HIPAA BUSINESS ASSOCIATE AGREEMENT — DRAFT FOR ATTORNEY REVIEW Document Ref: BAA-2026-001 Date of Preparation: June 1 2026 IMPORTANT: This document is a structured preparation draft only and must be reviewed and finalized by a qualified healthcare compliance attorney before it is signed or relied upon. This is not a certified HIPAA-compliant Business Associate Agreement. COVERED ENTITY: Sunrise Medical Group LLC Austin Texas USA Email: [covered entity email] BUSINESS ASSOCIATE: MedBill Solutions Inc Dallas Texas USA Email: [business associate email] 1. RECITALS 1.1 Sunrise Medical Group LLC is a healthcare provider and covered entity under HIPAA that provides medical services and maintains protected health information of patients in the course of providing and billing for healthcare services. 1.2 MedBill Solutions Inc is a medical billing and claims processing company that provides billing, claims submission, and payment collection services to Sunrise Medical Group LLC that require access to protected health information. 1.3 HIPAA requires a Business Associate Agreement to be executed before a covered entity may share protected health information with a business associate that performs functions or activities on its behalf involving PHI. 1.4 Both parties confirm mutual intent to document the terms of their HIPAA Business Associate Agreement through this draft for professional review and finalization. 2. DEFINITIONS 2.1 Covered Entity: Sunrise Medical Group LLC, a healthcare provider that electronically transmits health information in connection with certain transactions and is subject to HIPAA as defined in 45 CFR 160.103, which the parties should verify with their attorney. 2.2 Business Associate: MedBill Solutions Inc, a person or entity that performs functions or activities involving PHI on behalf of a covered entity as defined in 45 CFR 160.103, which the parties should verify with their attorney. 2.3 Protected Health Information (PHI): Individually identifiable health information held or transmitted by a covered entity or business associate in any form or medium as defined in 45 CFR 160.103, which the parties should verify with their attorney. 2.4 Electronic Protected Health Information (ePHI): PHI that is created, received, maintained, or transmitted in electronic form as defined under the HIPAA Security Rule at 45 CFR 164.304. 2.5 Breach: An acquisition, access, use, or disclosure of PHI in a manner not permitted under the Privacy Rule that compromises the security or privacy of the PHI as defined at 45 CFR 164.402, which must be confirmed with a qualified attorney. 2.6 Minimum Necessary: The standard requiring that only the minimum amount of PHI necessary to accomplish the intended purpose is used, disclosed, or requested as described at 45 CFR 164.502(b). 2.7 Effective Date: The date on which both parties execute this agreement. 3. SERVICES AND FUNCTIONS INVOLVING PHI 3.1 MedBill Solutions Inc provides medical billing, claims submission to insurance payers, payment collection, and accounts receivable reporting services to Sunrise Medical Group LLC. 3.2 In performing these services, MedBill Solutions Inc receives, maintains, and transmits PHI including patient demographics, diagnosis codes, procedure codes, and insurance information. 3.3 MedBill Solutions Inc is performing these functions as a service provider to Sunrise Medical Group LLC and not as an independent controller of the PHI involved. The precise characterization of the Business Associate relationship must be confirmed with a qualified healthcare compliance attorney. 4. PERMITTED USES AND DISCLOSURES AND PROHIBITED USES 4.1 MedBill Solutions Inc is permitted to use or disclose PHI only as follows: 1. As necessary to perform medical billing and claims submission services for Sunrise Medical Group LLC. 2. As necessary to submit and process insurance claims on behalf of Sunrise Medical Group LLC. 3. As necessary for payment collection activities on behalf of Sunrise Medical Group LLC. 4. As necessary to provide accounts receivable and billing reports to Sunrise Medical Group LLC. 4.2 MedBill Solutions Inc may use PHI for its own proper management and administration or to carry out its legal responsibilities to the extent permitted by applicable HIPAA regulations. These uses are governed by specific regulatory requirements that must be confirmed with a qualified attorney. 4.3 MedBill Solutions Inc is prohibited from selling PHI, using or disclosing PHI for marketing purposes without individual authorization, and using PHI in any manner that violates applicable law. These prohibitions are governed by specific HIPAA and HITECH requirements and must be confirmed with a qualified attorney. 5. MINIMUM NECESSARY 5.1 MedBill Solutions Inc agrees to use, disclose, or request only the minimum amount of PHI necessary to accomplish the intended purpose of the use, disclosure, or request, consistent with the minimum necessary standard under 45 CFR 164.502(b). 5.2 MedBill Solutions Inc will develop and implement policies and procedures to give effect to this obligation and will train relevant personnel accordingly. 6. BUSINESS ASSOCIATE'S OBLIGATIONS 6.1 MedBill Solutions Inc agrees to: 1. Implement and maintain appropriate administrative, physical, and technical safeguards to protect PHI consistent with HIPAA requirements. 