This Business Associate Agreement ("BAA") is entered into on the date Customer accepts it electronically through the Services, as LatentWorx’s records show (the “Effective Date”), between:
LatentWorx and Customer are each a “Party” and together the “Parties.”
A. Customer is a covered entity under HIPAA or, where Customer is a part 2 program that is not a covered entity, the Parties apply this BAA to Customer by contract, as the QSOA provides. LatentWorx provides Kerrigan, an AI clinical documentation service, to Customer under the Underlying Agreement.
B. LatentWorx will create, receive, maintain or transmit Protected Health Information on Customer’s behalf and is therefore Customer’s business associate.
C. HIPAA permits Customer to share PHI with LatentWorx only on written assurances that meet 45 C.F.R. §§ 164.502(e) and 164.504(e). This BAA gives those assurances.
The Parties therefore agree as follows.
1.1 Incorporated terms. Capitalized terms used but not defined in this BAA, such as Business Associate, Covered Entity, Data Aggregation, Designated Record Set, Disclosure, Health Care Operations, Individual, Secretary and Use, have the meanings given in the HIPAA Rules. “HIPAA” means the Health Insurance Portability and Accountability Act of 1996, the HITECH Act, and their implementing regulations at 45 C.F.R. Parts 160 and 164 (the “HIPAA Rules”).
1.2 Defined terms. In this BAA:
(a) “Actual Knowledge Date” means the first day on which LatentWorx’s privacy and security contact named in Exhibit D, or the person then acting in that role, has actual knowledge of the matter to be reported.
(b) “Breach” has the meaning given in 45 C.F.R. § 164.402.
(c) “business day” means any day other than a Saturday, a Sunday or a United States federal public holiday.
(d) “Discovery” means the first day on which a Breach is known to LatentWorx or, by exercising reasonable diligence, would have been known to LatentWorx, as determined under 45 C.F.R. § 164.410(a)(2).
(e) “Electronic PHI” means PHI that is “electronic protected health information” as defined in 45 C.F.R. § 160.103, that is, PHI transmitted by electronic media or maintained in electronic media.
(f) “Part 2 Record” means a record, as defined in 42 C.F.R. § 2.11, that Customer, as a part 2 program, discloses to LatentWorx, whether or not a QSOA is in force.
(g) “PHI” or “Protected Health Information” has the meaning given in 45 C.F.R. § 160.103, limited to the information LatentWorx creates, receives, maintains or transmits for or on behalf of Customer. PHI includes Electronic PHI.
(h) “QSOA” means any Qualified Service Organization Agreement between the Parties under 42 C.F.R. Part 2.
(i) “Required by Law” has the meaning given in 45 C.F.R. § 164.103.
(j) “Security Incident” has the meaning given in 45 C.F.R. § 164.304: the attempted or successful unauthorized access, use, disclosure, modification or destruction of information, or interference with system operations in an information system.
(k) “Services” means the services LatentWorx provides to Customer under the Underlying Agreement, as described in Exhibit A.
(l) “Subcontractor” means a person or entity to whom LatentWorx delegates a function, activity or service involving the creation, receipt, maintenance or transmission of PHI, other than a member of LatentWorx’s workforce.
(m) “Underlying Agreement” means the LatentWorx Terms of Service at https://latentworx.com/terms, and any order forms or renewals under it.
(n) “Unsecured PHI” has the meaning given to “unsecured protected health information” in 45 C.F.R. § 164.402.
1.3 Exhibits. Exhibit A (Services and Data), Exhibit B (Safeguards), Exhibit C (Subcontractors) and Exhibit D (Incident and Breach Procedure) are set out after the Acceptance section below and form part of this BAA. Where the Parties have also signed the QSOA, the QSOA incorporates them by reference.
2.1 General rule. LatentWorx will use and disclose PHI only as this BAA permits or requires, or as Required by Law (45 C.F.R. §§ 164.502(a)(3), 164.504(e)(2)(i)). LatentWorx will not use or disclose PHI in a way that would violate Subpart E of 45 C.F.R. Part 164 if Customer did it, except for the uses in Sections 2.3 and 2.4, which that Subpart permits a business associate contract to authorize.
2.2 To perform the Services. LatentWorx may use and disclose PHI as necessary to perform the Services described in Exhibit A for Customer.
2.3 Management and administration. LatentWorx may use PHI, if necessary, for its proper management and administration or to carry out its legal responsibilities (45 C.F.R. § 164.504(e)(4)(i)). LatentWorx may disclose PHI for those purposes only if (45 C.F.R. § 164.504(e)(4)(ii)):
(a) the disclosure is Required by Law; or
(b) LatentWorx first obtains reasonable assurances from the recipient that the PHI will be held confidentially and used or further disclosed only as Required by Law or for the purpose for which it was disclosed, and that the recipient will tell LatentWorx of any instance it learns of in which the confidentiality of the PHI has been breached.
2.4 Data Aggregation (off unless requested). LatentWorx will provide Data Aggregation services relating to Customer’s Health Care Operations only if Customer asks for them in writing, and only within the scope of that request (45 C.F.R. § 164.504(e)(2)(i)).
2.5 Minimum necessary. LatentWorx will limit its uses, disclosures and requests of PHI to the minimum necessary to accomplish the intended purpose, consistent with 45 C.F.R. § 164.502(b) and Customer’s minimum necessary policies where Customer has shared them with LatentWorx.
2.6 Prohibited uses. LatentWorx will not:
(a) sell PHI or receive any direct or indirect payment in exchange for PHI, except as 45 C.F.R. § 164.502(a)(5)(ii) permits (including payment for performing the Services);
(b) use or disclose PHI for marketing or fundraising;
(c) store or process PHI outside the United States, except as Section 5.4 provides; or
(d) use or disclose PHI for any purpose that this BAA does not permit or require.
2.7 No model training. LatentWorx will not use PHI to train, fine-tune or improve any model, whether its own or a third party’s. Using PHI to operate, support, debug or secure the Services for Customer is not training, fine-tuning or improving a model. LatentWorx will engage a Subcontractor that processes PHI only under written terms that prohibit the same, as Exhibit C records for each Subcontractor.
2.8 No de-identification. LatentWorx will not de-identify PHI, or create any de-identified data set from PHI, unless the Parties first agree in writing.
