Business Associate Agreement

1. Definitions

1.1 Capitalized terms used but not defined in this BAA have the meanings given in the HIPAA Rules, including “Breach”, “Covered Entity”, “Data Aggregation”, “Designated Record Set”, “Disclosure”, “Health Care Operations”, “Individual”, “Minimum Necessary”, “Notice of Privacy Practices”, “Required by Law”, “Secretary”, “Security Incident”, “Subcontractor”, “Unsecured Protected Health Information”, and “Use”.

1.2 “HIPAA Rules” means the Privacy, Security, Breach Notification, and Enforcement Rules at 45 CFR Parts 160 and 164, as amended, including by the HITECH Act.

1.3 “Protected Health Information” or “PHI” has the meaning given in 45 CFR 160.103, limited to the information FlashTower creates, receives, maintains, or transmits on behalf of Customer through the Covered Services. “ePHI” means PHI that is transmitted or maintained in electronic media.

1.4 “Agreement” means the FlashTower Terms of Service, the Data Processing Addendum, any Order Form, and any Enterprise agreement between FlashTower and Customer.

1.5 “Covered Services” means the parts of the Service listed in section 5.1, as they may be narrowed or extended in the executed Order Form.

1.6 “Discovery” means the first day on which a Breach of Unsecured PHI is known to FlashTower, or by exercising reasonable diligence would have been known to any FlashTower workforce member or agent, consistent with 45 CFR 164.410(a)(2).

2. Applicability and eligibility

2.1 This BAA is effective only when it has been executed by authorized representatives of both FlashTower and Customer, directly or through an Order Form that expressly incorporates it, and only for a subscription plan that FlashTower designates as eligible for a BAA. Accepting the Terms of Service online does not create a BAA.

2.2 Customer represents that it is a Covered Entity or a Business Associate of a Covered Entity, and that its use of the Covered Services involves PHI only to the extent permitted by this BAA.

2.3 Until this BAA is in effect, the Terms of Service prohibit Customer from submitting PHI to the Service, and FlashTower has no obligations under the HIPAA Rules with respect to any PHI submitted in breach of that prohibition, other than to delete it promptly when discovered.

3. Permitted uses and disclosures

3.1 FlashTower may Use and Disclose PHI only (a) to perform the Covered Services for Customer under the Agreement; (b) as Required by Law; and (c) as permitted by section 3.2. FlashTower will not Use or Disclose PHI in any manner that would violate Subpart E of 45 CFR Part 164 if done by Customer, except as permitted by section 3.2.

3.2 FlashTower may Use PHI for its proper management and administration and to carry out its legal responsibilities, and may Disclose PHI for those purposes only if the Disclosure is Required by Law, or FlashTower obtains reasonable written assurances from the recipient that the PHI will be held confidentially, Used or further Disclosed only as Required by Law or for the purpose for which it was Disclosed, and that the recipient will notify FlashTower of any instance in which the confidentiality of the PHI has been breached (45 CFR 164.504(e)(4)).

3.3 FlashTower will not: sell PHI; Use or Disclose PHI for marketing; use PHI to train machine-learning models; include PHI in any cross-customer statistic, benchmark, or intelligence product; or perform Data Aggregation services unless the Agreement expressly requests them.

3.4 FlashTower may de-identify PHI only in accordance with 45 CFR 164.514(a)–(c) and only to the extent needed to perform the Covered Services. FlashTower's aggregate intelligence uses derived, cohort-protected indicators and never raw content.

4. Safeguards and obligations of FlashTower

4.1 Safeguards. FlashTower will use appropriate administrative, physical, and technical safeguards, and comply with Subpart C of 45 CFR Part 164 with respect to ePHI, to prevent Use or Disclosure of PHI other than as provided by this BAA (45 CFR 164.314(a)(2)(i)(A) and 164.504(e)(2)(ii)(B)).

4.2 Minimum necessary. FlashTower will limit its Uses, Disclosures, and requests of PHI to the Minimum Necessary to accomplish the intended purpose, consistent with 45 CFR 164.502(b) and 164.514(d).

4.3 Security measures in the Covered Services include, without limitation: tenant isolation enforced by database row-level security; role-based access control; multi-factor authentication required for FlashTower platform administrators and enforced in the database for every account that enrolls a factor; encryption in transit with TLS and HSTS; encryption at rest provided by FlashTower's hosting and database providers; application-level AES-256-GCM encryption of Threat Evidence Vault payloads and forensic packages; an append-only audit log; and a hash-chained chain of custody for preserved evidence. No FlashTower staff role has a path to read a customer's preserved evidence.

