Business Associate Agreement

Version 1.0 · Effective November 8, 2026

Parties and purpose

This Business Associate Agreement ("Agreement") is entered into between AccuMix Pharmacy, LLC, an Illinois limited liability company doing business as AccuRx Allergy Services ("AccuRx", "we", "us"), located at 655 W. Grand Ave, Suite 240, Elmhurst, IL 60126 ("Business Associate"), and the medical practice, provider or other HIPAA covered entity that holds an account on the AccuRx Allergy Services portal ("Covered Entity"). It is effective on the earlier of the date Covered Entity's first user signs in to the portal or the date Covered Entity otherwise accepts it (the "Effective Date"). Business Associate provides allergy testing documentation, consent, coding-support and immunotherapy ordering services (the "Services") that require it to create, receive, maintain or transmit protected health information on Covered Entity's behalf. The parties enter this Agreement to comply with the Health Insurance Portability and Accountability Act of 1996, the Health Information Technology for Economic and Clinical Health Act, and the regulations at 45 CFR Parts 160 and 164 (together, the "HIPAA Rules"). If the parties have signed a separate written business associate agreement, that signed agreement controls over this one.

1. Definitions

Terms used but not defined here have the meanings given in the HIPAA Rules, including Breach, Data Aggregation, Designated Record Set, Disclosure, Electronic Protected Health Information (ePHI), Individual, Minimum Necessary, Protected Health Information (PHI), Required by Law, Secretary, Security Incident, Subcontractor, Unsecured PHI and Use. "PHI" in this Agreement means PHI that Business Associate creates, receives, maintains or transmits for or on behalf of Covered Entity.

2. Permitted uses and disclosures by Business Associate

• Business Associate may use and disclose PHI only as necessary to perform the Services described in the Terms of Service and any services agreement between the parties, as permitted or required by this Agreement, or as Required by Law. Business Associate may not use or disclose PHI in a manner that would violate Subpart E of 45 CFR Part 164 if done by Covered Entity, except as set out in this Section.
• Business Associate may use PHI for its proper management and administration and to carry out its legal responsibilities, and may disclose PHI for those purposes if the disclosure is Required by Law or Business Associate obtains reasonable written assurances from the recipient that the PHI will be held confidentially, used or further disclosed only as Required by Law or for the purpose for which it was disclosed, and that the recipient will notify Business Associate of any breach of confidentiality.
• Business Associate may use PHI to provide Data Aggregation services relating to Covered Entity's health care operations, and may de-identify PHI in accordance with 45 CFR 164.514(a)-(c); de-identified information is not subject to this Agreement.
• Business Associate may use PHI to report violations of law to appropriate federal and state authorities, consistent with 45 CFR 164.502(j)(1).
• When AccuMix Pharmacy, LLC receives a prescription transmitted through the portal and compounds and dispenses medication, it does so as a health care provider and covered entity in its own right; the resulting pharmacy records are governed by the HIPAA Rules directly and by the pharmacy's own Notice of Privacy Practices.

3. Obligations of Business Associate

Business Associate agrees to:

• not use or disclose PHI other than as permitted or required by this Agreement or as Required by Law;
• use appropriate safeguards, and comply with Subpart C of 45 CFR Part 164 (the Security Rule) with respect to ePHI, to prevent use or disclosure of PHI other than as provided for by this Agreement, including administrative, physical and technical safeguards that reasonably and appropriately protect the confidentiality, integrity and availability of ePHI;
• report to Covered Entity any use or disclosure of PHI not provided for by this Agreement of which it becomes aware, any Security Incident of which it becomes aware, and any Breach of Unsecured PHI, as required by 45 CFR 164.410, as set out in Section 4;
• in accordance with 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2), ensure that any Subcontractor that creates, receives, maintains or transmits PHI on behalf of Business Associate agrees in writing to the same restrictions, conditions and requirements that apply to Business Associate under this Agreement;
• make available PHI held in a Designated Record Set to Covered Entity, within 15 business days of a request, as necessary for Covered Entity to meet its obligations under 45 CFR 164.524, including in the electronic form and format requested where readily producible;
• make any amendment to PHI in a Designated Record Set that Covered Entity directs or agrees to under 45 CFR 164.526, within 15 business days of the request;
• maintain and make available to Covered Entity, within 15 business days of a request, the information required to provide an accounting of disclosures under 45 CFR 164.528, and retain that information for six years from the date of each disclosure;
• to the extent Business Associate is to carry out one or more of Covered Entity's obligations under Subpart E of 45 CFR Part 164, comply with the requirements of Subpart E that apply to Covered Entity in the performance of those obligations;
• make its internal practices, books and records relating to the use and disclosure of PHI available to the Secretary for purposes of determining compliance with the HIPAA Rules;
• limit its uses, disclosures and requests of PHI to the Minimum Necessary to accomplish the intended purpose, consistent with 45 CFR 164.502(b);
• provide HIPAA training to its workforce members who have access to PHI before access is granted and at least annually, and apply appropriate sanctions for violations;
• assign unique logins to every user of the portal, enforce role-based access, terminate access promptly when a user's or practice's authorization ends, and maintain audit logs of access to and changes of PHI;
• not receive remuneration in exchange for PHI except as permitted by 45 CFR 164.502(a)(5)(ii), and not use or disclose PHI for marketing or fundraising;
• comply with any restriction on use or disclosure agreed to by Covered Entity under 45 CFR 164.522 of which Covered Entity notifies Business Associate, and with any request for confidential communications that Covered Entity directs Business Associate to honor.

