1 Parties and acceptance
This Business Associate Agreement (BAA) is between Mahla LLC, a limited liability company based in Texas, doing business as Mahla (Mahla), and the customer identified in the applicable order form, electronic acceptance record, or signature block below (Customer). It governs the health information Mahla handles for Customer through Mahla’s electronic medical record platform and related services that Customer selects (Services).
This BAA becomes effective when both parties sign it or when Customer’s authorized representative affirmatively accepts it through a Mahla order form or electronic acceptance process that identifies this BAA (Effective Date). The representative accepting for Customer represents that the representative has authority to bind Customer. The parties must complete acceptance before Mahla receives Protected Health Information for Customer. Merely visiting Mahla’s public website does not execute this BAA.
Customer may be a HIPAA covered entity or a business associate acting for a covered entity. Mahla acts as Customer’s business associate or, where applicable, business associate subcontractor. If Customer is itself a business associate, references to Customer’s obligations and individual rights include the obligations Customer must support for its upstream covered entity. Customer must have authority under its upstream agreements to engage Mahla.
This BAA supplements the parties’ agreement for the Services, including any accepted order form (Services Agreement). It applies to free and paid Services that involve Protected Health Information and does not independently authorize use of a feature that Customer has not selected.
2 Definitions
2.1 Applicable rules. HIPAA means the Health Insurance Portability and Accountability Act of 1996, as amended by the Health Information Technology for Economic and Clinical Health Act, and its implementing regulations. HIPAA Rules means the Privacy, Security, Breach Notification, and Enforcement Rules in 45 C.F.R. Parts 160 and 164, as amended and applicable. Part 2 means 42 U.S.C. § 290dd-2 and 42 C.F.R. Part 2, as amended and applicable.
2.2 Protected information. Protected Health Information or PHI has the meaning in 45 C.F.R. § 160.103, limited here to PHI Mahla creates, receives, maintains, or transmits on Customer’s behalf. Electronic PHI or ePHI is PHI in electronic form. Part 2 Records are records subject to Part 2 that Mahla handles for Customer. Section 8 applies to Part 2 Records even if a particular record is not PHI.
2.3 Other terms. Breach, Designated Record Set, Disclosure, Health Care Operations, Individual, Required By Law, Secretary, Security Incident, Subcontractor, Unsecured Protected Health Information, and Use have their meanings under the HIPAA Rules. Business Day means a weekday other than a United States federal holiday. Other references to days mean calendar days.
3 Permitted uses and disclosures
3.1 Services for Customer. Mahla may use and disclose PHI only to perform the Services for Customer as permitted by this BAA and Customer’s lawful instructions, or as Required By Law. Selected Services may include record hosting and migration; scheduling and reminders; intake; telephone, text, and chat assistance; documentation and treatment-plan drafts; eligibility, claims, billing, and payment workflows; and support and security necessary to operate those Services. Feature availability is determined by the Services Agreement. Instructions may be given through authorized account settings, including settings permitting an assistant to act automatically within defined limits.
3.2 Limits on authority. Except for the management, administration, and data aggregation uses expressly permitted below, Mahla shall not use or disclose PHI in a manner that would violate the HIPAA Privacy Rule if done by Customer or its upstream covered entity. Mahla shall limit uses, disclosures, and requests to the minimum necessary where required by the HIPAA Rules, and shall follow Customer’s minimum-necessary policies communicated to Mahla to the extent applicable to the Services. A general instruction to improve the Services does not authorize an independent use of PHI.
3.3 AI processing. Mahla may process PHI through artificial intelligence systems to carry out Customer’s selected workflows, including using relevant patient and practice context to produce responses or draft records for Customer. Mahla shall not use PHI, or permit a vendor to use PHI, to train or fine-tune a general-purpose model or a model shared across customers. Mahla shall not train or fine-tune even a Customer-specific model on PHI without a separate written agreement identifying the permitted processing and necessary legal authority. Processing an input to generate an output, or retrieving authorized context for that task, does not by itself authorize model training. Prompts, recordings, transcripts, outputs, embeddings, and logs containing PHI remain subject to this BAA.
3.4 Prohibited secondary uses. Mahla shall not sell PHI, use it for Mahla’s advertising or targeted advertising, disclose it for another person’s independent commercial purposes, or use it for independent research. Communications performed for Customer must remain within Customer’s lawful care or administrative workflows; this BAA is not an individual’s marketing authorization. Mahla shall not combine identifiable patient information across unrelated customers for independent profiling.