2.9 Legal process. If LatentWorx receives a subpoena, court order or other legal demand for PHI, it will notify Customer within two (2) business days after receipt and, where legally permitted, before responding, so that Customer may seek a protective order or other remedy. LatentWorx will disclose only the PHI that the demand legally requires and only to the extent the disclosure is Required by Law.
2.10 Substance use disorder records. If Customer is a part 2 program, PHI that is also a Part 2 Record is also governed by the QSOA. Among other things, LatentWorx will not use or disclose those records to initiate or substantiate criminal charges against, or conduct a criminal investigation of, the patient, or in any civil, criminal, administrative or legislative proceeding against the patient (42 C.F.R. § 2.12(d)(1)), and will disclose them in response to legal process only under a court order that meets 42 C.F.R. § 2.64 or § 2.65, as the QSOA sets out.
LatentWorx will:
3.1 Use only as permitted. Not use or further disclose PHI other than as permitted or required by this BAA or as Required by Law (45 C.F.R. § 164.504(e)(2)(ii)(A)).
3.2 Safeguards. Use appropriate administrative, physical and technical safeguards, and comply with the applicable requirements of Subpart C of 45 C.F.R. Part 164 (the Security Rule) with respect to Electronic PHI, to prevent use or disclosure of PHI other than as this BAA provides (45 C.F.R. §§ 164.504(e)(2)(ii)(B), 164.314(a)(2)(i)(A)). Exhibit B describes the safeguards LatentWorx operates as of the Effective Date; it is a description, and does not limit LatentWorx’s obligations under this Section. LatentWorx may change its safeguards over time but will not materially reduce the overall protection of PHI described in Exhibit B.
3.3 Report improper uses and disclosures. Report to Customer any use or disclosure of PHI not provided for by this BAA of which it becomes aware, including Breaches of Unsecured PHI as required by 45 C.F.R. § 164.410, and any Security Incident of which it becomes aware, as set out in Section 4 (45 C.F.R. §§ 164.504(e)(2)(ii)(C), 164.314(a)(2)(i)(C)).
3.4 Subcontractors. Not permit a Subcontractor to create, receive, maintain or transmit PHI unless the Subcontractor has first agreed in writing to the same restrictions and conditions that apply to LatentWorx with respect to that PHI, and to comply with the applicable requirements of Subpart C of 45 C.F.R. Part 164, as set out in Section 5 (45 C.F.R. §§ 164.504(e)(2)(ii)(D), 164.502(e)(1)(ii), 164.308(b)(2), 164.314(a)(2)(i)(B), 164.504(e)(5)).
3.5 Access. Make PHI in a Designated Record Set available to Customer as necessary for Customer to meet its obligations under 45 C.F.R. § 164.524, as set out in Section 6 (45 C.F.R. § 164.504(e)(2)(ii)(E)).
3.6 Amendment. Make PHI in a Designated Record Set available for amendment and incorporate any amendments as Customer directs under 45 C.F.R. § 164.526, as set out in Section 6 (45 C.F.R. § 164.504(e)(2)(ii)(F)).
3.7 Accounting. Maintain and make available the information required for Customer to provide an accounting of disclosures under 45 C.F.R. § 164.528, as set out in Section 6 (45 C.F.R. § 164.504(e)(2)(ii)(G)).
3.8 Customer’s Privacy Rule obligations. To the extent LatentWorx carries out any of Customer’s obligations under Subpart E of 45 C.F.R. Part 164, comply with the requirements of that Subpart that apply to Customer in performing that obligation (45 C.F.R. § 164.504(e)(2)(ii)(H)). Unless Exhibit A says otherwise, LatentWorx carries out no such obligation.
3.9 Books and records. Make its internal practices, books and records relating to the use and disclosure of PHI available to the Secretary for purposes of determining Customer’s compliance with the HIPAA Rules (45 C.F.R. § 164.504(e)(2)(ii)(I)). Where legally permitted, LatentWorx will notify Customer of any such request and give Customer a copy of what it provides. Nothing in this Section waives any privilege.
3.10 Return or destruction. At termination, return or destroy PHI, or extend this BAA’s protections to PHI that cannot feasibly be returned or destroyed, as set out in Section 9 (45 C.F.R. § 164.504(e)(2)(ii)(J)).
3.11 Workforce. Train the members of its workforce who have access to PHI on the handling of PHI under this BAA within thirty (30) days after the Effective Date and on hire, and bind each of them to confidentiality obligations consistent with this BAA.
3.12 Mitigation. Take commercially reasonable steps, within LatentWorx’s systems and control, to contain and mitigate, to the extent practicable, any harmful effect known to LatentWorx of a use or disclosure of PHI by LatentWorx or its Subcontractors in violation of this BAA. The costs of notifying individuals, or of offering services to them, are recoverable only under Section 10.1(c) and are subject to Section 10.2.
3.13 Internal escalation. Require its workforce members and Subcontractors to report any suspected Security Incident, Breach or improper use or disclosure of PHI to its privacy and security contact named in Exhibit D within one (1) business day of becoming aware of it.
4.1 Notice of Security Incidents. LatentWorx will notify Customer of any Security Incident, other than an unsuccessful Security Incident described in Section 4.2, without unreasonable delay and no later than five (5) business days after the Actual Knowledge Date, or sooner where applicable law requires LatentWorx itself to give notice sooner, and in all cases no later than thirty (30) days after the date on which the Security Incident would be treated as discovered if the standard in 45 C.F.R. § 164.410(a)(2) applied to it. If the Security Incident is also a Breach of Unsecured PHI, Section 4.3 also applies.
4.2 Unsuccessful Security Incidents. Unsuccessful attempts occur routinely, such as pings, port scans, failed log-in attempts, denial-of-service attempts and blocked malware, that do not result in unauthorized access, use, disclosure, modification or destruction of PHI or interference with the information systems that hold it. This Section 4.2 is notice of them, and no further notice is required. On Customer’s written request, made no more than once per calendar quarter, LatentWorx will provide a summary of unsuccessful Security Incidents for the period requested.
4.3 Notice of Breaches of Unsecured PHI. LatentWorx will notify Customer of any Breach of Unsecured PHI without unreasonable delay and no later than five (5) business days after the Actual Knowledge Date, or sooner where applicable law requires LatentWorx itself to give notice sooner, and in every case within the period 45 C.F.R. § 164.410 requires, measured from Discovery. The time limit in 45 C.F.R. § 164.410(b) is an outer limit; whichever period ends first governs.
