Chartnote Business Associate Agreement
Self-Serve Edition — Version 2.2.1
Posted September 6, 2026. Effective upon acceptance for new accounts, and on September 16, 2026 for existing accounts.
This Business Associate Agreement (this "BAA") is entered into by and between Chartnote, Inc., a Delaware corporation ("Business Associate"), and the organization or individual agreeing to the terms of this BAA ("Customer") as indicated in the order form, subscription agreement, or terms of use referencing or otherwise incorporating this BAA (each or collectively, the "Agreement"). For purposes of this BAA, the "Agreement" includes the Chartnote Terms of Use (chartnote.com/termsOfUse) and, where applicable, the Chartnote Master Subscription Agreement (chartnote.com/msa) (the "MSA"). Business Associate and Customer are each a "Party" and together the "Parties" to this BAA. This BAA applies only to the extent Business Associate creates, receives, maintains, or transmits Protected Health Information for or on behalf of Customer in the course of providing the Services.
Customer accepts this BAA by clicking to accept it, by accepting the Terms of Use or an order form that references or incorporates it, or by using the Services in a manner that involves Protected Health Information, whichever occurs first. Every Chartnote account, including free and trial accounts, is covered by this BAA from first use.
1.DEFINITIONS
Capitalized terms used but not defined in this BAA have the meanings given in the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations at 45 C.F.R. Parts 160 and 164, each as amended, including by the Health Information Technology for Economic and Clinical Health Act ("HIPAA"). The following terms have the meanings given in HIPAA: "Breach," "Data Aggregation," "Designated Record Set," "Electronic Protected Health Information" ("ePHI"), "Individual," "Privacy Rule," "Required by Law," "Secretary," "Security Incident," "Security Rule," "Subcontractor," and "Unsecured Protected Health Information."
"Protected Health Information" or "PHI" means Protected Health Information as defined in 45 C.F.R. § 160.103, limited to the information Business Associate creates, receives, maintains, or transmits for or on behalf of Customer under the Agreement. "Services" means the Chartnote websites, web and mobile applications, browser extensions, and related services provided under the Agreement.
2.PERMITTED USES AND DISCLOSURES
2.1 Services. Business Associate may use and disclose PHI as necessary to provide the Services to Customer under the Agreement, as permitted by this BAA, or as Required by Law, and for no other purpose.
2.2 Management and Administration. Business Associate may use PHI as necessary for its proper management and administration and to carry out its legal responsibilities.
2.3 Disclosure for Management and Administration. Business Associate may disclose PHI for its proper management and administration or to carry out its legal responsibilities if the disclosure is Required by Law, or if Business Associate obtains reasonable assurances from the recipient that the PHI will be held confidentially, used or further disclosed only as Required by Law or for the purposes for which it was disclosed, and that the recipient will notify Business Associate of any instance of which it becomes aware in which the confidentiality of the PHI has been breached.
2.4 Data Aggregation. Business Associate may use PHI to provide Data Aggregation services relating to the health care operations of Customer as permitted by 45 C.F.R. § 164.504(e)(2)(i)(B).
2.5 No De-identification for Business Associate’s Own Purposes; No AI Training. Business Associate does not create de-identified data sets from PHI for its own purposes, and does not use PHI or Customer Content to train artificial intelligence or machine learning models. Any de-identification of PHI will be performed only at Customer’s written direction and in accordance with 45 C.F.R. § 164.514(a)–(c). These commitments are restated in the Chartnote Privacy Policy (chartnote.com/privacyPolicy) and the Terms of Use.
2.6 Minimum Necessary. Business Associate will limit its uses, disclosures, and requests of PHI to the minimum necessary to accomplish the intended purpose, consistent with 45 C.F.R. § 164.502(b).
