HIPAA Business Associate Agreement

This Business Associate Agreement ("Agreement") is entered into as of the effective date stated on the executed copy, by and between the Covered Entity identified in that copy ("Covered Entity") and Sora LLC ("Business Associate"). RCM Genius and PPO Genius are brands owned and operated by Sora LLC.

1. Purpose

This Agreement ensures compliance with the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), its implementing regulations, and the Health Information Technology for Economic and Clinical Health ("HITECH") Act by protecting the confidentiality, integrity, and security of Protected Health Information ("PHI").

2. Definitions

• Business Associate: Sora LLC, the operator of the brands RCM Genius and PPO Genius.
• Covered Entity: the healthcare provider, health plan, or other HIPAA-defined entity entering into this Agreement with Sora LLC.
• Protected Health Information (PHI): individually identifiable health information created, transmitted, or maintained on behalf of the Covered Entity.

3. Obligations of Business Associate

3.1 Permitted uses and disclosures of PHI

Business Associate will handle PHI exclusively for the following healthcare-related revenue cycle management (RCM) services contracted by the Covered Entity:

• Verification of benefits and insurance coverage.
• Payment posting for healthcare claims.
• Claims submission and processing.
• Accounts receivable management.
• Patient billing services.
• Reporting on financial and claims data.

Use or disclosure of PHI beyond these services is prohibited unless required by law or explicitly authorized, in writing, by the Covered Entity.

3.2 Safeguards

Business Associate will implement and maintain administrative, physical, and technical safeguards to ensure the confidentiality, integrity, and availability of PHI, as required by HIPAA.

3.3 Reporting obligations

Any unauthorized use, disclosure, or breach of PHI will be reported to the Covered Entity without unreasonable delay and no later than 5 days of its discovery. The report will include details of the incident, the PHI involved, and mitigation efforts taken by the Business Associate.

3.4 Subcontractors

Business Associate will ensure that any subcontractors who may handle PHI on its behalf agree in writing to the same restrictions, conditions, and requirements as imposed by this Agreement. The current list of subprocessors is maintained at sora-llc-group.com/legal/subprocessors.

4. Term and termination

The Business Associate will return or destroy all PHI upon termination of services, unless retention is required by law. Retained PHI will continue to be protected under HIPAA requirements.

5. Reseller and white-label arrangements

Where Sora LLC's services are delivered through a reseller, the agreement chain runs Practice → Reseller → Sora LLC. Clients in a white-label arrangement should confirm the applicable contracting path with their reseller.

6. Contact

For inquiries related to this Agreement, please contact compliance@sora-llc-group.com.