat your continued use as acceptance. A reference to a section of HIPAA includes any successor to that section.

If your practice needs a countersigned copy

Some practices keep a signed paper copy of every business associate agreement in their compliance file. Email support@practiceevolved.com and we will send one. The protections above already apply either way and do not wait for it.