1. Parties and relationship

Effective date: October 10, 2026.

This Business Associate Agreement ("BAA") is between the customer organization identified in the registration or signed service order ("Customer") and Reliable Betel Corp. ("Provider"). It supplements the Care Staff Manager Terms of Service and applicable order (the "Service Agreement").

Where Customer is a Covered Entity and Provider creates, receives, maintains, or transmits PHI on its behalf, Provider acts as its Business Associate. Where Customer is itself a Business Associate, Provider acts as its subcontractor Business Associate. In that case, references to Customer's Covered Entity duties concern Customer's applicable duties and upstream Covered Entity instructions; nothing gives Customer authority it does not possess.

Provider offers this BAA as part of the Service Agreement. Customer accepts through its authorized representative's affirmative acceptance of the identified version or through both parties' execution of a written agreement incorporating it. It applies when processing falls within the relationship above. Customer must identify that relationship before PHI processing. Acceptance by an organization outside that relationship does not establish Covered Entity status or authorize otherwise unlawful processing.

2. Definitions and priority

"HIPAA Rules" means the applicable Privacy, Security, Breach Notification, and Enforcement Rules in 45 CFR Parts 160 and 164, as amended. "PHI," "Electronic PHI," "Breach," "Unsecured PHI," "Security Incident," "Designated Record Set," "Required by Law," and "Secretary" have their applicable meanings under those Rules. PHI here means PHI handled by Provider on behalf of Customer.

Mandatory law controls. This BAA controls over conflicting Service Agreement or Privacy Policy terms concerning PHI. Commercial limitations, suspension, or payment disputes cannot excuse mandatory safeguards, reporting, individual-rights assistance, or lawful return of PHI.

3. Permitted processing and restrictions

Provider may use or disclose PHI only as necessary to deliver Customer's authorized services, including configured patient and care records, scheduling, visits, documents, time and task records, electronic visit verification, notifications, exports, and billing integrations, or as Required by Law. Processing remains subject to Customer's lawful documented instructions and minimum necessary requirements where applicable.

Provider will not use or disclose PHI in a manner that would violate the Privacy Rule if performed by Customer, except for limited management and legal-responsibility uses expressly permitted below. Provider will not sell PHI, use it for advertising, train general-purpose artificial intelligence models with it, or combine it across customers for independent commercial purposes. This BAA does not authorize cross-customer aggregation or de-identification for Provider's independent use.

Provider may use PHI for its proper management and administration or legal responsibilities only where the HIPAA Rules permit. Disclosure for those purposes is allowed only if Required by Law or the recipient gives reasonable assurances of confidentiality, restricted use and redisclosure, and notification to Provider of confidentiality breaches. Operational convenience is not a basis for unrestricted disclosure.

Customer will not instruct impermissible processing. Additional requirements must be separately agreed before processing records subject to 42 CFR Part 2 or other restrictions exceeding this BAA.

4. Safeguards and subcontractors

Provider will maintain appropriate administrative, physical, and technical safeguards for PHI and comply with the applicable Security Rule for Electronic PHI. Provider will maintain appropriate risk assessment and management, access management, workforce training, incident response, and contingency procedures. Personnel access must be limited to legitimate service needs and subject to confidentiality duties.

Before a subcontractor creates, receives, maintains, or transmits PHI on Provider's behalf, Provider will obtain a written agreement imposing the same applicable restrictions, conditions, and safeguards, including Security Rule compliance and incident reporting. Provider will take reasonable steps to cure a known material pattern of subcontractor violations or end the violation and, if unsuccessful, terminate the arrangement where feasible. Provider remains responsible for its contractual duties when using subcontractors.

Provider will make current information about PHI-processing subcontractors and processing locations available on request. An ordinary vendor privacy policy is not a substitute for a required subcontractor BAA.

5. Impermissible use, incidents, and breaches

Provider will report any impermissible use or disclosure of PHI of which it becomes aware and any Security Incident affecting Customer's Electronic PHI. Initial notice will be given without unreasonable delay and no later than five business days after discovery, with available facts and subsequent updates. Notice need not await a completed investigation.

The parties acknowledge routine unsuccessful probes, blocked malware, failed logins, and comparable attempts. This paragraph constitutes notice only of attempts that do not result in unauthorized access, use, disclosure, modification, destruction, or material interference with Electronic PHI. Provider will retain appropriate records and provide a summary on reasonable request. Events with a material impact or suspected compromise require the incident notice above.