4.3A Other improper uses and disclosures. LatentWorx will report to Customer any other use or disclosure of PHI not provided for by this BAA, whether or not it is a Breach, without unreasonable delay and no later than five (5) business days after the Actual Knowledge Date, and in all cases no later than thirty (30) days after the date on which the use or disclosure would be treated as discovered if the standard in 45 C.F.R. § 164.410(a)(2) applied to it.
4.4 Content of notice. LatentWorx’s notice of a Breach will include, to the extent possible, the information required by 45 C.F.R. § 164.410(c): the identification of each individual whose Unsecured PHI has been, or is reasonably believed by LatentWorx to have been, accessed, acquired, used or disclosed during the Breach, and any other available information Customer is required to include in its notice to individuals under 45 C.F.R. § 164.404(c), such as what happened, the dates of the Breach and of Discovery, the types of PHI involved, and the steps LatentWorx is taking. LatentWorx will not delay notice to complete its investigation and will supplement the notice promptly as information becomes available. Exhibit D sets out the contacts, channels and notice template.
4.5 Notifications to individuals, regulators and the media. Customer will make any notifications to individuals, to the Secretary, to state regulators and to the media that the HIPAA Rules or state law require, unless the Parties agree otherwise in writing for a specific incident. LatentWorx will cooperate reasonably and promptly with Customer’s investigation and notifications, including by providing information Customer reasonably requests. LatentWorx will not notify affected individuals or regulators about a Breach of Customer’s PHI without Customer’s prior written consent, unless it is Required by Law to do so.
4.6 Law enforcement delay. If a law enforcement official tells LatentWorx that a notice would impede a criminal investigation or damage national security, LatentWorx may delay notice to the extent the HIPAA Rules permit such a delay, and will tell Customer as soon as it lawfully can.
5.1 Current Subcontractors. Exhibit C lists each Subcontractor that creates, receives, maintains or transmits PHI as of the Effective Date, its role, where it stores and processes PHI, the written agreement under which it does so, and that agreement’s status and date. Exhibit C will be complete, with no unfilled fields, when this BAA is signed. LatentWorx represents that, as of the Effective Date, each Subcontractor listed in Exhibit C has executed an agreement meeting Section 5.2, stated with its date in Exhibit C, and that no other person creates, receives, maintains or transmits PHI on LatentWorx’s behalf. LatentWorx will not accept PHI from Customer until this is true. Customer approves the Subcontractors listed in Exhibit C in reliance on that representation.
5.2 Written agreements. LatentWorx will not permit a Subcontractor to create, receive, maintain or transmit PHI unless it has first agreed in writing to the same restrictions and conditions that apply to LatentWorx with respect to that PHI, and to comply with the applicable requirements of Subpart C of 45 C.F.R. Part 164, in an agreement that meets 45 C.F.R. §§ 164.504(e)(2)(ii)(D), 164.502(e)(1)(ii), 164.308(b)(2), 164.314(a)(2)(i)(B) and 164.504(e)(5). The commitments in Sections 2.6(c) and 2.7 are met for each Subcontractor through the terms Exhibit C identifies for it.
5.3 New Subcontractors. LatentWorx will give Customer at least thirty (30) days’ written notice before a new Subcontractor creates, receives, maintains or transmits Customer’s PHI, by notice under Section 12.5 with an updated Exhibit C. No PHI will reach the new Subcontractor before that period ends unless Customer consents in writing. If Customer objects in writing within that period on reasonable privacy or security grounds, the Parties will discuss the objection in good faith, and LatentWorx will not permit the new Subcontractor to handle Customer’s PHI while the objection is unresolved. If the Parties cannot resolve it, Customer may terminate this BAA and the Underlying Agreement by written notice given within thirty (30) days after the discussions end. On that termination LatentWorx will refund prepaid fees for the unused term and provide the return under Section 9.1 at no charge; the Underlying Agreement governs any other refund. If a change is needed urgently to address a security risk or to comply with law, LatentWorx may make it on shorter notice, given as soon as practicable, and Customer’s termination right under this Section still applies. In every case, Section 5.2 must be met before the new Subcontractor receives PHI.
5.4 Data location. LatentWorx stores and processes PHI only in AWS regions located in the United States, and requires each Subcontractor that stores or processes PHI to do the same. Transit of data, and connections a user initiates from outside the United States, are not storage or processing. Handling of a connection by the AWS network services described in Exhibit A, Section 3.1(b), at the AWS location that receives it, may occur outside the United States and is the only exception to this Section. Exhibit A, Section 3.2 describes the regions. LatentWorx will not move storage or processing of PHI outside the United States without Customer’s prior written consent.
5.5 Subcontractor breaches. If LatentWorx learns of a pattern of activity or practice of a Subcontractor that is a material breach of its agreement, LatentWorx will take reasonable steps to cure the breach or end the violation and, if those steps are unsuccessful, will terminate the arrangement if feasible (45 C.F.R. § 164.504(e)(1)(iii)). LatentWorx is responsible to Customer for its Subcontractors’ compliance with the terms this BAA requires them to accept, subject to Section 10. LatentWorx itself remains bound by Section 2.10 for any Part 2 Record in a Subcontractor’s possession.
6.1 Access. Within ten (10) business days after Customer’s written request, LatentWorx will make available to Customer, in the electronic form and format the Services support, PHI in a Designated Record Set that Customer needs to respond to an individual’s request for access under 45 C.F.R. § 164.524. Customer can also copy finished notes out of the Services itself.
6.2 Amendment. Within ten (10) business days after Customer’s written request, LatentWorx will make PHI in a Designated Record Set available for amendment and will incorporate any amendment Customer directs under 45 C.F.R. § 164.526. Where Customer can make the amendment itself in the Services, Customer will do so.
6.3 Accounting of disclosures. LatentWorx will record any disclosure of PHI that is subject to an accounting under 45 C.F.R. § 164.528, with the information § 164.528 requires, keep that record for six (6) years, and provide the recorded information to Customer within ten (10) business days after Customer’s written request.
6.4 Requests made directly to LatentWorx. If an individual contacts LatentWorx directly to request access to, amendment of, or an accounting of their PHI, LatentWorx will forward the request to Customer within five (5) business days and will not respond to the individual on the substance. Customer is responsible for responding to the individual.
6.5 Shorter deadlines. If state law gives Customer a shorter deadline, Customer will say so in its request and LatentWorx will use reasonable efforts to meet it.
