BUSINESS ASSOCIATE AGREEMENT

This Business Associate Agreement (hereinafter referred to as the “Agreement”) is made and entered into on this 24th March, 2026, by and between:

RECITALS

• WHEREAS, the Covered Entity is a healthcare provider, health plan, or healthcare clearinghouse subject to the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and its implementing regulations;
• WHEREAS, the Business Associate provides certain services to the Covered Entity that involve the use or disclosure of Protected Health Information (PHI);
• WHEREAS, the Parties wish to comply with the requirements of HIPAA and establish the terms and conditions under which the Business Associate will handle PHI on behalf of the Covered Entity;

1. DEFINITIONS

2. OBLIGATIONS OF BUSINESS ASSOCIATE

• 2.1 Use and Disclosure of PHI: The Business Associate agrees to use and disclose PHI only as permitted or required by this Agreement or as required by law. The Business Associate shall not use or disclose PHI in any manner that would violate HIPAA if done by the Covered Entity.
• 2.2 Safeguards: The Business Associate shall implement appropriate administrative, physical, and technical safeguards to protect the confidentiality, integrity, and availability of PHI, in accordance with HIPAA regulations.
• 2.3 Reporting: The Business Associate shall report to the Covered Entity any use or disclosure of PHI not provided for by this Agreement within 24 hours of becoming aware of such use or disclosure.
• 2.4 Mitigation: The Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known of a use or disclosure of PHI in violation of this Agreement.
• 2.5 Subcontractors: The Business Associate shall ensure that any subcontractors or agents to whom it provides PHI agree to the same restrictions and conditions that apply to the Business Associate.

3. OBLIGATIONS OF COVERED ENTITY

• 3.1 Permissible Disclosures: The Covered Entity shall provide the Business Associate with the PHI necessary for the Business Associate to perform its Services.
• 3.2 Notice of Privacy Practices: The Covered Entity shall provide the Business Associate with a copy of its Notice of Privacy Practices, as required by HIPAA.
• 3.3 Limitations on Use of PHI: The Covered Entity shall not request the Business Associate to use or disclose PHI in any manner that would not be permissible under HIPAA if done by the Covered Entity.

4. ACCESS TO PHI

• 4.1 Access by the Covered Entity: The Business Associate shall make PHI available to the Covered Entity as necessary to satisfy the Covered Entity’s obligations under HIPAA.
• 4.2 Amendments to PHI: The Business Associate shall make any amendments to PHI that the Covered Entity directs or agrees to.
• 4.3 Accounting of Disclosures: The Business Associate shall document disclosures of PHI and make such documentation available to the Covered Entity for accounting purposes.

5. TERMINATION

• 5.1 Termination for Cause: The Covered Entity may terminate this Agreement immediately if it determines that the Business Associate has violated a material term of this Agreement.
• 5.2 Termination for Convenience: Either Party may terminate this Agreement for any reason by providing 14 days written notice to the other Party.
• 5.3 Effect of Termination: Upon termination, the Business Associate shall return or destroy all PHI received from or created on behalf of the Covered Entity.

6. INDEMNIFICATION

The Business Associate shall indemnify and hold the Covered Entity harmless from any claims, damages, or liabilities arising from the Business Associate’s failure to comply with this Agreement or HIPAA regulations. Similarly, the Covered Entity shall indemnify the Business Associate for breaches of HIPAA by the Covered Entity.

7. CONFIDENTIALITY

Each Party agrees to protect the confidentiality of such Confidential Information using the same degree of care that it uses to protect its own confidential information, but in no event less than a reasonable standard of care.

8. MISCELLANEOUS PROVISIONS

• 8.1 Governing Law: This Agreement shall be governed by the laws of the State of Delaware and Nigeria.
• 8.2 Entire Agreement: This Agreement constitutes the entire agreement between the Parties regarding the subject matter.
• 8.3 Amendments: Any amendments must be made in writing and signed by both Parties.
• 8.4 Severability: If any provision is found invalid, the remaining provisions remain in effect.

Signatures