Business Associate Agreement

Last updated: September 29, 2026

This Business Associate Agreement ("BAA") is between Ventus Media Group LLC ("Business Associate", "we", "us") and any customer of the Virtual Receptionist service that is a covered entity under HIPAA, such as a dental, medical, imaging or other healthcare practice ("Covered Entity", "you").

How this agreement takes effect. This BAA is part of our Terms of Service. If you are a Covered Entity, it takes effect automatically, with no separate signature, when you agree to the Terms of Service at checkout. It stays in effect as long as we provide the service to you. If your practice needs a signed copy, email us and we'll countersign one.

1. Definitions

Terms used in this BAA that are not defined here, such as "Breach", "Protected Health Information" ("PHI"), "Required by Law", "Secretary", "Security Incident", "Subcontractor" and "Unsecured PHI", have the same meaning as in the HIPAA Privacy, Security, Breach Notification and Enforcement Rules at 45 CFR Parts 160 and 164 ("HIPAA Rules"). PHI in this BAA means only the PHI we create, receive, maintain or transmit on your behalf.

2. Our obligations

We will:

• Not use or disclose PHI other than as permitted or required by this BAA or as Required by Law.
• Use appropriate administrative, physical and technical safeguards, and comply with Subpart C of 45 CFR Part 164 for electronic PHI, to prevent use or disclosure of PHI other than as this BAA allows.
• Report to you any use or disclosure of PHI not allowed by this BAA that we become aware of, including Breaches of Unsecured PHI as required by 45 CFR 164.410, and any Security Incident. Reports of Breaches will be made without unreasonable delay and no later than 30 days after discovery. This paragraph serves as notice of unsuccessful Security Incidents (such as pings, port scans and blocked login attempts) that do not result in unauthorized access, for which no further report is required.
• Make sure any Subcontractors that create, receive, maintain or transmit PHI on our behalf, such as our voice platform provider, agree in writing to the same restrictions, conditions and requirements that apply to us, in line with 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2).
• Make PHI in a designated record set available to you within 15 business days of your request, so you can meet your obligations under 45 CFR 164.524.
• Make any amendment to PHI in a designated record set that you direct, within 15 business days of your request, in line with 45 CFR 164.526.
• Keep and make available to you, within 15 business days of your request, the information needed for you to provide an accounting of disclosures under 45 CFR 164.528.
• To the extent we carry out any of your obligations under Subpart E of 45 CFR Part 164, comply with the requirements of Subpart E that apply to you in performing those obligations.
• Make our internal practices, books and records available to the Secretary for purposes of determining compliance with the HIPAA Rules.

3. Permitted uses and disclosures

• We may use and disclose PHI only as needed to provide the Virtual Receptionist service to you as described in the Terms of Service: answering calls, booking and managing appointments, transferring calls, and sending you call summaries and reports.
• We may use or disclose PHI as Required by Law.
• We will limit our uses, disclosures and requests of PHI to the minimum necessary, consistent with your minimum necessary policies.
• We will not use or disclose PHI in any way that would violate Subpart E of 45 CFR Part 164 if done by you, except as allowed below.
• We may use PHI for the proper management and administration of our business or to carry out our legal responsibilities. We may disclose PHI for these purposes only if Required by Law, or if we get reasonable assurances from the recipient that it will be kept confidential and used or further disclosed only as Required by Law or for the purpose it was disclosed, and that the recipient will tell us of any instances in which confidentiality has been breached.
• We will not sell PHI or use it for marketing.

4. Your obligations

• Tell us of any limitation in your notice of privacy practices, any change or revocation of a patient's permission, and any restriction you have agreed to, to the extent it may affect our use or disclosure of PHI.
• Not ask us to use or disclose PHI in any way that would not be permitted under Subpart E of 45 CFR Part 164 if done by you.
• Tell us before launch that you are a Covered Entity, so we can configure your receptionist for PHI (limited data storage, automatic deletion and restricted access to recordings).

5. Term and termination

• Term. This BAA starts when you agree to the Terms of Service and ends when the service ends, or when you terminate it under this section, whichever comes first.
• Termination for cause. If you determine that we have violated a material term of this BAA, you may give us written notice and 30 days to cure the violation. If we do not cure it, you may terminate this BAA and the service.
• When this BAA ends. We will return to you or destroy all PHI we still hold in any form, and keep no copies. If returning or destroying PHI is not feasible, we will extend the protections of this BAA to that PHI and limit further uses and disclosures to the purposes that make return or destruction infeasible, for as long as we hold it.
• Survival. Our obligations under this section survive the end of this BAA.

6. General

• A reference in this BAA to a section of the HIPAA Rules means that section as in effect or as amended.
• We may amend this BAA as needed to comply with changes to the HIPAA Rules. We will post the updated version on this page.
• Any ambiguity in this BAA will be resolved to permit compliance with the HIPAA Rules.
• If this BAA conflicts with the Terms of Service, this BAA controls for PHI.
• Nothing in this BAA gives any rights to anyone other than you and us.

Contact

Questions about this agreement, or need a countersigned copy? Email samson@ventusmediagroup.com.