4.4 Mitigation. FlashTower will mitigate, to the extent practicable, any harmful effect known to FlashTower of a Use or Disclosure of PHI by FlashTower in violation of this BAA.

4.5 Obligations of Customer carried out by FlashTower. To the extent FlashTower carries out any of Customer's obligations under Subpart E of 45 CFR Part 164, FlashTower will comply with the requirements of Subpart E that apply to Customer in the performance of that obligation.

5. Covered Services and channels that must not receive PHI

5.1 Unless the executed Order Form provides otherwise, the Covered Services are: (a) the FlashTower application database and organization workspace; (b) the Agent DLP inspection API; (c) the AI Agent Security Gateway; (d) the AI Communication Map telemetry API; (e) the Threat Evidence Vault, including Restricted Forensic Evidence Packages; and (f) evidence files uploaded to an organization's private evidence storage.

5.2 The following channels are not Covered Services, are not designed to receive PHI, and Customer must not submit PHI to them: (a) support tickets, support attachments, and support email, unless the executed Order Form expressly extends this BAA to support; (b) email notifications, whose bodies FlashTower designs to contain no evidence or customer content; (c) optional AI narrative features, which Customer must keep turned off for any organization that processes PHI unless the executed Order Form expressly covers them; (d) product analytics; and (e) error monitoring. FlashTower applies redaction before data reaches logs, error monitoring, analytics, and AI prompts, but redaction is pattern-based and is not a substitute for Customer keeping PHI out of these channels.

5.3 Customer will configure the Covered Services consistent with this section, including keeping AI processing turned off for organizations that process PHI and choosing Threat Evidence Vault capture and retention settings appropriate to its own obligations.

6. Subcontractors

6.1 In accordance with 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2), FlashTower will ensure that any Subcontractor that creates, receives, maintains, or transmits PHI on behalf of FlashTower agrees in writing to the same or substantially similar restrictions, conditions, and requirements that apply to FlashTower under this BAA, including implementing reasonable and appropriate safeguards for ePHI.

6.2 FlashTower will not permit PHI to be processed by a Subcontractor that has not entered into such a written agreement. FlashTower's current subprocessors are listed at /legal/subprocessors.

6.3 FlashTower remains responsible to Customer for its Subcontractors' performance of the obligations in this BAA.

7. Reporting of Security Incidents and Breaches

7.1 Breaches of Unsecured PHI. FlashTower will notify Customer of any Breach of Unsecured PHI without unreasonable delay and in no case later than ten (10) business days after Discovery. The initial notice will include the information then available, and FlashTower will supplement it as information becomes available, including, to the extent known: the identification of each Individual whose Unsecured PHI has been, or is reasonably believed to have been, accessed, acquired, used, or disclosed; a description of what happened, including the date of the Breach and the date of Discovery; the types of Unsecured PHI involved; the steps FlashTower is taking to investigate, mitigate harm, and protect against further Breaches; and any other information Customer reasonably requests to meet its obligations under 45 CFR 164.404 through 164.410.

7.2 Other Uses and Disclosures. FlashTower will report to Customer any Use or Disclosure of PHI not provided for by this BAA of which it becomes aware, within the same period.

7.3 Security Incidents. FlashTower will report to Customer any successful Security Incident of which it becomes aware, within the same period. The parties agree that this section constitutes notice by FlashTower of the ongoing existence and occurrence of attempted but unsuccessful Security Incidents, for which no further notice is required. Unsuccessful Security Incidents include pings and other broadcast attacks on firewalls, port scans, unsuccessful sign-in attempts, denial-of-service attempts, and any combination of these, so long as none results in unauthorized access to, or Use or Disclosure of, ePHI.

7.4 Law-enforcement delay. If a law-enforcement official states that a notification would impede a criminal investigation or damage national security, FlashTower may delay notification as permitted by 45 CFR 164.412.

7.5 Notifications to Individuals. Customer is responsible for determining whether a Breach requires notice to Individuals, the Secretary, or the media, and for providing any such notice, unless the parties agree in writing that FlashTower will provide it on Customer's behalf and at Customer's direction. FlashTower will cooperate reasonably with Customer's investigation and notifications.

7.6 Notices under this section are sent to the security contact Customer designates in the Order Form or, if none, to Customer's account owners by email.

8. Individual rights

8.1 The Covered Services are security and governance tools; they are not designed to maintain a Designated Record Set. If FlashTower maintains PHI in a Designated Record Set on Customer's behalf, FlashTower will, within fifteen (15) business days of Customer's written request: (a) make that PHI available to Customer so Customer can meet its obligations under 45 CFR 164.524 (access); and (b) make amendments that Customer directs or agrees to under 45 CFR 164.526 (amendment).