2. Ensure that any subcontractors or agents who access PHI agree to the same restrictions through a written subcontractor BAA. 3. Report any use or disclosure of PHI not provided for in this document to Sunrise Medical Group LLC without unreasonable delay. 4. Make PHI available to Sunrise Medical Group LLC to enable fulfillment of individual access rights requests. 5. Make PHI available for amendment as directed by Sunrise Medical Group LLC. 6. Provide an accounting of disclosures as required under applicable HIPAA regulations. 7. Make internal practices and records available to HHS for compliance determination purposes. 8. Return or destroy all PHI upon termination of this agreement. 7. SAFEGUARDS 7.1 Administrative Safeguards: MedBill Solutions Inc agrees to implement security policies and procedures, conduct annual risk analysis and risk management activities, implement a security awareness and training program, implement security incident procedures, and maintain contingency planning for emergencies. 7.2 Physical Safeguards: MedBill Solutions Inc agrees to implement facility access controls, workstation use policies, workstation security measures, and device and media controls. 7.3 Technical Safeguards: MedBill Solutions Inc agrees to implement access controls limiting system access to authorized users, audit controls, integrity controls, and transmission security measures. AES-256 encryption is applied to all ePHI at rest and in transit. 7.4 Security Certifications: MedBill Solutions Inc maintains SOC 2 Type II certification and agrees to provide Sunrise Medical Group LLC with evidence of current certification upon request. 8. SUBCONTRACTORS AND BREACH NOTIFICATION 8.1 MedBill Solutions Inc agrees to ensure that any subcontractor or agent to whom it provides PHI agrees to the same restrictions through a written subcontractor BAA. MedBill Solutions Inc must notify Sunrise Medical Group LLC before engaging any new subcontractor who will access PHI. 8.2 MedBill Solutions Inc agrees to notify Sunrise Medical Group LLC of any breach of unsecured PHI or any suspected breach without unreasonable delay and within 60 days of discovery. The breach notification must include: identification of each individual affected, the date of the breach and date of discovery, a description of the types of unsecured PHI involved, a description of investigation and mitigation steps, and contact information for MedBill Solutions Inc's privacy and security officer. Breach notification obligations under HIPAA are governed by specific regulatory requirements at 45 CFR 164.410 that must be confirmed with a qualified attorney. 9. INDIVIDUAL RIGHTS, HHS, AND STATE LAW 9.1 MedBill Solutions Inc agrees to cooperate with Sunrise Medical Group LLC in fulfilling individual rights requests including the right to access PHI, the right to request amendment, and the right to receive an accounting of disclosures. MedBill Solutions Inc must respond to Sunrise Medical Group LLC's requests for assistance within 10 business days. 9.2 MedBill Solutions Inc agrees to make its internal practices, books, and records relating to PHI available to the Secretary of HHS for compliance determination purposes. 9.3 Texas state health privacy law applies to this arrangement. Texas mental health privacy laws including the Texas Health and Safety Code requirements for mental health records provide protections more stringent than federal HIPAA requirements for those categories and will apply to this arrangement. A qualified Texas healthcare compliance attorney must identify all applicable state law requirements before this document is finalized. 10. TERM AND TERMINATION 10.1 This agreement is effective from the Effective Date and continues indefinitely for as long as MedBill Solutions Inc creates, receives, maintains, or transmits PHI on behalf of Sunrise Medical Group LLC. 10.2 Sunrise Medical Group LLC may terminate this agreement if MedBill Solutions Inc violates a material term and has not cured the violation within 30 days of written notice, or immediately if cure is not possible. 10.3 Either party may terminate for convenience with 90 days written notice. 10.4 Upon termination, MedBill Solutions Inc must return or destroy all PHI and retain no copies. These obligations are governed by 45 CFR 164.504(e)(2) and must be confirmed with a qualified attorney. 11. GOVERNING LAW AND DISPUTES 11.1 Laws of Texas USA govern this agreement. Federal HIPAA regulations apply regardless of this governing law choice. 11.2 Disputes will first be addressed through direct good-faith negotiation. If unsuccessful, disputes proceed to binding arbitration. SIGNATURE BLOCK: IMPORTANT: Both parties must have this agreement reviewed and finalized by a qualified healthcare compliance attorney before signing. This draft does not constitute a certified HIPAA-compliant Business Associate Agreement. Sunrise Medical Group LLC (Covered Entity) HIPAA Privacy Officer: ________________ Signature: ________________ Date: ____________________ MedBill Solutions Inc (Business Associate) HIPAA Security Officer: _______________ Signature: ________________ Date: ____________________ DISCLAIMER: This HIPAA Business Associate Agreement draft was generated by an AI drafting tool as a structured preparation and documentation aid only. It does not constitute a certified HIPAA-compliant Business Associate Agreement and must not be signed or relied upon without review and finalization by a qualified healthcare compliance attorney.