Business Associate Agreement

Template version 1.0 · 2026-05-27

Status: Vogelview offers BAAs to healthcare providers and Covered Entities who integrate Vogelview with workflows involving Protected Health Information (PHI). For most consumer users a BAA is not required because Vogelview operates as a direct-to-consumer service. Email legal@vogelview.health to execute a BAA.

This Business Associate Agreement (“BAA”) is entered into between the Covered Entity identified in the signature block (“CE”) and Vogelview, Inc. (“Business Associate” or “BA”), and supplements any service agreement between the parties.

1. Definitions

Capitalized terms have the meaning given in the HIPAA Privacy, Security, Breach Notification, and Enforcement Rules at 45 C.F.R. Parts 160 and 164 (collectively, “HIPAA Rules”).

2. Permitted uses and disclosures of PHI

Vogelview may use or disclose PHI only as necessary to perform the services described in the service agreement, or as Required by Law.
Vogelview will not sell PHI or use PHI for marketing in violation of HIPAA.
Vogelview may use PHI for the proper management and administration of Vogelview, or to provide data aggregation services for CE as described at 45 C.F.R. § 164.504(e)(2)(i)(B).

3. Safeguards

Vogelview will implement administrative, physical, and technical safeguards (including written policies and procedures) that reasonably and appropriately protect the confidentiality, integrity, and availability of Electronic PHI, as required by the Security Rule.

4. Subcontractors

Vogelview will ensure that any subcontractor that creates, receives, maintains, or transmits PHI on behalf of Vogelview agrees in writing to the same restrictions and conditions that apply to Vogelview under this BAA.

5. Breach notification

Vogelview will notify CE of any Breach of Unsecured PHI without unreasonable delay and in no case later than 60 calendar days after Discovery, in accordance with 45 C.F.R. § 164.410.

6. Individual rights

Vogelview will (a) make PHI available to CE for access by individuals pursuant to 45 C.F.R. § 164.524; (b) make PHI available for amendment per § 164.526; (c) make available the information required for an accounting of disclosures per § 164.528.

7. Internal practices and HHS access

Vogelview will make its internal practices, books, and records relating to the use and disclosure of PHI received from CE available to the Secretary of HHS for purposes of determining CE’s compliance with the HIPAA Rules.

8. Termination

On termination of the service agreement, Vogelview will return or destroy all PHI, including PHI in possession of subcontractors. If return or destruction is infeasible, Vogelview will extend the protections of this BAA to such PHI and limit further uses and disclosures.

9. Governing law

This BAA is governed by the laws of the Commonwealth of Massachusetts (or as otherwise specified in the underlying service agreement), without regard to conflict-of-laws principles.

10. Signatures

To execute this BAA, contact legal@vogelview.health for the signature-ready PDF and DocuSign workflow.