Customer will:
7.1 Permissible requests. Not ask LatentWorx to use or disclose PHI in any way that would not be permissible under Subpart E of 45 C.F.R. Part 164 if done by Customer, except as Sections 2.3 and 2.4 allow (45 C.F.R. § 164.504(e)(2)(i)).
7.2 Authorizations, consents and notices. Obtain every authorization, consent and patient notice it needs under the HIPAA Rules, 42 C.F.R. Part 2 and state law before PHI is provided to LatentWorx or captured through the Services. This includes any consent needed to record a session and any notice to patients that AI is used in their care where state law requires one.
7.3 Notice of privacy practices. Notify LatentWorx of any limitation in its notice of privacy practices, and of any change to it, to the extent the limitation or change may affect LatentWorx’s use or disclosure of PHI.
7.4 Restrictions and revocations. Notify LatentWorx of any restriction on the use or disclosure of PHI that Customer has agreed to or must follow under the HIPAA Rules, and of any change in or revocation of an individual’s permission to use or disclose PHI, to the extent it may affect LatentWorx’s use or disclosure of PHI.
7.5 Sessions, users and access. Decide which sessions its users record or import through the Services, and obtain the consents its law requires for each. Customer is responsible for its users’ credentials and devices, and for the access settings the Services make available to it. LatentWorx is responsible for the security of the Services, including their authentication and access-control mechanisms, under Section 3.2.
7.6 Part 2 status. State through the Services, when accepting this BAA, whether Customer is a part 2 program under 42 C.F.R. Part 2, and tell LatentWorx in writing before that changes. If Customer is a part 2 program, Customer will not send Part 2 Records through the Services until Customer has accepted the QSOA through the Services.
7.7 Intentionally omitted.
7.8 Exported PHI. Be responsible for notes, transcripts and other PHI after a Customer user copies or exports them out of the Services. LatentWorx is not responsible for PHI once it has left the Services at a Customer user’s direction.
7.9 Suspension. Accept that, if LatentWorx reasonably believes PHI was provided in breach of Section 7.2, or that Customer’s material breach of this BAA threatens PHI, LatentWorx may suspend processing of the affected PHI after written notice to Customer, until the matter is resolved.
8.1 Term. This BAA starts on the Effective Date and ends when the Underlying Agreement ends, unless terminated earlier under this Section 8. LatentWorx’s obligations under this BAA continue for as long as LatentWorx or any Subcontractor retains any PHI.
8.2 Termination by Customer for cause. If Customer determines that LatentWorx has violated a material term of this BAA, Customer may give LatentWorx written notice describing the violation (45 C.F.R. §§ 164.504(e)(2)(iii), 164.504(e)(1)(ii)). If LatentWorx does not cure the violation or end it within thirty (30) days after the notice, Customer may terminate this BAA and the Underlying Agreement by written notice. If cure is not possible, Customer may terminate immediately by written notice. If Customer terminates under this Section, LatentWorx will refund prepaid fees for the unused term.
8.3 Termination by LatentWorx for cause. If Customer violates a material term of this BAA, including by requiring a use or disclosure that Section 7.1 prohibits, LatentWorx may terminate this BAA and the Underlying Agreement on the same notice and cure terms as Section 8.2.
8.4 Effect on the Underlying Agreement. Because the Services cannot run without a BAA, termination of this BAA permits either Party to terminate the Underlying Agreement, and LatentWorx will stop receiving new PHI on that date.
9.1 Return. For thirty (30) days after this BAA terminates (the “Return Period”), LatentWorx will keep Customer’s PHI available for Customer to access and copy through the Services. On Customer’s written request made within the Return Period, LatentWorx will return to Customer, at no charge, all PHI that LatentWorx or its Subcontractors still maintain, in a format reasonably usable by Customer: an export of clinical notes and transcripts, and audio files if Customer asks for them.
9.2 Destruction. Customer has thirty (30) days after termination to export its PHI (the Return Period under Section 9.1). LatentWorx will complete destruction within thirty (30) days after that period ends, or sooner once Customer confirms in writing that export is complete, and in any case within thirty (30) days after that confirmation. Destruction covers all PHI held in LatentWorx’s and its Subcontractors’ active systems, is carried out by deleting Customer’s records and stored objects in accordance with NIST SP 800-88 guidelines, and leaves no copies except as Section 9.3 permits. Copies in backups and snapshots are deleted as those backups expire, within thirty (30) days after active-system destruction, and remain protected under Section 9.3 until then. LatentWorx will give Customer a written certificate of destruction, signed by an authorized representative of LatentWorx, stating the date active-system copies were destroyed and the date by which backup copies expire.
9.3 When return or destruction is infeasible. If returning or destroying any PHI is infeasible, LatentWorx will tell Customer in writing what PHI is affected and why. LatentWorx will then extend the protections of this BAA to that PHI and limit further uses and disclosures to the purposes that make return or destruction infeasible, for as long as LatentWorx retains it (45 C.F.R. § 164.504(e)(2)(ii)(J)). The same applies to PHI that LatentWorx must keep to meet a legal obligation under Section 2.3, which LatentWorx will keep only as long as that obligation lasts and will then return or destroy.
9.4 Deletion during the term. Customer may ask LatentWorx in writing, or use any deletion function the Services make available to Customer, to delete specified audio recordings, transcripts or notes during the term. LatentWorx will complete a requested deletion from its active systems within thirty (30) days after the request and confirm it in writing. Backup copies are deleted as those backups expire, within the period stated in Section 9.2, and remain protected under Section 9.3 until then.
10.1 Mutual indemnity. Each Party (the “Indemnifying Party”) will defend, indemnify and hold harmless the other Party and its officers, employees and agents from and against:
(a) claims brought by third parties;
(b) civil monetary penalties imposed by the Secretary or a state attorney general, and other amounts paid to regulators; and
(c) the reasonable costs of forensic investigation, legal counsel for regulatory response, notifying individuals, regulators and the media of a Breach as required by law, call-centre support, and credit or identity monitoring offered to affected individuals,
in each case to the extent arising from the Indemnifying Party’s breach of this BAA or violation of HIPAA or 42 C.F.R. Part 2, and excluding any portion caused by the indemnified Party’s own breach, negligence, misconduct or instructions. For a third-party claim, the indemnified Party will give prompt written notice of the claim, let the Indemnifying Party control the defense and settlement (but no settlement may admit fault for, or bind, the indemnified Party without its consent), and cooperate at the Indemnifying Party’s expense. Any investigation, audit or proceeding by the Secretary, a state attorney general or another regulator against the indemnified Party is controlled by the indemnified Party, at the Indemnifying Party’s expense to the extent this Section 10.1 provides, subject to Section 10.2.
