Signal/pitch/legal/gaboro-baa.md

BUSINESS ASSOCIATE AGREEMENT

Effective Date: June __, 2026

Between:

• STTIL Solutions LLC ("Business Associate"), a limited liability company, Kisa Fenn, Managing Member
• Gaboro DME ("Covered Entity"), Robert Robinson, Co-Founder and Managing Partner

Each a "Party" and together the "Parties."

---

Recitals

Covered Entity is a durable medical equipment supplier subject to the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations ("HIPAA"). Business Associate provides Signal, a documentation readiness platform, and in connection with that service may receive, create, maintain, or transmit data on behalf of Covered Entity that may constitute Protected Health Information ("PHI") as defined under HIPAA. The Parties enter into this Agreement to satisfy the Business Associate Agreement requirements of 45 C.F.R. Part 164, Subpart C.

---

1. Definitions

Terms used in this Agreement have the meanings assigned under HIPAA and its implementing regulations, including the HITECH Act amendments, as of the Effective Date.

"Protected Health Information" or "PHI" means individually identifiable health information created, received, maintained, or transmitted by Business Associate on behalf of Covered Entity, in any form or medium.

"Minimum Necessary" means the least amount of PHI required to accomplish the intended purpose of a given use, disclosure, or request.

"Security Incident" means the attempted or successful unauthorized access, use, disclosure, modification, or destruction of information or interference with system operations in an information system.

---

2. Obligations of Business Associate

2.1 Permitted Uses and Disclosures

Business Associate may use or disclose PHI only:

(a) To perform the services described in the Pilot Letter of Intent between the Parties dated June __, 2026 ("LOI"), specifically: receiving de-identified order management data uploaded by Covered Entity, calculating documentation readiness status per patient, and returning a prioritized worklist to Covered Entity staff;

(b) As required by law; or

(c) For the proper management and administration of Business Associate's own operations, provided that any such disclosure is required by law or Business Associate obtains reasonable assurances that the information will be held in confidence and used or further disclosed only as required by law or for the purpose for which it was disclosed.

Business Associate will not use or disclose PHI in any manner that would violate HIPAA if done by Covered Entity directly.

2.2 Minimum Necessary

Business Associate will make reasonable efforts to use, disclose, and request only the minimum necessary PHI to accomplish the intended purpose.

2.3 Safeguards

Business Associate will implement and maintain appropriate administrative, physical, and technical safeguards to protect the confidentiality, integrity, and availability of PHI it creates, receives, maintains, or transmits on behalf of Covered Entity, in accordance with 45 C.F.R. Part 164, Subpart C (Security Rule).

Business Associate's current safeguards include:

• HTTPS enforced on all data transmission surfaces
• SHA-256 hashing of patient_id before storage in any log or database record
• Supabase Row Level Security (RLS) restricting data access by organization
• Clerk JWT authentication required on all API endpoints
• No storage of patient names, dates of birth, Social Security numbers, addresses, or contact information at any time
• The patient identity crosswalk (supplier's internal patient_id to real patient identity) is maintained solely by Covered Entity staff and is never transmitted to or stored by Business Associate

2.4 Reporting

Business Associate will report to Covered Entity, without unreasonable delay and in no event later than 30 calendar days of discovery:

(a) Any use or disclosure of PHI not permitted by this Agreement of which Business Associate becomes aware;

(b) Any Security Incident of which Business Associate becomes aware, including breaches of Unsecured PHI as required by 45 C.F.R. Part 164, Subpart D;

(c) Any attempted but unsuccessful Security Incident of which Business Associate becomes aware, to the extent practicable.

Reports shall be made to Covered Entity's designated contact in writing.

2.5 Subcontractors

Business Associate will ensure that any subcontractor or agent to which it provides PHI on behalf of Covered Entity agrees to the same restrictions, conditions, and requirements that apply to Business Associate under this Agreement.

Business Associate's current subprocessors include:

Subprocessor	Purpose	Data Touched
Supabase (via cloud.supabase.com)	PostgreSQL database hosting	Hashed patient_id, device_type, shipment_date, payer, doc status fields
Railway (via railway.app)	Backend API hosting	Processes upload requests in transit; does not persist PHI
Vercel (via vercel.com)	Frontend hosting	No PHI; serves static application only
Clerk (via clerk.com)	Staff authentication	No PHI; stores staff identity only

Business Associate will notify Covered Entity of any material change to subprocessors that will touch PHI, and will obtain Covered Entity's written approval before adding any new subprocessor that will receive or process PHI.

