DentalSlip Business Associate Agreement

Version 2026-10-16 — adds e‑signature services

This version takes effect as provided in Section 13.2: when the account owner accepts it in the product, or thirty (30) days after notice to Covered Entity, whichever is earlier. For an office that first accepts this BAA in the product, it takes effect under Section 10.1.

This Business Associate Agreement ("BAA") is entered into between the subscribing dental office that accepts it in the DentalSlip product ("Covered Entity") and UCPlaces LLC, a Virginia limited liability company with its principal office at 303 Maple Ave W, Suite F, Vienna, VA 22180, which operates DentalSlip ("Business Associate"). Each is a "Party."

1. Definitions

Capitalized terms used but not defined in this BAA have the meanings given in the HIPAA Rules. "HIPAA Rules" means the Privacy, Security, Breach Notification, and Enforcement Rules at 45 C.F.R. Parts 160 and 164. In particular:

• "Protected Health Information" or "PHI" has the meaning in 45 C.F.R. 160.103, limited to information Business Associate creates, receives, maintains, or transmits on behalf of Covered Entity. It includes Electronic Protected Health Information.
• "Breach" and "Unsecured Protected Health Information" have the meanings in 45 C.F.R. 164.402.
• "Security Incident" has the meaning in 45 C.F.R. 164.304.
• "Services" means the DentalSlip services described in Section 2, including the E-Signature Services.
• "E-Signature Services" means the DentalSlip electronic signature services described in Section 2.1.
• "Signature Document" means a document that Covered Entity uploads or prepares for signature through the E-Signature Services, together with the fields placed on it and the information Signers enter into it, at any stage before or after completion.
• "Signer" means any person whom Covered Entity designates to complete or sign a Signature Document, including a patient, a patient's personal representative, another person outside Covered Entity, or a member of Covered Entity's workforce.
• "Signing Request" means an email, including any reminder, that sends a Signer a link to complete or sign a Signature Document.
• "Signed Document" means a Signature Document that all Signers have signed, in its final form, including the Completion Certificate appended to it.
• "Audit Trail" means the record the E-Signature Services generate for a Signature Document, which may include events and their timestamps (such as sending, viewing, consent, signing, declining, voiding, expiration, and delivery of copies), Signer names and email addresses, IP addresses, browser user-agent information, each Signer's consent to use electronic records and signatures, and a cryptographic (SHA-256) hash of the Signed Document.
• "Completion Certificate" means the summary of the Audit Trail that the E-Signature Services append to a Signed Document.
• "Secretary" means the Secretary of the U.S. Department of Health and Human Services or the Secretary's designee.

2. Scope of Services

Business Associate may create, receive, maintain, or transmit PHI on behalf of Covered Entity only to provide the following Services: hosting referral forms and receiving the submissions made through them, including submissions by referring offices; storing referrals and the notes and status changes attached to them; sending notifications; generating PDF and printable copies; the E-Signature Services; customer support Covered Entity requests; and the hosting, backup, security, and maintenance activities needed to deliver those Services.

2.1 E-Signature Services. The E-Signature Services allow Covered Entity's authorized users to upload documents, such as patient intake, consent, and medical history forms and business documents, convert them to PDF, place fields, designate Signers, and send Signing Requests; allow Signers to review, complete, and sign Signature Documents in a web browser; record each Signer's consent to use electronic records and signatures; generate the Audit Trail and Completion Certificate; store Signature Documents and Signed Documents; and deliver copies of Signed Documents as Section 3.6 describes. Signature Documents, the information Signers enter, and Audit Trails may contain PHI. Signing Requests and notification emails generated by the E-Signature Services are designed to contain a link and limited identifying information, not the contents of the Signature Document.

2.2 Documents without PHI. Covered Entity may also use the E-Signature Services for documents that contain no PHI, such as leases or vendor agreements. Business Associate will handle those documents with the same safeguards and retention, export, and deletion terms that apply to PHI under Sections 4 and 11. Information that is not PHI does not become PHI because it is handled through the Services, and the PHI-specific obligations in this BAA apply only to PHI. Business Associate does not review the contents of Signature Documents. Information in any Signature Document that is PHI remains PHI and subject to this BAA regardless of how Covered Entity labels or configures the document.

3. Permitted Uses and Disclosures

3.1 Services. Business Associate may use and disclose PHI only as needed to perform the Services, as this BAA allows, or as Required by Law.