10.2 Shared, mutual cap. Each Party’s total aggregate liability arising out of or relating to PHI or Part 2 Records under this BAA, the QSOA and the Underlying Agreement combined, including under Section 10.1, will not exceed the fees Customer paid to LatentWorx under the Underlying Agreement in the twelve (12) months before the first event giving rise to any liability. This cap is not additional to any cap in the Underlying Agreement: liability subject to it does not also count against, and is not also recoverable under, any cap in the Underlying Agreement.
10.3 Exclusion of consequential damages. Neither Party is liable to the other for any indirect, incidental, special, consequential or punitive damages, or lost profits or revenue, arising out of or relating to this BAA, even if advised of their possibility. This Section 10.3 does not limit amounts payable under Section 10.1.
10.4 Exceptions. Nothing in this BAA limits either Party’s liability for its fraud or willful misconduct. In this BAA, “willful misconduct” means intentional wrongdoing undertaken with knowledge that it is wrongful.
10.5 Insurance. Intentionally omitted.
11.1 Security questionnaires. Once per contract year, on Customer’s written request, LatentWorx will give written responses to a reasonable security and privacy questionnaire and copies of its current HIPAA privacy and security policies. Customer will treat them as LatentWorx’s confidential information, except that Customer may share them with its legal and insurance advisers and with regulators.
11.2 Regulator-required inspection. LatentWorx will permit an on-site inspection of its relevant practices only if the Secretary or a state regulator requires Customer to conduct one. Customer will give at least thirty (30) days’ written notice, bear its own costs and LatentWorx’s reasonable costs, conduct the inspection during LatentWorx’s normal business hours without unreasonably disrupting operations, and keep everything it learns confidential. This Section does not limit the Secretary’s own access under Section 3.9.
11.2A Review after a Breach. After a Breach affecting Customer’s PHI, Customer may, once per Breach, ask in writing for (a) a written root-cause report and (b) a documentation-based review of LatentWorx’s relevant policies, risk-analysis summary, access logs for Customer’s notes, and remediation evidence. LatentWorx will provide both within thirty (30) days after the request or after its investigation is complete, whichever is later. The final report under Exhibit D may serve as the root-cause report. Each Party bears its own costs. This Section gives no on-site right beyond Section 11.2.
11.3 Cooperation. Each Party will reasonably cooperate with the other in responding to a regulator’s inquiry about PHI handled under this BAA, where legally permitted.
12.1 Regulatory references and amendment. A reference to a section of the HIPAA Rules or 42 C.F.R. Part 2 means that section as in effect or as amended. The Parties will negotiate in good faith to amend this BAA as necessary to comply with any change in the HIPAA Rules or other applicable law. If they cannot agree on an amendment within sixty (60) days after either Party requests one, either Party may terminate this BAA and the Underlying Agreement on written notice.
12.2 More stringent law. Where a state law is more stringent than HIPAA within the meaning of 45 C.F.R. § 160.202, including state laws on the confidentiality of mental health and substance use disorder records and California’s Confidentiality of Medical Information Act where it applies, each Party will comply with the more stringent law to the extent it applies to that Party. This Section does not change the periods in Sections 4 and 6 unless a law that applies directly to LatentWorx requires a shorter period. Customer will identify in writing any such law it relies on.
12.3 Interpretation. Any ambiguity in this BAA will be resolved in favor of a meaning that permits both Parties to comply with the HIPAA Rules.
12.4 Precedence. In any conflict concerning the use, disclosure or safeguarding of PHI, this BAA controls over the Underlying Agreement to the extent of the conflict. The Underlying Agreement controls on every other matter, including warranties, disclaimers and dispute resolution, and on limitations of liability except as Section 10 provides. On any matter governed by 42 C.F.R. Part 2, the QSOA controls over this BAA.
12.5 Notices. Notices under this BAA must be in writing. Notices to LatentWorx must be sent by email; notices to Customer may be sent by email, by a recognized courier, or by certified mail. An email notice is effective when sent with confirmation of transmission, and any other notice when delivered. Notices go to:
Notices under Section 4 may also be given by the channels in Exhibit D. A Party may change its notice details by notice to the other.
12.6 No third-party beneficiaries. Nothing in this BAA gives any right or remedy to anyone other than the Parties and their permitted successors and assigns.
12.7 Independent parties. LatentWorx is an independent contractor, not Customer’s agent.
12.8 Governing law and venue.
(a) Governing law. This BAA is governed by federal law and, to the extent not preempted, the laws of the State of Delaware, without regard to its conflict-of-laws rules.
(b) Venue. Venue: the state and federal courts located in Pierce County, Washington, which have exclusive jurisdiction over any dispute arising out of or relating to this BAA.
12.9 Entire agreement. This BAA, with its Exhibits, is the Parties’ entire agreement on its subject and supersedes any earlier business associate agreement or terms between them on that subject, other than the QSOA. It may be amended only in writing signed by both Parties, except that LatentWorx may update Exhibit C under Section 5.3.
12.10 Survival. Sections 2 to 6, 9, 11.3 and 12 survive termination for as long as LatentWorx or any Subcontractor retains PHI. Section 7 (as to conduct during the term), Sections 10.1 to 10.4 and Section 12 survive termination. A claim under Section 10 must be brought within two (2) years after the date the claiming Party knew or reasonably should have known of the claim, except that a claim for a civil penalty, fine or other regulator-imposed cost may be brought until two (2) years after the proceeding that imposed it is finally resolved. Section 10.5 does not survive termination.
12.11 Severability and waiver. An unenforceable provision is enforced to the extent possible and does not affect the rest. Failure to enforce a provision is not a waiver.
12.12 Assignment. Neither Party may assign this BAA except together with an assignment of the Underlying Agreement permitted under its terms.
12.13 Counterparts and electronic signatures. This BAA may be signed in counterparts, each of which is an original and all of which together are one agreement. Signatures delivered electronically, including through an electronic signature service or as a scanned copy, are binding as originals.