8.2 FlashTower will document Disclosures of PHI and information related to them as would be required for Customer to respond to a request for an accounting of Disclosures under 45 CFR 164.528, and provide that information to Customer within fifteen (15) business days of Customer's written request.

8.3 If an Individual contacts FlashTower directly with a request under this section, FlashTower will forward the request to Customer within ten (10) business days and will not respond to the Individual except as Customer directs or as Required by Law.

9. Books and records

FlashTower will make its internal practices, books, and records relating to the Use and Disclosure of PHI received from, or created or received by FlashTower on behalf of, Customer available to the Secretary for purposes of determining Customer's compliance with the HIPAA Rules (45 CFR 164.504(e)(2)(ii)(I)). FlashTower will promptly notify Customer of any such request, unless prohibited by law.

10. Obligations of Customer

10.1 Customer will notify FlashTower of any limitation in its Notice of Privacy Practices, any change in or revocation of an Individual's permission, and any restriction on the Use or Disclosure of PHI that Customer has agreed to under 45 CFR 164.522, to the extent the limitation, change, or restriction may affect FlashTower's Use or Disclosure of PHI.

10.2 Customer will not request that FlashTower Use or Disclose PHI in any manner that would not be permissible under Subpart E of 45 CFR Part 164 if done by Customer.

10.3 Customer will submit PHI only to the Covered Services, only to the extent necessary for its purposes, and only from organizations covered by this BAA. Customer is responsible for its own users' accounts, for enabling multi-factor authentication for users who access PHI, for the roles it assigns, and for the capture, retention, and two-person settings it chooses in the Threat Evidence Vault.

11. Term and termination

11.1 This BAA takes effect on the date it is executed by both parties and remains in effect until all PHI is returned or destroyed under section 12, or until the Agreement terminates, whichever is later.

11.2 If either party determines that the other has violated a material term of this BAA, it may give written notice describing the violation. If the violation is not cured within thirty (30) days of that notice, the non-breaching party may terminate this BAA and the affected parts of the Agreement. If cure is not possible, the non-breaching party may terminate immediately.

11.3 Termination of this BAA ends Customer's permission to submit PHI to the Service; it does not by itself terminate the rest of the Agreement unless the terminating party so elects.

12. Return or destruction of PHI

12.1 On termination of this BAA, FlashTower will, at Customer's election made within thirty (30) days, return to Customer or destroy all PHI that FlashTower still maintains in any form, and will retain no copies, consistent with 45 CFR 164.504(e)(2)(ii)(J). Customer may export its data before termination through the Service and by request to FlashTower support.

12.2 Destruction includes deletion of the organization's data from the production database, destruction of Threat Evidence Vault payloads (which also revokes every forensic package containing them), and deletion of evidence files from storage. Data held in the rolling database backups of FlashTower's database provider ages out on the provider's backup cycle and is not restored except for disaster recovery; any PHI restored that way remains subject to this BAA.

12.3 If return or destruction is infeasible, including because PHI is subject to a legal hold or remains in backups until they expire, FlashTower will extend the protections of this BAA to that PHI and limit further Uses and Disclosures to the purposes that make return or destruction infeasible, for as long as FlashTower maintains it.

13. Relationship to other agreements; order of precedence

13.1 This BAA supplements and is part of the Agreement. In the event of a conflict between this BAA and any other part of the Agreement with respect to PHI, this BAA controls. In all other respects the Agreement controls, including its limitation of liability, to the extent permitted by law.

13.2 The Data Processing Addendum continues to apply to personal data that is not PHI, and to PHI to the extent it does not conflict with this BAA.

14. Miscellaneous

14.1 Regulatory references. A reference to a section of the HIPAA Rules means the section as in effect or as amended.

14.2 Amendment. The parties will negotiate in good faith to amend this BAA as necessary to comply with changes in the HIPAA Rules. Any other amendment must be in writing and signed by both parties.

14.3 Interpretation. Any ambiguity in this BAA will be resolved to permit compliance with the HIPAA Rules.

14.4 Survival. Sections 7, 9, 12, and 13 survive termination of this BAA.

14.5 No third-party beneficiaries. Nothing in this BAA confers any rights or remedies on any person other than the parties and their permitted successors and assigns.

14.6 Versions. FlashTower publishes the current version of this BAA at /legal/baa with its effective date. An executed BAA continues on the version the parties signed until both parties sign a later version.

15. Contact

Notices under this BAA to FlashTower are sent to security@flashtower.com (Security Incidents and Breaches) and privacy@flashtower.com (all other notices), with a copy by mail to Boostlete LLC, Attn: Legal, 1620 N Carpenter Rd, Suite D46, Modesto, CA 95351.