3.2 Management and administration. Business Associate may use PHI for its proper management and administration or to carry out its legal responsibilities. It may disclose PHI for those purposes only if (a) the disclosure is Required by Law, or (b) Business Associate first obtains reasonable written assurances from the recipient that the PHI will be held confidentially, used or further disclosed only as Required by Law or for the purpose for which it was disclosed, and that the recipient will notify Business Associate of any instance it knows of in which the confidentiality of the PHI has been breached.

3.3 Privacy Rule limit. Except as Section 3.2 allows, Business Associate will not use or disclose PHI in any manner that would violate Subpart E of 45 C.F.R. Part 164 if done by Covered Entity.

3.4 Minimum necessary. Business Associate will limit its requests for, uses of, and disclosures of PHI to the minimum necessary to accomplish the intended purpose, consistent with 45 C.F.R. 164.502(b) and 164.514(d) and with any minimum necessary policies Covered Entity provides to Business Associate in writing.

3.5 Prohibited uses. Business Associate will not sell PHI or use or disclose PHI for marketing or fundraising. Business Associate will not de-identify PHI or perform data aggregation services unless Covered Entity agrees in writing.

3.6 Signing Requests and signed copies. At Covered Entity's direction, Business Associate may (a) send Signing Requests to the Signers and email addresses Covered Entity designates; (b) display a Signature Document to each Signer for completion and signature; and (c) after all Signers have signed, deliver a copy of the Signed Document to the Signers. A Signer who is not an authorized user of Covered Entity's account will receive a copy by email only if Covered Entity has not turned off emailed copies for that template or document and the Signer has affirmatively chosen to receive the copy by email after being informed that email may not be secure. Signers cannot download a Signature Document before all Signers have signed. Each such disclosure is made on behalf of and at the direction of Covered Entity. A copy delivered to a Signer who is the individual who is the subject of the PHI, or that individual's personal representative, is intended as a disclosure to the individual under 45 C.F.R. 164.502(a)(1)(i), and, to the extent the individual requests it, as a copy provided in the electronic form and format the individual requests, including by unencrypted email at the individual's request after being advised of the risk, consistent with 45 C.F.R. 164.524(c)(2)(ii). Covered Entity is responsible for determining that any disclosure to any other Signer is permitted under Subpart E of 45 C.F.R. Part 164.

3.7 Signer identity and Covered Entity choices. The E-Signature Services associate a Signer with a Signature Document based on access through the signing link sent to the email address Covered Entity provides for that Signer, together with any additional verification step the E-Signature Services apply or Covered Entity adds. Business Associate does not otherwise verify a Signer's identity or authority, including authority to act as a personal representative. Covered Entity is responsible for choosing which documents and PHI to send, to whom, and at which email addresses, and for deciding whether additional verification is appropriate.

4. Safeguards

4.1 Business Associate will use appropriate administrative, physical, and technical safeguards, and will comply with Subpart C of 45 C.F.R. Part 164 (the Security Rule) for Electronic Protected Health Information, to prevent any use or disclosure of PHI other than as this BAA provides.

4.2 These safeguards include access controls with two-step sign-in, encryption of PHI in transit and at rest, audit logging, workforce training, and restricting workforce access to those who need it to perform the Services.

4.3 For the E-Signature Services, these safeguards also include signing links that expire, making completed Signed Documents viewable in the product only by authenticated users of Covered Entity's account, and recording a cryptographic hash and Audit Trail for each Signed Document so that later alteration can be detected.

5. Reporting

5.1 Breaches of Unsecured PHI. Business Associate will notify Covered Entity of any Breach of Unsecured PHI without unreasonable delay, and in no case later than thirty (30) calendar days after discovery, or any shorter period stated in an order form. The notice will contain the information described in Section 5.4. A Breach is treated as discovered as provided in 45 C.F.R. 164.410(a)(2).

5.2 Other unpermitted uses or disclosures. Business Associate will report to Covered Entity any use or disclosure of PHI not provided for by this BAA, whether or not it is a Breach, without unreasonable delay and no later than thirty (30) calendar days after discovery.