3.5 Internal administration and legal duties. Mahla may use PHI as necessary for its proper management and administration or to fulfill its legal responsibilities. It may disclose PHI for those purposes only if Required By Law or if the recipient gives reasonable assurances that it will keep the information confidential, use and further disclose it only for the stated purpose or as Required By Law, and notify Mahla of any breach of confidentiality of which it becomes aware. These permissions do not override Sections 3.3, 3.4, or 8.
3.6 Data aggregation and de-identification. Mahla may provide data aggregation services relating to Customer’s Health Care Operations only when included in the Services Customer requests. Mahla may de-identify PHI under an expert determination or the safe-harbor method in 45 C.F.R. § 164.514(b), and use the resulting information for internal service performance analysis, security, and product evaluation. Removing names alone does not establish de-identification. Mahla shall maintain the information in de-identified form, shall not attempt re-identification, and shall impose the same restrictions on recipients. It shall not sell that information, use it for advertising, disclose it publicly in a manner identifying Customer, or use it for model training or fine-tuning without a separate written amendment. Part 2 Records, psychotherapy notes, and SUD counseling notes may not be used under this subsection without Customer’s specific written instructions and a lawful basis under the applicable heightened protections.
4 Safeguards and subcontractors
4.1 Security program. Mahla shall implement appropriate administrative, physical, and technical safeguards against uses and disclosures not permitted by this BAA and shall comply with Subpart C of 45 C.F.R. Part 164 for ePHI. Its program shall include risk analysis and risk management, workforce authorization and training, access controls, audit logging, incident response, contingency planning, and secure disposal, as required by the HIPAA Rules. Mahla shall protect ePHI in transit and at rest through encryption or documented equivalent alternative measures where the applicable rule permits them. These obligations are not a representation of any particular third-party certification.
4.2 Workforce and access. Mahla shall restrict access to PHI to persons who need it to perform authorized duties and are subject to appropriate confidentiality obligations. Support and troubleshooting access must be limited to an authorized purpose. Mahla shall maintain controls designed to separate customers’ records and prevent disclosure through AI responses, logs, or integrations to unauthorized persons.
4.3 Subcontractors. Before a Subcontractor creates, receives, maintains, or transmits PHI for Mahla, Mahla shall obtain a written agreement imposing the same applicable restrictions, conditions, and requirements as this BAA, including compliance with the HIPAA Security Rule for ePHI. This includes applicable hosting, AI, transcription, communications, and support vendors. Mahla shall obtain corresponding downstream protections and address known material violations as required by 45 C.F.R. §§ 164.502(e) and 164.504(e). Delegation does not relieve Mahla of its obligations hereunder. Upon reasonable request, Mahla shall identify its PHI-processing Subcontractors and their functions.
4.4 Compliance cooperation. Mahla shall make its internal practices, books, and records concerning the use and disclosure of PHI available to the Secretary for determining compliance with the HIPAA Rules. On Customer’s reasonable request, Mahla shall provide information reasonably necessary to assess compliance with this BAA, subject to safeguards for other customers’ information and security-sensitive material. Those safeguards shall not limit access required by the Secretary.
5 Incidents and breach reporting
5.1 Reporting deadline. Mahla shall notify Customer in writing without unreasonable delay and in any event within five calendar days after discovery of a use or disclosure of PHI not permitted by this BAA, a Breach of Unsecured Protected Health Information, or a Security Incident involving Customer’s ePHI, except the unsuccessful attempts addressed in Section 5.3. For Breaches, discovery has the meaning in 45 C.F.R. § 164.410(a)(2), including knowledge attributable to employees, officers, and other agents under that provision. The five-day period is an outside contractual limit, not permission to delay a report. Mahla shall not await a completed investigation or final breach determination before reporting known facts. Any shorter legal deadline controls; delay permitted by 45 C.F.R. § 164.412 remains available only to the extent lawful.
5.2 Content and response. The initial notice shall contain the information then reasonably available, including the incident and discovery dates; nature of the event; categories of information involved; affected or reasonably believed affected Individuals; containment and mitigation measures; and a contact for follow-up. Mahla shall promptly supplement the notice as information becomes available, including the information needed for Customer’s notices under 45 C.F.R. § 164.404(c). Mahla shall investigate, preserve relevant evidence, mitigate harmful effects known to it to the extent practicable, and take reasonable corrective action. It shall cooperate with Customer’s assessment, response, and legally required notifications.
5.3 Routine unsuccessful attempts. Mahla gives continuing notice that its systems may experience routine unsuccessful attempts, such as blocked port scans, failed logins, and unsuccessful malware attempts. No separate notice is required for those attempts only if they do not result in unauthorized access, use, disclosure, modification, or destruction of PHI or interference with system operations. Mahla shall provide reasonably available summary information on request. Actual compromise or disruption is not excluded by this subsection.