Acceptance by Customer. Customer accepts this BAA electronically through the Services. Acceptance by [[CUSTOMER_SIGNATORY_NAME]], [[CUSTOMER_SIGNATORY_TITLE]], on the date LatentWorx’s records show for that acceptance, binds Customer. That date is the Effective Date.
LatentWorx. LatentWorx offers this BAA through the Services and is bound by it when it makes the Services available to Customer after that acceptance. No separate signature by LatentWorx is required.
References to signing. In this BAA and its Exhibits, a reference to an agreement being signed or executed, to a signature page or to a date of signature means its acceptance in this way and the date of that acceptance.
This Exhibit A forms part of the Business Associate Agreement above between LatentWorx, Ltd. ("LatentWorx") and [[CUSTOMER_LEGAL_NAME]] (the “BAA”) and, where the Parties have also signed the Qualified Service Organization Agreement (the “QSOA”), the QSOA. “Customer” means the “Program” under the QSOA, where applicable. “Effective Date” means the Effective Date of the BAA. Capitalized terms not defined here have the meanings given in the BAA or, for Part 2 terms, the QSOA.
1.1 LatentWorx provides Customer with Kerrigan, an AI clinical scribe for behavioral-health and substance use disorder ("SUD") clinicians. The Services consist of:
(a) live in-session audio transcription, performed on graphics processing unit ("GPU") infrastructure that LatentWorx operates inside its own AWS account using a self-hosted transcription model; audio is not sent to any third-party transcription API;
(b) clinical note drafting, in ASAM six-dimension, DAP, narrative and custom template formats, produced by large language model inference on AWS Bedrock, called from LatentWorx’s AWS account;
(c) transcript-grounded clinical chat, allowing the clinician to ask questions about a session transcript;
(d) clinician-approved note revision with diffs, note versioning, and rollback to a prior note version; and
(e) clipboard-based export of a finished note for the clinician to paste into Customer’s own electronic health record ("EHR") or other systems of record.
1.2 The Services can capture a Zoom session live and can import a Zoom session transcript. The Services do not include a native in-meeting Zoom integration.
1.3 An account is created when Customer completes sign-up through the Services, confirmed by LatentWorx’s payment processor. The account holder signs in by a single-use link sent to the account email address. The Services do not today support a multi-provider organizational account model.
2.1 In providing the Services, LatentWorx creates, receives, maintains or transmits the following categories of PHI and, where Customer is a part 2 program, Part 2 Records:
(a) Audio: recordings of clinical sessions captured live;
(b) Transcripts: text output of the transcription process, and session transcripts Customer imports;
(c) Draft and final notes: AI-drafted and clinician-approved clinical notes, including all saved versions;
(d) Chat: the clinician’s questions and the Services’ answers in transcript-grounded clinical chat;
(e) Note-generation traces: copies of the prompts sent for note generation and the model outputs returned, held in the trace store described in Section 3.1(i); and
(f) Metadata: session timestamps, note version history, user and account identifiers, and similar records describing the above.
2.2 Other data (not PHI). LatentWorx also holds clinician account information collected at onboarding, such as name and contact information. This is not PHI and is not governed by the BAA.
2.3 Where records are kept relative to Customer’s EHR. Audio, transcripts, draft and final notes, every saved note version, chat and note-generation traces are stored in LatentWorx’s systems, separately from Customer’s EHR. A finished note reaches Customer’s EHR only when a clinician copies it there. The copies in Kerrigan remain in LatentWorx’s systems until they are deleted under BAA Section 9.4 or destroyed under BAA Section 9.2. Customer has thirty (30) days after termination to export its PHI. LatentWorx will complete destruction within thirty (30) days after that period ends, or sooner once Customer confirms in writing that export is complete, and in any case within thirty (30) days after that confirmation. The exception is note-generation traces, which expire as Section 3.1(i) describes.
2.4 Where Customer is a part 2 program, the categories in 2.1 that identify a patient as having received SUD diagnosis, treatment or referral for treatment are Part 2 Records and are handled under the QSOA as well as the BAA.
3.1 In plain language, data moves through the following systems:
(a) Clinician’s browser: the clinician starts a live session or imports a session transcript.
(b) AWS network: the connection reaches LatentWorx’s AWS account through AWS network services covered by LatentWorx’s agreement with AWS (Exhibit C). Those services may end the connection’s TLS encryption at the AWS location that receives it, and so handle the content of the request, including PHI, in unencrypted form there, and forward the request to the Services’ ingress inside LatentWorx’s cluster over a new encrypted connection.
(c) LatentWorx AWS account: the compute, storage and inference described in (d) to (i) run in a single-tenant AWS account controlled by LatentWorx.
(d) Self-hosted transcription on GPU: audio is transcribed by a self-hosted model running on GPU infrastructure in that AWS account.
(e) AWS Bedrock inference: the transcript is sent to AWS Bedrock, called from that AWS account, for note drafting.
(f) Application database: session, transcript, note, chat and metadata records are stored in a PostgreSQL database running inside LatentWorx’s Kubernetes cluster, on Amazon EBS volumes encrypted with AWS Key Management Service ("KMS"). Access to each record through the application is mediated by a database row scoped to the customer.
(g) Object storage: audio files and related large objects are stored in an object store (MinIO) running inside LatentWorx’s Kubernetes cluster, on Amazon EBS volumes encrypted with KMS.
(h) Audit log: administrative actions are written to an append-only audit log enforced at the database; access to notes is also logged.
(i) LLM trace store: copies of note-generation prompts and outputs are held in an in-cluster trace store (Langfuse), which keeps them in a ClickHouse database on Amazon EBS volumes and in a KMS-encrypted Amazon S3 bucket. A daily job deletes these copies once they are fourteen (14) days old.
3.2 Data location. LatentWorx stores and processes PHI and Part 2 Records only in AWS regions located in the United States (us-west-2 and, for AWS Bedrock inference, us-east-1), and requires each Subcontractor storing or processing such records to do the same. The AWS network services described in Section 3.1(b) may handle a connection, including in unencrypted form, at the AWS location that receives it, which is not limited to those regions and may be outside the United States. Transit of encrypted data, and connections a user initiates from outside the United States, are not storage or processing. LatentWorx will not move storage or processing outside the United States without Customer’s prior written consent.
4.1 LatentWorx does not write data back into Customer’s EHR. Note export is a one-way, clinician-initiated clipboard copy; LatentWorx has no integration that writes to Customer’s EHR.