5.3 Security Incidents. Business Associate will report to Covered Entity any Security Incident of which it becomes aware, without unreasonable delay and no later than thirty (30) calendar days after discovery. The Parties agree that this Section is notice, now and for the future, of unsuccessful Security Incidents for which no further notice is required. Unsuccessful Security Incidents include pings, port scans, broadcast attacks, unsuccessful log-in attempts, denial-of-service attempts, and similar events that do not result in unauthorized access to, or use, disclosure, modification, or destruction of, PHI or interference with system operations.

5.4 Contents of a Breach notice. A notice under Section 5.1 will include, to the extent available, the identity of each individual whose Unsecured PHI has been, or is reasonably believed to have been, accessed, acquired, used, or disclosed, and any other information Covered Entity needs to notify individuals under 45 C.F.R. 164.404(c). Business Associate will supplement the notice as more information becomes available.

5.5 Notifications to individuals, HHS, and the media. Covered Entity is responsible for deciding whether a Breach requires notice and for notifying affected individuals, the Secretary, and the media where required under 45 C.F.R. 164.404 through 164.408. Business Associate will cooperate and provide the information Covered Entity reasonably needs to do so. If a Breach results from Business Associate's or its Subcontractor's violation of this BAA, Business Associate will reimburse Covered Entity's reasonable costs of those required notifications, subject to Section 13.8.

5.6 Mitigation. Business Associate will mitigate, to the extent practicable, any harmful effect known to it of a use or disclosure of PHI by Business Associate or its Subcontractors in violation of this BAA.

6. Subcontractors

In accordance with 45 C.F.R. 164.502(e)(1)(ii) and 164.308(b)(2), Business Associate will ensure that any Subcontractor that creates, receives, maintains, or transmits PHI on behalf of Business Associate agrees in writing to the same restrictions, conditions, and requirements that apply to Business Associate under this BAA, including compliance with the Security Rule. This includes Subcontractors that provide cloud hosting, storage, and email delivery for the Services, including the E-Signature Services. Business Associate will provide a current list of Subcontractors that handle PHI on request.

7. Individual Rights

7.1 Access. Covered Entity can view, download, and print referrals and Signed Documents, including Completion Certificates, directly in the product. For PHI that Covered Entity cannot retrieve itself, Business Associate will make it available to Covered Entity, in the form and format requested where readily producible, within ten (10) business days of a request, so Covered Entity can meet its obligations under 45 C.F.R. 164.524.

7.2 Amendment. Business Associate will make PHI available for amendment and will incorporate any amendment Covered Entity directs or agrees to under 45 C.F.R. 164.526, within ten (10) business days of the direction. The product records amendments separately from the original submission so both remain available.

7.3 Accounting of disclosures. Business Associate will document disclosures of PHI, and the information related to them, that Covered Entity would need to respond to a request for an accounting under 45 C.F.R. 164.528. For the E-Signature Services, the Audit Trail records each Signing Request and each delivery of a copy of a Signed Document. It will provide that information to Covered Entity within ten (10) business days of a request.

7.4 Requests received directly. If an individual asks Business Associate directly for access, amendment, or an accounting, Business Associate will forward the request to Covered Entity within five (5) business days and will not respond to the individual unless Covered Entity directs it to.

7.5 Signed Documents and the Designated Record Set. Covered Entity decides whether Signed Documents, Completion Certificates, or Audit Trails form part of its Designated Record Set. To the extent Covered Entity so treats them, Sections 7.1 and 7.2 apply to them. Because a Signed Document is locked and hashed on completion, Business Associate will record any amendment under Section 7.2 as a separate record linked to the Signed Document, consistent with 45 C.F.R. 164.526(c)(1), rather than altering the Signed Document, its Completion Certificate, or its Audit Trail, so that the original and the amendment both remain available.

8. Covered Entity Obligations Performed by Business Associate

To the extent Business Associate carries out any of Covered Entity's obligations under Subpart E of 45 C.F.R. Part 164, Business Associate will comply with the requirements of Subpart E that apply to Covered Entity in performing those obligations.

9. Access by the Secretary

Business Associate will make its internal practices, books, and records relating to the use and disclosure of PHI available to the Secretary for purposes of determining compliance with the HIPAA Rules.

10. Term and Termination

10.1 Term. This BAA takes effect when an owner or administrator of Covered Entity's account accepts it in the product. That person confirms on acceptance that they are authorized to bind Covered Entity. The BAA continues for the subscription term and any export, deletion, or backup-expiration period under Section 11, unless terminated earlier under this Section. Termination does not end the protections and obligations applicable to PHI that Business Associate or its Subcontractors retain, including PHI in retained compliance records. Those protections and obligations continue for as long as that PHI is retained.