5.4 Notifications and contacts. Customer is responsible for notices to Individuals, regulators, and the media required of Customer, unless applicable law assigns a duty directly to Mahla or the parties expressly agree otherwise. Neither party may delay a legally required notice to obtain the other party’s approval. Reports to Customer shall go to its designated privacy or security contact, with its administrative account contact as a fallback. Customer shall report security concerns to [email protected]. The parties shall use a secure channel for PHI contained in incident details. This section does not allocate indemnity or incident-response costs beyond any express terms of the Services Agreement.
6 Individual rights and delegated duties
6.1 Access and amendments. Mahla shall make PHI in a Designated Record Set available to Customer as necessary for Customer to satisfy 45 C.F.R. § 164.524, in the requested form and format if readily producible or another lawful format agreed with Customer. It shall amend PHI as directed or agreed by Customer, or take other measures necessary to support Customer’s obligations under 45 C.F.R. § 164.526.
6.2 Accounting. Mahla shall document disclosures and make the information required for an accounting available to Customer under 45 C.F.R. § 164.528, including records covering the applicable accounting period. It shall preserve required compliance documentation for the period required by law.
6.3 Timing and direct requests. Mahla shall provide assistance under this section within ten Business Days after Customer’s request, or sooner when reasonably necessary to meet a legal deadline identified by Customer. If an Individual directs a request to Mahla, Mahla shall forward it to Customer within five Business Days and shall not independently deny it or alter the record unless authorized by Customer or required by law. Customer decides the response as the responsible entity, without limiting any duty imposed directly on Mahla.
6.4 Delegated Privacy Rule functions. To the extent Mahla performs a Customer obligation under Subpart E of 45 C.F.R. Part 164, Mahla shall comply with the requirements that apply to Customer in performing that obligation.
7 Customer responsibilities
7.1 Lawful instructions. Customer shall provide only information it is authorized to disclose for the selected Services and shall not request an impermissible use or disclosure. Customer shall give Mahla notice of restrictions in its Notice of Privacy Practices, changes or revocations of an Individual’s permission, and agreed or mandatory restrictions under 45 C.F.R. § 164.522, to the extent they affect Mahla’s processing. The parties shall promptly address an instruction that cannot lawfully be performed.
7.2 Notices and consent. Customer is responsible for notices, consents, and authorizations legally required for its selected workflows, including recording or transcription, automated calls and texts, and specially protected records. Mahla remains responsible for obligations imposed directly on it. Neither account acceptance nor this BAA substitutes for a patient’s consent or authorization when one is required. Customer shall configure communication preferences and destinations to reflect the permissions and restrictions applicable to each patient.
7.3 Clinical control. Customer controls its users, assistant permissions, recipients, and integrations, and shall use appropriate account and device safeguards. Customer’s clinicians remain responsible for clinical judgment and review and approval of draft clinical documentation. Mahla’s administrative assistants do not provide therapy or replace clinical oversight. Customer shall establish appropriate human escalation procedures for patient communications. This allocation does not excuse Mahla’s duties under this BAA.
8 Substance use disorder and specially protected records
8.1 Part 2 compliance. Mahla shall handle Part 2 Records in compliance with applicable Part 2 requirements. Customer shall identify its Part 2 status, records, consents, and restrictions using the agreed workflow. The parties shall establish the applicable disclosure authority and instructions before enabling a workflow requiring them. Failure to label a record does not remove protections otherwise known to apply. A general permission in this BAA does not override Part 2 or more protective applicable state law.
8.2 Qualified service organization. When Customer is a Part 2 program and Mahla receives records to provide data processing, billing, or other qualified service organization services to that program, this BAA also serves as their qualified service organization agreement. Mahla acknowledges that, in receiving, storing, processing, or otherwise dealing with those records, it is fully bound by Part 2 and, if necessary, shall resist in judicial proceedings efforts to obtain patient-identifying information concerning SUD diagnosis, treatment, or referral except as Part 2 permits. This provision is limited to the services and disclosure pathway legally available to the parties; it does not create blanket authority to disclose records to other providers or for independent purposes.
8.3 Consent and redisclosure. When relying on patient consent, Mahla shall process Part 2 Records only within the scope of valid consent and applicable law, honor effective revocations as required, and include the notice and copy of consent or clear explanation of its scope required by 42 C.F.R. § 2.32 with applicable disclosures. A qualifying treatment, payment, and health care operations consent may permit HIPAA-based redisclosures under 42 C.F.R. § 2.33, subject to the restrictions that remain applicable. Subcontractor access must follow a lawful Part 2 pathway and carry the corresponding written confidentiality obligations.