2.6 Access to PHI

To the extent Business Associate maintains PHI in a Designated Record Set, Business Associate will make such PHI available to Covered Entity as necessary to fulfill Covered Entity's obligations under 45 C.F.R. Section 164.524 within 15 business days of a written request.

2.7 Amendment

To the extent Business Associate maintains PHI in a Designated Record Set, Business Associate will make such PHI available for amendment and will incorporate any amendments requested by Covered Entity as required by 45 C.F.R. Section 164.526.

2.8 Accounting of Disclosures

Business Associate will maintain a record of disclosures of PHI and will make such information available to Covered Entity as necessary to respond to a request for an accounting of disclosures under 45 C.F.R. Section 164.528.

2.9 Government Access

Business Associate will make its internal practices, books, and records relating to the use and disclosure of PHI available to the Secretary of the U.S. Department of Health and Human Services for purposes of determining compliance with HIPAA.

---

3. Obligations of Covered Entity

Covered Entity agrees to:

(a) Notify Business Associate of any limitation in Covered Entity's Notice of Privacy Practices that would affect Business Associate's permitted uses or disclosures;

(b) Notify Business Associate of any changes in, or revocations of, authorization by individuals that would affect Business Associate's permitted uses or disclosures;

(c) Not request Business Associate to use or disclose PHI in any manner that would not be permissible under HIPAA if done by Covered Entity directly;

(d) Ensure that any PHI uploaded to Signal is limited to the minimum necessary fields specified in the LOI: an internal patient identifier (patient_id), device type, shipment date, and payer name. Covered Entity will not upload patient names, Social Security numbers, dates of birth, addresses, or direct contact information to Signal at any time.

---

4. Term and Termination

4.1 Term

This Agreement is effective as of the Effective Date and continues until the later of: (a) the termination of the LOI or any subsequent formal agreement between the Parties; or (b) the date on which Business Associate has completed its data return and destruction obligations under Section 4.3.

4.2 Termination for Cause

Either Party may terminate this Agreement immediately upon written notice to the other Party if the other Party has materially breached a provision of this Agreement and has not cured the breach within 10 business days of written notice identifying the breach.

4.3 Return or Destruction of PHI

Upon termination of this Agreement for any reason:

(a) Business Associate will return to Covered Entity or destroy all PHI received from or created on behalf of Covered Entity, including PHI in the possession of subcontractors, within 10 business days of the effective termination date;

(b) Business Associate will certify in writing to Covered Entity that all such PHI has been returned or destroyed;

(c) If return or destruction is not feasible, Business Associate will extend the protections of this Agreement to such PHI and limit further use or disclosure to the purposes that make return or destruction infeasible, for as long as Business Associate maintains the PHI.

---

5. Miscellaneous

5.1 Regulatory References

Any reference in this Agreement to a section of HIPAA includes the most recent amendment or regulatory guidance applicable to that section.

5.2 Interpretation

This Agreement is intended to comply with HIPAA as amended. Where this Agreement conflicts with HIPAA, HIPAA controls. Where this Agreement is silent, HIPAA controls.

5.3 No Third-Party Beneficiaries

Nothing in this Agreement confers any right, remedy, or claim upon any third party, including any patient whose PHI is involved.

5.4 Governing Law

This Agreement shall be governed by the laws of the Commonwealth of Pennsylvania, without regard to conflict of law principles.

5.5 Entire Agreement

This Agreement, together with the LOI and mutual NDA between the Parties, constitutes the entire agreement with respect to PHI and supersedes all prior understandings on the subject.

---

Attorney Review Notes

The following items should be confirmed by Nixon Law Group before this Agreement is executed:

1. BAA necessity: Confirm whether Signal's receipt of Covered Entity's internal patient_id (supplier account number, one of HIPAA's 18 Safe Harbor identifiers) makes STTIL Solutions a Business Associate requiring this Agreement, or whether Signal's de-identification architecture (no names, no DOBs, no SSNs; crosswalk stays with Covered Entity) satisfies the Expert Determination or Safe Harbor de-identification standards.

2. Subprocessor agreements: Confirm whether Railway, Supabase, Vercel, and Clerk each require a separate BAA as subcontractors.

3. Accounting of disclosures scope: Confirm the scope of Section 2.8 as applied to a software service that processes de-identified data only.

4. Pennsylvania-specific requirements: Confirm no PA-specific health data protection statutes (beyond HIPAA) apply to this arrangement.

---

Signatures

STTIL Solutions LLC (Business Associate) By: ___________________________ Name: Kisa Fenn Title: Managing Member Date: _________________________ Email: kisasttil@gmail.com

Gaboro DME (Covered Entity) By: ___________________________ Name: Robert Robinson Title: Co-Founder and Managing Partner Date: _________________________ Email: ___________________________