10.2 Termination for cause by Covered Entity. If Covered Entity determines that Business Associate has violated a material term of this BAA, Covered Entity may (a) give Business Associate written notice and thirty (30) calendar days to cure the violation, and terminate this BAA and the subscription if it is not cured, or (b) terminate this BAA and the subscription immediately if cure is not possible.

10.3 Termination for cause by Business Associate. If Business Associate determines that Covered Entity has violated a material term of this BAA, Business Associate may give Covered Entity written notice and thirty (30) calendar days to cure, and terminate this BAA and the subscription if it is not cured.

10.4 Effect on subscription. Termination of this BAA ends Business Associate's right to receive new PHI on Covered Entity's behalf. Published forms will stop accepting submissions, and outstanding Signing Requests can no longer be completed.

11. Retention, Export, and Destruction of PHI

11.1 Office-selected cleanup during the subscription. Covered Entity may select an automatic cleanup period of one (1), three (3), or seven (7) years for submitted referrals, or select no automatic cleanup. The default is three (3) years. The period runs from each referral's submission date. Cleanup applies to the referral submission and its attachments, notes, and status history (together, "Referral Content"), subject to Sections 11.5 and 11.6. Business Associate will display a reminder that Covered Entity should save referrals into its patient charts. Selecting no automatic cleanup does not prevent deletion following cancellation or termination under this Section. The same selected period applies to Signature Documents. It runs from the date each Signed Document is completed or, for a Signature Document that is declined, voided, or expires before completion, from the date of that event. Cleanup applies to the Signature Document together with its Completion Certificate and Audit Trail, which are kept and deleted together, subject to Sections 11.5 and 11.6. Templates and documents uploaded but not yet sent remain until Covered Entity deletes them or until deletion under Section 11.3. "Signature Content" means Signature Documents, Signed Documents, Completion Certificates, Audit Trails, and the templates and uploaded documents Covered Entity keeps in the E-Signature Services. These settings are Covered Entity's instructions for storage in DentalSlip; they are not recommendations concerning legally required medical-record retention periods.

11.2 Export following cancellation or termination. When the subscription ends or this BAA is terminated under Section 10, forms will stop accepting new submissions and outstanding Signing Requests can no longer be completed. Covered Entity will have ninety (90) calendar days from that date to access and export its remaining Referral Content and Signature Content through read-only access, unless the Parties agree in writing to a different period. Export will include referral submissions, attachments, notes, and status history, and Signed Documents with their Completion Certificates and Audit Trails. Automatic cleanup under Section 11.1 will be paused during this export period. Business Associate will not condition access to or export of PHI during this period on payment of disputed or outstanding subscription fees. All retained PHI remains protected under this BAA throughout the export period and subsequent deletion and backup-expiration periods.

11.3 Deletion of Referral Content and Signature Content. At the end of the export period, Business Associate will permanently delete the remaining Referral Content and Signature Content from active systems and require its Subcontractors to do the same, subject only to Sections 11.5 and 11.6. Business Associate will retain a deletion record identifying the office, the categories of records deleted, and the date of deletion, without retaining the deleted referral content or Signature Content in that record. On request, Business Associate will certify completion of deletion in writing, identifying any backup copies awaiting expiration and any information retained under Sections 11.5 or 11.6.

11.4 Backup expiration. Referral Content and Signature Content deleted under Section 11.1 or 11.3 may remain in protected backups until the normal backup rotation removes it, which will occur no later than seven (7) calendar days after deletion from active systems. Such copies will not be used for ordinary business purposes and will remain protected under this BAA. If a backup is restored for disaster recovery, Business Associate will reapply applicable deletions before making restored Referral Content or Signature Content available for ordinary use.

