Effective Date: April 27, 2026
This Agreement is entered into between the Covered Entity (Customer — Cardiology Practice) and the Business Associate (GenniRx, Inc.)
GenniRx will process Protected Health Information (PHI) to provide prescription tracking, communication, and workflow automation services on behalf of the Covered Entity.
GenniRx may use PHI solely to perform services on behalf of the Covered Entity, including storage, transmission, and processing of prescription and patient data necessary to provide the GenniRx service.
GenniRx shall implement appropriate administrative, physical, and technical safeguards to protect PHI from unauthorized use or disclosure. This includes encryption at rest (AES-256) and in transit (TLS), role-based access controls, and immutable audit logging.
GenniRx shall notify the Covered Entity of any breach of unsecured PHI without unreasonable delay and no later than 60 calendar days after discovery of the breach, in accordance with HIPAA Breach Notification Rules.
GenniRx may utilize the following subcontractors who also handle PHI:
GenniRx ensures subprocessors are bound by equivalent data protection obligations.
The Covered Entity is solely responsible for:
GenniRx will make reasonable efforts to use, disclose, and request only the minimum amount of PHI necessary to accomplish the intended purpose.
This Agreement remains in effect for the duration of the service relationship between GenniRx and the Covered Entity and survives termination with respect to PHI retained by GenniRx.
PHI will be retained and archived in accordance with HIPAA compliance requirements for a minimum of six (6) years. Upon termination of services, PHI will be archived and not deleted in compliance with applicable regulations.
This Agreement terminates upon termination of the GenniRx service subscription. Upon termination, GenniRx will archive PHI in accordance with HIPAA retention requirements.
GenniRx reserves the right to amend this Agreement as required by changes in applicable law or regulation. Covered Entity will be notified of material amendments.
This Agreement is governed by the laws of the State of Florida and applicable federal law including HIPAA and the HITECH Act.
For BAA-related inquiries: support@gennirx.com | GenniRx, Inc. | DeLand, Florida, United States
By using the GenniRx platform, the Covered Entity acknowledges that they have read, understood, and agreed to the terms of this Business Associate Agreement.