Business Associate Agreement (BAA)

This Business Associate Agreement (“Agreement”) is between Maestro Nutrition LLC, a North Carolina limited liability company (“Maestro”), and the practice or individual that subscribes to the Maestro Nutrition service (“Practice”). It is part of, and incorporated into, the Maestro Nutrition Terms of Use (the “Terms”).

Practice uses Maestro’s software to collect and analyze information about its patients, who may also be called clients. In doing so, Maestro creates, receives, maintains or transmits protected health information on Practice’s behalf. This Agreement sets out how Maestro will protect that information, as required by the Health Insurance Portability and Accountability Act of 1996 and its regulations (“HIPAA”).

Electronic acceptance. Practice accepts this Agreement electronically when subscribing to the Service. The person accepting represents that they are authorized to bind Practice. Acceptance by Practice’s owner, an employee or another authorized person binds Practice. Maestro will send confirmation of acceptance to the Account Owner’s email address.

Practices that are not covered entities. Some practices may not be “covered entities” under HIPAA. Maestro will nonetheless handle all patient information in the Service as PHI under this Agreement. This Agreement does not by itself make Practice a covered entity.

1. Definitions

Capitalized terms used but not defined here have the meanings given in HIPAA, at 45 CFR Parts 160 and 164, or in the Terms.

1. “Breach” has the meaning in 45 CFR 164.402.
2. “Individual” means the person who is the subject of PHI, including a patient or client of Practice.
3. “Protected Health Information” or “PHI” has the meaning in 45 CFR 160.103, limited to information Maestro creates, receives, maintains or transmits on behalf of Practice through the Service. It includes electronic PHI.
4. “Security Incident” has the meaning in 45 CFR 164.304.
5. “Service” means the Maestro Nutrition software, including the practitioner application and the Patient Portal.
6. “Subcontractor” means a person or company to which Maestro delegates a function involving PHI, such as hosting or software development.
7. “Unsecured PHI” has the meaning in 45 CFR 164.402.
8. “Secretary” means the Secretary of the U.S. Department of Health and Human Services or their designee.

2. Permitted Uses and Disclosures of PHI

1. To provide the Service. Maestro may use and disclose PHI only as needed to provide, maintain, secure and support the Service for Practice under the Terms, and as this Agreement or the law requires.
2. Management and administration. Maestro may use PHI for its proper management and administration or to carry out its legal responsibilities. Maestro may disclose PHI for those purposes only if the disclosure is required by law, or Maestro obtains reasonable assurances that the recipient will keep the PHI confidential, use or further disclose it only as required by law or for the purpose for which it was disclosed, and notify Maestro of any breach of its confidentiality.
3. Minimum necessary. Maestro will limit its uses, disclosures and requests of PHI to the minimum necessary to accomplish the intended purpose.
4. De-identified data. Maestro may de-identify PHI in accordance with 45 CFR 164.514(a)–(c) and use de-identified data to operate and improve the Service and to produce aggregate statistics. De-identified data is not PHI.
5. Prohibited uses. Maestro will not sell PHI, use it for marketing, or use or disclose it in any way that would violate HIPAA if done by Practice.
6. No contact with Individuals. Maestro does not communicate with Individuals about their care or their information. Automated messages the Service sends to Individuals at Practice’s direction, such as survey invitations and report notices, are sent on Practice’s behalf.

3. Maestro’s Obligations

1. Maestro will use appropriate administrative, physical and technical safeguards to prevent use or disclosure of PHI other than as this Agreement permits. For electronic PHI, Maestro will comply with the HIPAA Security Rule (45 CFR Part 164, Subpart C).
2. Maestro will report to Practice:
   1. any use or disclosure of PHI not permitted by this Agreement that Maestro becomes aware of;
   2. any Security Incident Maestro becomes aware of; and
   3. any Breach of Unsecured PHI, as required by 45 CFR 164.410.

Maestro will make these reports without unreasonable delay and no later than 30 business days after discovery. A Breach report will include, to the extent known, the Individuals affected and the other information Practice needs to meet its own notification duties. Maestro will supplement the report as more information becomes available. Maestro does not notify Individuals directly unless Practice and Maestro agree in writing that it will.