4.2 LatentWorx will not sell PHI or Part 2 Records, as “sale” is described at 45 C.F.R. § 164.502(a)(5)(ii).
4.3 LatentWorx will not use PHI or Part 2 Records for marketing.
4.4 LatentWorx will not use PHI to train, fine-tune or improve any model, whether its own or a third party’s. Using PHI to operate, support, debug or secure the Services for Customer is not training, fine-tuning or improving a model. LatentWorx will engage a Subcontractor that processes PHI only under written terms that prohibit the same (BAA Section 2.7). LatentWorx will not use Part 2 Records to train, fine-tune or improve any model, whether its own or a third party’s (QSOA Section 5.3). LatentWorx will not de-identify PHI, or create any de-identified data set from PHI, unless the Parties first agree in writing (BAA Section 2.8). LatentWorx will not de-identify Part 2 Records for any purpose of its own (QSOA Section 5.4).
Exhibit B forms part of this Business Associate Agreement. It is not published on this website. It is shown in full in the application before Customer accepts, and a copy is available on request to support@latentworx.com.
This Exhibit C forms part of the Business Associate Agreement above between LatentWorx, Ltd. ("LatentWorx") and [[CUSTOMER_LEGAL_NAME]] (the “BAA”) and, where the Parties have also signed the Qualified Service Organization Agreement (the “QSOA”), the QSOA (together, where both are signed, the “Agreements”). “Customer” means the “Program” under the QSOA, where applicable. “Effective Date” means the Effective Date of the BAA. Capitalized terms not defined here have the meanings given in the BAA or, for Part 2 terms, the QSOA.
This Exhibit C lists each Subcontractor that creates, receives, maintains or transmits PHI or Part 2 Records on LatentWorx’s behalf. It supports LatentWorx’s subcontractor obligations under 45 C.F.R. §§ 164.504(e)(2)(ii)(D) and 164.502(e)(1)(ii) and BAA Section 5.
| Subcontractor | Role in the data path | Data it can access |
|---|---|---|
| Amazon Web Services, Inc. ("AWS") | Hosts LatentWorx’s AWS account: compute (including the GPU infrastructure for self-hosted transcription and the Kubernetes cluster that runs the PostgreSQL application database and the LLM trace store), Amazon EBS volumes, Amazon S3, AWS Key Management Service, and AWS Bedrock model inference; and carries connections to the Services through AWS network services (Exhibit A, Section 3.1(b)) | All categories of PHI and Part 2 Records described in Exhibit A, Section 2 |
| None | Not applicable | Not applicable |
Each row states the agreement LatentWorx requires from the Subcontractor, that agreement’s status and date as of the Effective Date, where the Subcontractor stores or processes PHI, and the written term under which it may not use PHI to train, fine-tune or improve any model (BAA Sections 2.7 and 5.4).
| Subcontractor | Agreement required | Agreement status and date | Storage and processing location | No-training term |
|---|---|---|---|---|
| AWS | AWS Business Associate Addendum, accepted through AWS Artifact | In place. AWS Business Associate Addendum accepted through AWS Artifact, effective 2026-10-09 | us-west-2; AWS Bedrock inference in us-east-1; AWS network services at the AWS location that receives a connection (Exhibit A, Section 3.2) | AWS Business Associate Addendum, effective 2026-10-09: on acceptance, the account is opted out of AWS service teams storing and using its Customer Content for service improvement purposes |
| None | Not applicable | Not applicable | Not applicable | Not applicable |
2.1 LatentWorx will not permit a Subcontractor to create, receive, maintain or transmit PHI or Part 2 Records unless it has first agreed in writing to the same restrictions and conditions that apply to LatentWorx under the BAA, and for Part 2 Records as the QSOA provides, with respect to that information, and to comply with the applicable requirements of Subpart C of 45 C.F.R. Part 164 (45 C.F.R. §§ 164.504(e)(2)(ii)(D), 164.502(e)(1)(ii), 164.308(b)(2), 164.314(a)(2)(i)(B), 164.504(e)(5)). Each Subcontractor listed in Section 1 has executed such an agreement, stated with its date in Section 1.2, as BAA Section 5.1 represents. LatentWorx will not accept PHI or Part 2 Records until this is true.
2.2 LatentWorx treats AWS as a business-associate subcontractor, so its flow-down to it follows 45 C.F.R. § 164.504(e)(5) rather than 42 C.F.R. § 2.33(c). LatentWorx does not represent that any Subcontractor has signed terms specific to 42 C.F.R. Part 2. For Part 2 Records in a Subcontractor’s possession, LatentWorx itself remains bound by its duty to resist in judicial proceedings (QSOA Section 6) and its duty not to use records against patients (QSOA Section 5.6).
2.3 If LatentWorx engages a Subcontractor that is not itself a business associate for the service it provides, LatentWorx’s written contract with it will also meet 42 C.F.R. § 2.33(c) for any Part 2 Records it receives.
3.1 LatentWorx will give Customer at least thirty (30) days’ written notice, with an updated Exhibit C, before a new Subcontractor creates, receives, maintains or transmits Customer’s PHI or Part 2 Records. No PHI or Part 2 Record will reach the new Subcontractor before that period ends unless Customer consents in writing. If a change is needed urgently to address a security risk or to comply with law, LatentWorx may make it on shorter notice, given as soon as practicable, and Section 3.2 still applies. In every case, Section 2.1 must be met before the new Subcontractor receives PHI or Part 2 Records.
3.2 If Customer objects in writing within the notice period on reasonable privacy or security grounds, the Parties will discuss the objection in good faith, and LatentWorx will not permit the new Subcontractor to handle Customer’s PHI or Part 2 Records while the objection is unresolved. If the Parties cannot resolve it, Customer may terminate the Agreements and the Underlying Agreement by written notice given within thirty (30) days after the discussions end. On that termination LatentWorx will refund prepaid fees for the unused term and provide the return under BAA Section 9.1 at no charge; the Underlying Agreement governs any other refund. This Exhibit C does not give Customer a right to veto a Subcontractor and continue the Agreements.
This Exhibit D forms part of the Business Associate Agreement above between LatentWorx, Ltd. ("LatentWorx") and [[CUSTOMER_LEGAL_NAME]] (the “BAA”) and, where the Parties have also signed the Qualified Service Organization Agreement (the “QSOA”), the QSOA (together, where both are signed, the “Agreements”). “Customer” means the “Program” under the QSOA, where applicable. Capitalized terms not defined here have the meanings given in the BAA.