11.5 Limited retention of compliance records. Business Associate may retain BAA versions and acceptance records, deletion records, disclosure-accounting records, and security and activity logs needed to document compliance, investigate incidents, and meet applicable legal obligations. Retention will be limited to information reasonably necessary for those purposes and will not include copies of complete referrals, attachments, or Signed Documents merely for convenience. Audit Trail event records may be retained under this Section as security and activity logs, without the contents of the Signed Document. Required HIPAA documentation will be retained for at least six (6) years from its creation or the date it was last in effect, whichever is later. Business Associate's policy is to retain security and activity logs for six (6) years from the recorded event and disclosure-accounting records for six (6) years from the disclosure, unless applicable law requires a longer period or Section 11.6 applies. This log-retention policy does not represent that HIPAA requires every activity log to be retained for six years. Records will be deleted when the applicable retention period expires, subject to Section 11.6 and the backup-expiration process in Section 11.4. Compliance records may themselves contain PHI; any such PHI remains subject to this BAA, may be used or disclosed only for the purposes justifying retention or as Required by Law, and remains available to Covered Entity as needed to meet its applicable HIPAA obligations. Retention under this Section is an express exception to deletion of Referral Content and Signature Content and does not authorize continued operational use of deleted referrals or Signature Documents.

11.6 Legal retention and infeasibility. If return or destruction of particular PHI is infeasible, including because preservation is Required by Law, Business Associate will notify Covered Entity of the affected categories of PHI and the conditions preventing return or destruction, to the extent legally permitted. Business Associate will retain only the PHI necessary, extend this BAA's protections to it, and limit further uses and disclosures to the purposes making return or destruction infeasible. Business Associate will reassess the need for retention and return or destroy the PHI when those conditions end.

12. Obligations of Covered Entity

Covered Entity will:

• notify Business Associate of any limitation in its notice of privacy practices, any change in or revocation of an individual's permission, and any restriction on use or disclosure it has agreed to, to the extent it may affect Business Associate's use or disclosure of PHI;
• not ask Business Associate to use or disclose PHI in any manner that would not be permissible under Subpart E of 45 C.F.R. Part 164 if done by Covered Entity, except as Section 3.2 allows;
• configure its forms to request only the PHI it needs for referrals, and include in Signature Documents only the PHI needed for their purpose;
• choose which documents to send for signature, designate Signers and their email addresses accurately, decide whether to allow emailed copies for each template, and keep PHI out of any custom email subject or message it adds to a Signing Request; and
• select and review its referral cleanup setting, save Referral Content and Signed Documents into its patient charts as appropriate, and satisfy applicable medical-record retention requirements. DentalSlip is not a substitute for Covered Entity's patient chart or records-retention program. Covered Entity remains responsible for those requirements even if it selects a shorter cleanup period or cancels its subscription.

Validity of electronic signatures. Business Associate does not provide legal advice and does not determine whether an electronic signature or electronic record is valid, enforceable, or appropriate for any particular document, Signer, or jurisdiction, including under the federal ESIGN Act or the Uniform Electronic Transactions Act as adopted in any state. Covered Entity is responsible for making that determination, including for documents that law excludes from electronic signature or that require additional formalities.

13. General Terms

13.1 Regulatory references. A reference to a section of the HIPAA Rules means that section as in effect or as amended.

13.2 Amendment. The Parties will amend this BAA as needed for compliance with changes to the HIPAA Rules. Business Associate may publish an updated version for that purpose or to reflect additions to or changes in the Services. The updated version takes effect when the account owner accepts it in the product, or thirty (30) days after notice to Covered Entity, whichever is earlier.

13.3 Interpretation. Any ambiguity in this BAA will be resolved in favor of a meaning that permits the Parties to comply with the HIPAA Rules.

13.4 Order of precedence. If this BAA conflicts with the DentalSlip Terms of Use, an order form, or any other agreement between the Parties about PHI, this BAA controls.

13.5 Survival. Sections 5, 9, 11, and 13, and Business Associate's obligations for any PHI it retains, survive termination of this BAA.

13.6 No third-party beneficiaries. Nothing in this BAA confers any rights or remedies on anyone other than the Parties and their permitted successors and assigns.

13.7 Notices. Notices to Business Associate under this BAA will be sent to UCPlaces LLC at info@dentalslip.com and 303 Maple Ave W, Suite F, Vienna, VA 22180. Notices to Covered Entity will be sent to the email address of the account owner on file in the product.

13.8 Limitation of liability. Each Party's liability arising out of or relating to this BAA is subject to the limitation of liability in the DentalSlip Terms of Use or in a signed order form. Section 13.4 does not override that limitation.

13.9 Governing law. This BAA is governed by the laws of the Commonwealth of Virginia, except to the extent federal law, including the HIPAA Rules, applies. Venue is as stated in the DentalSlip Terms of Use.