For a Breach of Unsecured PHI, Provider will notify Customer without unreasonable delay and no later than five calendar days after discovery, unless a legally applicable law-enforcement delay under 45 CFR 164.412 applies. Discovery is determined under 45 CFR 164.410, including knowledge reasonably attributable to employees, officers, or agents other than the person committing the Breach. This contractual deadline does not extend the statutory outside limit.

Provider will supply known details concerning the event, dates, PHI types, affected individuals, containment, mitigation, and recommended protective steps, together with information reasonably needed for Customer's notices. Missing information will be supplied promptly as it becomes available. Provider will cooperate with investigations and reporting and mitigate harmful effects where practicable. Customer remains responsible for its required external notices unless a permitted duty is expressly delegated in writing. Provider's independent statutory duties remain unaffected.

Notice goes to Customer's designated privacy or security contact, or registered administrator until a specific contact is supplied. Provider's incident contact is support@carestaffmanager.com. Required reporting cannot await a billing dispute or fault determination.

6. Individual rights and regulatory cooperation

For PHI in a Designated Record Set maintained by Provider, Provider will supply access and reasonably usable electronic copies to Customer, or directly to an individual or designee when lawfully directed, as needed for compliance with 45 CFR 164.524. Provider will forward a directly received individual request to Customer within five business days unless law requires otherwise.

Provider will make applicable PHI available for amendment and incorporate or associate Customer-directed amendments for compliance with 45 CFR 164.526. Provider will document and supply information necessary for an accounting of disclosures under 45 CFR 164.528, including applicable subcontractor information.

Provider will respond to Customer's verified assistance requests within ten business days or a shorter period reasonably required to meet a statutory deadline. If an issue prevents timely completion, Provider will promptly identify it and cooperate on a lawful resolution. Customer determines the scope of individual rights and whether a request must be granted, except for duties imposed directly on Provider.

When carrying out a Customer obligation under the Privacy Rule, Provider will comply with the requirements applicable to that obligation. Provider will make relevant internal practices, books, and records available to the Secretary for determining HIPAA compliance. Provider will reasonably cooperate with Customer's requests for evidence of contractual compliance, protecting other customers' information and security-sensitive details.

7. Customer duties

Customer will give lawful instructions and disclose limitations in its privacy practices notice, changes or revocations of permissions, and agreed or legally required restrictions affecting Provider's processing. Customer will obtain required permissions, maintain authorized contacts, limit PHI to the agreed purpose, configure appropriate access, and promptly report suspected compromise involving the Service.

These duties do not reduce Provider's obligations or authorize unlawful use. Requests identifying individuals must use an agreed secure channel rather than ordinary public contact forms.

8. Term, termination, and disposition

This BAA remains effective for the applicable relationship and, for retained PHI, while Provider or its subcontractors retain it. Customer may terminate the affected Service Agreement if Provider violates a material BAA term. Customer may allow cure where appropriate but may terminate immediately if cure is infeasible or continued processing presents a material unlawful risk. Renewal cancellation does not extinguish these duties.

Upon termination, Provider will return PHI or destroy it as Customer lawfully directs, including subcontractor-held PHI, and retain no copies where feasible. Verified export procedures in the Service Agreement apply without limiting mandatory access rights. Ordinary return/destruction is due within 60 calendar days after termination or receipt of lawful disposition instructions, whichever is later; a shorter legal deadline controls.

Where return or destruction is infeasible, Provider will identify the reason, affected information, applicable legal basis or technical limitation, and expected duration. Provider will extend this BAA's protections to retained PHI and restrict further uses and disclosures to the purposes making disposition infeasible. Commercial usefulness alone is not a basis for retention. Provider will complete disposition once the impediment ends and provide written confirmation on request.

Backups are included. If immediate removal from protected backups is technically infeasible, Provider will isolate them from ordinary use, safeguard them, follow the disclosed expiration schedule, and reapply required deletions upon restoration. A blanket backup exception does not authorize indefinite retention. Provider will require corresponding subcontractor disposition and protection.

9. General provisions and contacts

The parties will amend this BAA in writing or through affirmative, version-identified electronic acceptance as needed for changed law. A revised Privacy Policy alone cannot expand PHI uses. Ambiguities will be resolved consistently with applicable HIPAA obligations.

The Service Agreement's law, notice, and liability provisions apply only where consistent with this BAA and mandatory law. Nothing restricts regulatory enforcement or nonwaivable individual rights. There are no contractual third-party beneficiaries unless mandatory law provides otherwise. Required safeguards, reporting, rights assistance, and disposition duties survive for retained PHI.

Contact: support@carestaffmanager.com