This Exhibit D sets out the procedure for LatentWorx’s reporting obligations under BAA Section 4 (45 C.F.R. §§ 164.504(e)(2)(ii)(C), 164.314(a)(2)(i)(C) and 164.410) and, where Customer is a part 2 program, 42 C.F.R. § 2.16(b).
| Side | Role | Name | Contact |
|---|---|---|---|
| LatentWorx | Privacy and security contact | Privacy and Security Officer | security@latentworx.com |
| LatentWorx | Notice address | — | support@latentworx.com (email only) |
| Customer | Privacy officer | [[CUSTOMER_SIGNATORY_NAME]], [[CUSTOMER_SIGNATORY_TITLE]], until Customer names another person by notice | The email address registered to Customer’s account in the Services |
| Customer | Notice address | — | [[CUSTOMER_ADDRESS]] |
2.1 “Security Incident” has the meaning given in the BAA, which cross-refers to 45 C.F.R. § 164.304. “Breach” and “Unsecured PHI” have the meanings given in the BAA, which cross-refers to 45 C.F.R. § 164.402. “Discovery,” “Actual Knowledge Date” and “business day” have the meanings given in the BAA. This Exhibit D does not restate those definitions.
2.2 Unsuccessful Security Incidents described in BAA Section 4.2 are handled solely under that Section and are not subject to this Exhibit D.
3.1 Clock. The contractual periods below run from the Actual Knowledge Date. In every case, notice of a Breach of Unsecured PHI is also given within the period 45 C.F.R. § 164.410 requires, measured from Discovery (BAA Section 4.3), and notice of a matter in Section 3.2(b) or (c) is also given within the thirty-day period BAA Sections 4.1 and 4.3A set. LatentWorx will require its workforce members and Subcontractors to report any suspected Security Incident, Breach or improper use or disclosure of PHI to its privacy and security contact within one (1) business day of becoming aware of it (BAA Section 3.13).
3.2 Initial Notice to Customer. LatentWorx will give Customer an initial written notice (an “Initial Notice”) of each of the following no later than five (5) business days after the Actual Knowledge Date, or sooner where applicable law requires LatentWorx itself to give notice sooner:
(a) any Breach of Unsecured PHI;
(b) any Security Incident other than an unsuccessful Security Incident described in BAA Section 4.2; and
(c) any other use or disclosure of PHI not provided for by the Agreements, whether or not it is a Breach (BAA Section 4.3A).
3.3 Supplemental notices. LatentWorx will give Customer supplemental written notices as additional material facts become known, and in any event when Customer reasonably requests an update, until the investigation is complete.
3.4 Final report. LatentWorx will give Customer a final written report within thirty (30) days after LatentWorx completes its investigation. The report will summarize the facts known at that time, the remediation taken, and any facts that remain unresolved.
4.1 For a Breach, LatentWorx’s Initial Notice will include, to the extent possible (45 C.F.R. § 164.410(c)):
(a) the identification of each individual whose Unsecured PHI has been, or is reasonably believed by LatentWorx to have been, accessed, acquired, used or disclosed during the Breach; and
(b) any other available information Customer is required to include in its notice to individuals under 45 C.F.R. § 164.404(c), and any further information Customer reasonably needs for its own notifications.
For any other matter in Section 3.2, the Initial Notice will describe what happened, the systems and data involved, and the steps LatentWorx is taking, to the extent known.
4.2 Where full information is not available by the Initial Notice deadline, LatentWorx will provide what is known at that time and supplement it under Section 3.3 as information becomes available. Logging of transcript and audio reads is not confirmed as running in production (Exhibit B, Section 2). For that reason, LatentWorx may be unable to determine which individuals’ transcripts or audio were accessed, and it will say so in its notice.
5.1 Customer is responsible for notifying affected individuals, the Secretary and, where required, the media, as and when 45 C.F.R. Part 164, Subpart D requires, including notice to individuals under 45 C.F.R. § 164.404 (BAA Section 4.5).
5.2 LatentWorx will cooperate with Customer’s notifications under 5.1, including by providing the information described in Section 4 and any further information Customer reasonably requests to complete them.
6.1 Customer will tell LatentWorx in writing of any state-law notice deadline that Customer believes applies to it.
6.2 Where a law that applies directly to LatentWorx requires notice sooner than Section 3.2 provides, LatentWorx will give notice within that time. Where a shorter deadline applies only to Customer, LatentWorx will cooperate with Customer to meet it.
7.1 Where Customer is a part 2 program, 42 C.F.R. § 2.16(b) applies the HIPAA breach-notification rule (45 C.F.R. Part 160 and Part 164, Subpart D) to a breach of Part 2 Records in the same manner as it applies to a covered entity. This Exhibit D’s procedure therefore governs Part 2 Records as well as PHI. In its notice, LatentWorx will tell Customer when affected records are Part 2 Records.
7.2 LatentWorx’s written security policies under 42 C.F.R. § 2.16(a) are addressed in QSOA Section 9.1, and their status is stated in Exhibit B, Section 3. Customer maintains its own written policies for its own records.
To: (Customer's privacy officer and notice email, Section 1)
From: (LatentWorx's privacy and security contact, Section 1)
Date of this notice: __________
Actual Knowledge Date: __________
Date of Discovery (45 C.F.R. 164.410(a)(2)), if different: __________
Type: __________ (Breach / Security Incident / other use or disclosure not provided for)
1. Nature of the matter: __________
2. Systems or data categories potentially involved: __________
3. Part 2 Records involved (yes / no / not yet known): __________
4. Individuals potentially affected, to the extent known: __________
5. Status of LatentWorx's investigation: __________
6. Containment steps taken to date: __________
7. Information Customer needs for its own notifications: __________
8. Next update expected by: __________
To: (Customer's privacy officer and notice email, Section 1)
From: (LatentWorx's privacy and security contact, Section 1)
Date of this report: __________
Reference: Initial Notice dated __________
1. New facts since the last notice: __________
2. Updated identification of individuals affected, to the extent known: __________
3. Root cause, if determined: __________
4. Remediation completed or in progress: __________
5. Whether this is the final report: __________
6. Next update expected by (if not final): __________
9.1 After resolving any Breach or any Security Incident reported under Section 3.2, LatentWorx will conduct an internal post-incident review. On request, it will give Customer a summary of the corrective actions that resulted. BAA Section 11.2A governs any further documentation review after a Breach.