4. Security Incidents and Breach notification

• Business Associate will report to Covered Entity any Breach of Unsecured PHI without unreasonable delay and in no case later than ten (10) business days after discovery. A Breach is treated as discovered on the first day it is known, or by exercising reasonable diligence would have been known, to Business Associate or any of its workforce members or agents other than the person who committed the Breach.
• The report will include, to the extent known: the identity of each Individual whose Unsecured PHI has been or is reasonably believed to have been accessed, acquired, used or disclosed; a description of what happened, including the date of the Breach and the date of discovery; the types of PHI involved; the steps Individuals should take to protect themselves; what Business Associate is doing to investigate, mitigate harm and protect against further Breaches; and contact information for further questions. Information not available at the time of the initial report will be supplied as it becomes available.
• Business Associate will report Security Incidents that result in unauthorized access, use, disclosure, modification or destruction of ePHI within the same timeframe. The parties acknowledge that unsuccessful attempts such as pings, port scans, log-in attempts that do not succeed and denial-of-service attacks that do not result in unauthorized access occur routinely; this Section constitutes notice of those unsuccessful attempts, and no further reporting of them is required.
• Business Associate will mitigate, to the extent practicable, any harmful effect known to it of a use or disclosure of PHI in violation of this Agreement, will cooperate with Covered Entity's risk assessment under 45 CFR 164.402, and will provide information reasonably needed for Covered Entity's notifications to Individuals, the Secretary and the media. Unless the parties agree otherwise in writing, Covered Entity is responsible for making those notifications; Business Associate will reimburse Covered Entity's reasonable, documented costs of notification for a Breach caused by Business Associate's violation of this Agreement.

5. Obligations of Covered Entity

Covered Entity agrees to: notify Business Associate of any limitation in its Notice of Privacy Practices, any change in or revocation of an Individual's permission to use or disclose PHI, and any restriction or confidential-communication request it has agreed to, to the extent that these may affect Business Associate's uses or disclosures; not request Business Associate to use or disclose PHI in any manner that would not be permissible under Subpart E of 45 CFR Part 164 if done by Covered Entity, except as permitted under Section 2; obtain any consent or authorization required for the uses and disclosures contemplated by the Services, including a patient's informed consent to immunotherapy; enter into the portal only PHI of patients it treats; and manage its users' access as described in the Terms of Service, including prompt deactivation of departing staff.

6. Term and termination

• This Agreement is effective on the Effective Date and continues until all PHI received from, or created or received by Business Associate on behalf of, Covered Entity is returned or destroyed in accordance with this Section, or, if return or destruction is infeasible, until the Services end and the protections in this Section are in place.
• Covered Entity may terminate this Agreement and the Services if it determines that Business Associate has violated a material term of this Agreement and Business Associate has not cured the violation within 30 days of written notice, or immediately if cure is not possible. Business Associate may terminate the Services if Covered Entity violates its obligations in Section 5 and does not cure within 30 days of written notice.
• On termination, Business Associate will return or destroy all PHI that it still maintains in any form and retain no copies, except that Business Associate may retain PHI (a) that it is required by law to keep, including prescription, compounding, dispensing and patient consent records that Illinois pharmacy law and federal law require it to keep, (b) that is needed for its proper management and administration or to carry out its legal responsibilities, or (c) where return or destruction is otherwise infeasible. Business Associate will extend the protections of this Agreement to any retained PHI and limit further uses and disclosures to the purposes that make return or destruction infeasible, for as long as it maintains the PHI. On request within 30 days of termination, Business Associate will provide Covered Entity with an electronic export of its patients' test results, orders and consents in a commonly used format before destroying any copies it is not required to keep.

7. Indemnification and insurance

Each party will indemnify, defend and hold harmless the other party from third-party claims, fines, penalties and reasonable costs, including notification costs and reasonable attorneys' fees, to the extent arising from the indemnifying party's breach of this Agreement or violation of the HIPAA Rules. Business Associate will maintain commercially reasonable cyber-liability and professional liability insurance during the term of this Agreement. Any limitation of liability in the Terms of Service does not apply to a party's obligations under this Section to the extent prohibited by law.

8. Miscellaneous

• Regulatory references. A reference to a section of the HIPAA Rules means that section as in effect or as amended.
• Amendment. The parties agree to take such action as is necessary to amend this Agreement to comply with changes in the HIPAA Rules or other applicable law. Business Associate may update this Agreement by posting a new version at new.accu-rx.us/legal/baa/ with a new effective date and notifying Covered Entity through the portal; continued use of the Services after the effective date is acceptance. No change may reduce the protection of PHI below what the HIPAA Rules require.
• Interpretation. Any ambiguity in this Agreement will be resolved to permit compliance with the HIPAA Rules. In the event of a conflict between this Agreement and the Terms of Service or any other agreement between the parties regarding PHI, this Agreement controls.
• No third-party beneficiaries. Nothing in this Agreement confers rights on any person other than the parties and their successors and permitted assigns.
• Survival. Sections 3, 4, 6, 7 and 8 survive termination.
• Governing law. This Agreement is governed by the laws of the State of Illinois and applicable federal law, with exclusive venue in the state or federal courts located in DuPage County, Illinois.
• Acceptance. Covered Entity accepts this Agreement through its authorized representative by creating or using a portal login and by checking the attestation on each order, which records the version in force. Either party may request a countersigned paper copy at any time.
• Contact. Notices under this Agreement go to Privacy & Compliance Officer, AccuRx Allergy Services, 655 W. Grand Ave, Suite 240, Elmhurst, IL 60126 · phone 630-749-2771 · or the Help Desk inside the portal, and to Covered Entity at the practice address and administrator email on file in the portal.