3. Unsuccessful attempts. This section is notice to Practice of the ongoing existence of unsuccessful Security Incidents, for which no further report is required. These include pings, port scans, blocked log-in attempts, denial-of-service attempts and similar events that do not result in unauthorized access to, or use or disclosure of, PHI.
4. Maestro will take reasonable steps to mitigate any harmful effect, known to Maestro, of a use or disclosure of PHI by Maestro in violation of this Agreement.
5. Maestro will ensure that any Subcontractor that creates, receives, maintains or transmits PHI on Maestro’s behalf agrees in writing to the same restrictions, conditions and requirements that apply to Maestro under this Agreement, as required by 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2).
6. Practitioners can view PHI and download PDF reports directly in the Service. If Practice needs Maestro’s help to respond to an Individual’s request for access under 45 CFR 164.524, Maestro will make the requested PHI available to Practice within 30 days of Practice’s request.
7. Practice can correct or update PHI directly in the Service. If Practice needs Maestro’s help to make an amendment under 45 CFR 164.526, Maestro will assist within 30 days of Practice’s request.
8. Accounting of disclosures. Maestro will document disclosures of PHI, and provide that information to Practice within 30 days of request, as needed for Practice to respond to a request for an accounting under 45 CFR 164.528.
9. Requests from Individuals. If an Individual contacts Maestro to request access to, amendment of, or an accounting of their PHI, or for any other reason, Maestro will not respond to the Individual. Maestro will forward the request to Practice within 10 business days.
10. Practice’s obligations. To the extent Maestro carries out any of Practice’s obligations under the HIPAA Privacy Rule, Maestro will comply with the requirements of that Rule that apply to Practice in performing them.
11. Records available to HHS. Maestro will make its internal practices, books and records relating to PHI available to the Secretary for purposes of determining compliance with HIPAA.

4. Practice’s Obligations

1. Notice of privacy practices. Practice will notify Maestro of any limitation in its notice of privacy practices that may affect Maestro’s use or disclosure of PHI.
2. Changes in permission. Practice will notify Maestro of any change in, or revocation of, an Individual’s permission to use or disclose PHI, to the extent it may affect Maestro.
3. Practice will notify Maestro of any restriction on the use or disclosure of PHI that Practice has agreed to under 45 CFR 164.522, to the extent it may affect Maestro.
4. Permissible requests. Practice will not ask Maestro to use or disclose PHI in any way that would not be permitted under HIPAA if done by Practice.
5. Consents and authorizations. Practice is responsible for obtaining any notices, consents and authorizations required by law before entering an Individual’s information into the Service or inviting them to the Patient Portal.
6. Users and access. Practice is responsible for its users’ access, credentials and compliance with this Agreement and the Terms, including granting only the access each user needs and removing access promptly when a user leaves.
7. Own records. The Service is not Practice’s system of record. Practice is responsible for downloading and keeping copies of its patient reports and for meeting any record-retention obligations that apply to it.

5. Term and Termination

1. This Agreement takes effect when Practice accepts it and remains in effect for as long as Maestro holds PHI on Practice’s behalf.
2. Cancellation is not termination. Canceling or pausing a subscription does not end this Agreement. While a subscription is canceled, Maestro continues to store and protect Practice’s PHI under this Agreement so Practice can return to it if it reactivates.
3. When this Agreement ends. This Agreement ends when all of Practice’s PHI has been destroyed under Section 5.5, which happens when:
   1. Practice requests deletion of its data through the contact form on Maestro’s website;
   2. the account has been canceled and inactive for 2 years, Maestro has sent notice to the Account Owner’s email address, and the account is not reactivated within 30 days of that notice; or
   3. either party terminates for cause under Section 5.4.
4. Termination for cause. If either party determines that the other has violated a material term of this Agreement, it may give written notice of the violation. If the violation is not cured within 30 days of notice, the non-breaching party may terminate this Agreement and the Terms. If cure is not possible, the non-breaching party may terminate immediately.
5. Return or destruction of PHI. During the subscription, Practice can download its patient reports as PDFs at any time, and these serve as the return of PHI to Practice. The Service does not provide a bulk export. When this Agreement ends, Maestro will destroy all PHI it holds on Practice’s behalf and will require its Subcontractors to do the same. Maestro will retain no copies, except as follows:
   1. PHI in backup systems will be overwritten or destroyed in the normal backup cycle, within 60 days; and
   2. where destruction is not feasible, or law requires Maestro to keep PHI, Maestro will extend the protections of this Agreement to that PHI and limit further uses and disclosures to the purposes that make destruction infeasible, for as long as Maestro keeps it.
6. Maestro’s obligations under Section 5.5 survive termination of this Agreement.

6. General

1. Regulatory references. A reference in this Agreement to a section of HIPAA means that section as in effect or as amended.
2. The parties will amend this Agreement as needed to comply with changes in HIPAA. Maestro may update this Agreement by posting a new version at https://maestronutrition.com/baa and giving notice as described in the Terms. Changes required by law may take effect on the date the law requires.
3. Any ambiguity in this Agreement will be resolved in favor of a meaning that permits compliance with HIPAA.
4. If this Agreement conflicts with the Terms on the handling of PHI, this Agreement controls. In all other respects, the Terms govern, including the limitation of liability and dispute resolution provisions. Liability under this Agreement is subject to the limitation of liability in Section 12 of the Terms.
5. No third-party beneficiaries. Nothing in this Agreement gives any right or remedy to anyone other than Maestro and Practice, including Individuals.
6. Governing law. This Agreement is governed by HIPAA and, to the extent not preempted, by the laws of the State of North Carolina.

Notices. Practice may give notice to Maestro through the contact form on Maestro’s website. Maestro will give notice to Practice at the Account Owner’s email