Business Associate Agreement

Parties and purpose

This Business Associate Agreement ("BAA") supplements the Cara Terms of Service between Cara ("Business Associate") and the home care agency accepting this agreement ("Covered Entity"). It governs Protected Health Information ("PHI") that Covered Entity, or others acting for Covered Entity, makes available to Cara.

Terms not defined here have the meaning given in the HIPAA Privacy, Security, Breach Notification, and Enforcement Rules at 45 CFR Parts 160 and 164 (the "HIPAA Rules").

Permitted uses and disclosures

Cara may use and disclose PHI only as necessary to perform the services described in the Terms of Service, as required by law, or as Covered Entity directs in writing. Services include answering and transcribing inquiry calls, storing and routing inquiry records, drafting follow-up communications, scheduling assessments, and syncing records to systems the Covered Entity connects.

• Cara will not use or disclose PHI in a manner that would violate the HIPAA Rules if done by Covered Entity.
• Cara will not sell PHI and will not use PHI for marketing to individuals.
• Cara may use PHI for its own proper management and administration and to carry out its legal responsibilities.
• Cara may de-identify PHI in accordance with 45 CFR 164.514(b) and use de-identified data for service improvement.

Minimum necessary

Cara will request, use, and disclose only the minimum amount of PHI necessary to accomplish the purpose of the request, use, or disclosure.

Safeguards

Cara will implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of electronic PHI, as required by 45 CFR Part 164 Subpart C. These currently include:

• Encryption of PHI in transit (TLS) and at rest.
• Per-agency data isolation enforced at the database layer, so no agency can read another agency's records.
• Role-based access control, with export, bulk deletion, and audit access limited to owners and administrators.
• An append-only access log recording every view, creation, change, export, and deletion of PHI, retained and readable by the Covered Entity.
• Automatic session termination after a period of inactivity.
• Configurable retention with automatic destruction of records past the Covered Entity's retention period.
• Redaction of direct identifiers from application logs and from prompts sent to AI model providers, unless the Covered Entity explicitly enables full-content AI processing.

Subcontractors

Cara will ensure that any subcontractor that creates, receives, maintains, or transmits PHI on Cara's behalf agrees in writing to restrictions and conditions at least as strict as those that apply to Cara under this BAA. A current list of subcontractors and their agreement status is published at /subprocessors and updated before any new subcontractor receives PHI.

Reporting and breach notification

Cara will report to Covered Entity any use or disclosure of PHI not permitted by this BAA, any security incident of which it becomes aware, and any breach of unsecured PHI.

• Notice of a suspected breach of unsecured PHI: without unreasonable delay and no later than 15 calendar days after discovery.
• Notice will include, to the extent known, the individuals affected, the nature of the PHI involved, what occurred, and the mitigation steps taken.
• Cara will mitigate, to the extent practicable, any harmful effect known to Cara of a use or disclosure in violation of this BAA.
• Unsuccessful attempts at unauthorized access that do not result in access (routine scans, pings, blocked login attempts) are reported in aggregate rather than individually.

Individual rights

Cara will support the Covered Entity in meeting its obligations to individuals:

• Access (45 CFR 164.524): PHI held by Cara is visible and exportable by the Covered Entity at any time from within the product.
• Amendment (45 CFR 164.526): records can be edited by the Covered Entity directly; Cara will make amendments the Covered Entity directs.
• Accounting of disclosures (45 CFR 164.528): the access log provides the record needed to respond to an accounting request; Cara will provide supporting information within 15 days of a written request.
• Cara will make its internal practices, books, and records relating to PHI available to the Secretary of Health and Human Services for determining compliance.

Term and termination

This BAA takes effect when Covered Entity accepts it and continues until all PHI is returned or destroyed. Covered Entity may terminate the Terms of Service if Cara materially breaches this BAA and fails to cure within 30 days of written notice.

On termination, Cara will return or destroy all PHI it maintains for Covered Entity, including PHI held by subcontractors, within 60 days. Where return or destruction is infeasible, Cara will extend the protections of this BAA to that PHI and limit further use and disclosure to the purposes that make return or destruction infeasible.

Covered Entity obligations

• Covered Entity will not ask Cara to use or disclose PHI in a way that would violate the HIPAA Rules if done by Covered Entity.
• Covered Entity will notify Cara of any limitation in its notice of privacy practices, any change in or revocation of an individual's permission, and any restriction on use or disclosure it has agreed to, to the extent it affects Cara's use or disclosure of PHI.
• Covered Entity is responsible for obtaining any consents required for calls, recordings, SMS, and email sent through the service, and for honoring opt-outs.
• Covered Entity controls which integrations receive PHI and is responsible for its own agreements with those systems.

Miscellaneous

This BAA is governed by the laws of the State of Delaware, excluding conflict-of-laws rules. Any ambiguity is resolved to permit compliance with the HIPAA Rules. If the HIPAA Rules change, the parties will negotiate in good faith to amend this BAA as necessary. Nothing in this BAA creates rights in any third party.

Acceptance is recorded electronically with the signer's name, title, email address, IP address, and timestamp, and constitutes a signature under the E-SIGN Act.