8.4 Proceedings and separate notes. Mahla shall not use or disclose Part 2 Records in civil, criminal, administrative, or legislative proceedings against a patient except pursuant to consent specific to that use or disclosure or a qualifying Part 2 court order and any additional process required by law. An ordinary subpoena or general treatment consent is not sufficient by itself. Psychotherapy notes under HIPAA and SUD counseling notes under Part 2 require the separate protections applicable to those categories; ordinary progress notes are not automatically included. Customer shall not submit those specially protected notes to a general documentation or AI workflow unless the parties have confirmed a lawful basis and suitable controls.
8.5 Requests and incidents. To the extent legally permitted, Mahla shall promptly notify Customer of a demand for specially protected records and cooperate in applying required restrictions. The safeguards, reporting, assistance, and disposition requirements of this BAA also apply to Part 2 Records, together with additional applicable Part 2 duties and compliance dates. Mahla shall support Customer’s applicable patient-rights duties; this clause does not accelerate a statutory requirement whose compliance date has not yet arrived.
9 Term and disposition of records
9.1 Term and cause. This BAA continues while Mahla handles PHI or Part 2 Records for Customer. Customer may terminate the BAA and affected Services for a material violation by Mahla if Mahla fails to cure or end it within 30 days after written notice, or sooner if needed to comply with law. Customer may terminate immediately if cure is not possible. Mahla may suspend affected processing to prevent an unlawful use or material security threat and shall cooperate in lawful continuity and record transfer. Expiration of the Services Agreement does not end protection of retained records.
9.2 Return and destruction. Upon termination, Customer may elect return or destruction of the PHI and Part 2 Records Mahla maintains for it. Mahla shall provide a reasonable opportunity to obtain an export and, if return is elected, complete return in a reasonably usable agreed format within 30 days. Unless Customer lawfully directs otherwise, Mahla shall destroy remaining active copies within 60 days after termination, after completing the requested return, and backup copies within 90 days after termination. This duty includes copies held by Subcontractors. Mahla shall not withhold an export or legally required access because of a payment dispute. It shall confirm completion in writing on request.
9.3 Infeasible destruction or required retention. If return or destruction of particular records is infeasible or prohibited by law, Mahla shall notify Customer of the affected categories, reason, and expected retention period; retain only the records needed for that reason; extend this BAA’s protections for as long as they are retained; and limit further use and disclosure to the purposes making return or destruction infeasible or legally prohibited. Isolated backups shall remain protected, shall not be used for ordinary operations, and shall be deleted on the applicable cycle; if restored for recovery, the deletion instructions shall be reapplied. Mahla shall destroy retained records when the reason for retention ends. A general preference to keep data or develop products does not establish infeasibility. These duties survive termination.
10 General terms
10.1 Priority and changes. This BAA controls any conflict concerning PHI or Part 2 Records with the Services Agreement, an order form, or a privacy policy. Neither a website policy change nor an expanded data license amends it. An amendment requires the parties’ affirmative written or electronic agreement. They shall cooperate in adopting changes necessary to comply with applicable law; until then, mandatory legal requirements control. Ambiguities shall be resolved to permit compliance with the HIPAA Rules and applicable Part 2 requirements.
10.2 Commercial terms. The Services Agreement governs commercial matters not addressed here, including any express allocation of liability, indemnity, governing law, and dispute resolution. No such term relieves either party of its obligations to Individuals or regulators, prevents required reporting or record access, or authorizes prohibited processing. This BAA grants Mahla no ownership of patient records and creates no third-party beneficiary rights except as required by law.
10.3 Notices and execution. Ordinary contractual notices may be sent to the notice contacts in the Services Agreement or signature block; incident notices follow Section 5.4. Each party shall keep its contacts current. The parties may execute this BAA in counterparts and by electronic signature or the affirmative electronic acceptance described in Section 1. An electronic acceptance record must identify Customer, its representative, the accepted version, and the date. The following signature block is available for separately signed agreements.
Mahla
Legal entity: Mahla LLC
By: ______________________________ Date: __________________
Name and title: _____________________________________________
Notice address: 1204 San Antonio Street, 2nd floor, Austin, Texas 78701
Privacy contact: [email protected] Security contact: [email protected]
Customer
Legal entity: _______________________________________________
By: ______________________________ Date: __________________
Name and title: _____________________________________________
Notice address: _____________________________________________
Privacy or security contact name and email: ______________________
Customer role: Pending confirmation: [Covered entity / Business associate]