3.OBLIGATIONS OF THE PARTIES
3.1 Obligations of Business Associate. Business Associate agrees to:
(a) not use or disclose PHI other than as permitted or required by this BAA or as Required by Law;
(b) use appropriate safeguards, and comply with the Security Rule with respect to ePHI, to prevent use or disclosure of PHI other than as provided for by this BAA, including administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of ePHI;
(c) mitigate, to the extent practicable, any harmful effect known to Business Associate of a use or disclosure of PHI in violation of this BAA;
(d) report to Customer any use or disclosure of PHI not provided for by this BAA of which it becomes aware, including any Breach of Unsecured Protected Health Information as required by 45 C.F.R. § 164.410, without unreasonable delay and in no case later than ten (10) business days after discovery, and any Security Incident of which it becomes aware; provided that this Section constitutes notice to Customer, and no further notice will be given, of the ongoing existence and occurrence of attempted but unsuccessful Security Incidents (such as pings, port scans, denial-of-service attempts, and malware that is blocked) for which no additional notice is required;
(e) in accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2), ensure that any Subcontractor that creates, receives, maintains, or transmits PHI on behalf of Business Associate agrees in writing to restrictions and conditions at least as restrictive as those that apply to Business Associate under this BAA, including compliance with the Security Rule with respect to ePHI; a current list of Subcontractors is available through the Chartnote Trust Center at trust.chartnote.com;
(f) make its internal practices, books, and records relating to the use and disclosure of PHI available to the Secretary for purposes of determining compliance with HIPAA;
(g) maintain and make available to Customer the information required to provide an accounting of disclosures of PHI as necessary to satisfy Customer’s obligations under 45 C.F.R. § 164.528;
(h) upon receiving a written request from Customer, make available (in accordance with 45 C.F.R. § 164.524) Protected Health Information necessary for Customer to respond to Individuals’ requests for access, to the extent the Protected Health Information in Business Associate’s possession constitutes a Designated Record Set; and
(i) to the extent the Protected Health Information in Business Associate’s possession constitutes a Designated Record Set, make available, upon written request by Customer, Protected Health Information for amendment and incorporate any amendments as directed by Customer, in accordance with 45 C.F.R. § 164.526.
3.2 Responsibilities of Customer. With regard to the use and/or disclosure of Protected Health Information by Business Associate, Customer agrees: (i) to obtain any consent, authorization or permission that may be required by the Privacy Rule or any other applicable federal, state or local laws and/or regulations prior to furnishing Business Associate the Protected Health Information pertaining to an Individual; (ii) to inform Business Associate of any changes in, or revocation of, an authorization provided to Customer by an Individual pursuant to 45 C.F.R. § 164.508, to the extent such changes or revocation affect Business Associate’s permitted or required uses and disclosures; (iii) not to furnish Business Associate Protected Health Information that is subject to restrictions or arrangements agreed to by Customer under 45 C.F.R. § 164.522 that would impact Business Associate’s use and/or disclosure of Protected Health Information under this BAA, without first notifying Business Associate; and (iv) to inform Business Associate of any amendments to Protected Health Information agreed to by Customer under 45 C.F.R. § 164.526 that relate to Protected Health Information upon which Business Associate relies to perform the Services.
(a) Customer represents and warrants that its notice of privacy practices permits Customer to use and disclose Protected Health Information in the manner that Business Associate is authorized to use and disclose Protected Health Information under this BAA.
(b) Customer shall be responsible for providing all notices to Individuals, and to any state, federal, or other authorities, of any breach of Protected Health Information, except as otherwise required of Business Associate by applicable law.
(c) Customer shall not request that Business Associate use or disclose Protected Health Information in any manner that would not be permissible under the Privacy Rule if done by Customer.
(d) Where Customer is an individual clinician using the Services in connection with a healthcare facility, employer, or other organization, Customer represents that its use of the Services is authorized by that organization, as further described in Section 2.4 of the Terms of Use.
3.3 Customer as Business Associate. To the extent Customer is itself a business associate of a covered entity and the PHI processed under this BAA is PHI of that covered entity, Business Associate acts as a Subcontractor of Customer, references in this BAA to Customer’s obligations as a covered entity are construed accordingly, and Customer represents and warrants that its agreement with the applicable covered entity permits Customer to engage Business Associate as a subcontractor on the terms of this BAA.
4.TERM AND TERMINATION
4.1 Term. This BAA is effective upon Customer’s acceptance as described above and continues until the Agreement expires or is terminated, or until this BAA is terminated in accordance with this Section, whichever occurs first.
4.2 Termination for Cause. Either Party may terminate this BAA and the applicable portion of the Agreement if the other Party materially breaches this BAA and fails to cure the breach within thirty (30) days after receiving written notice of the breach, or immediately if cure is not possible.
4.3 Effect of Termination. Upon termination of this BAA for any reason, Business Associate will, at Customer’s election exercised through the Services or by written notice, return or destroy all PHI that Business Associate maintains in any form, and retain no copies, except that if return or destruction is infeasible, Business Associate will extend the protections of this BAA to the retained PHI, limit further uses and disclosures to those purposes that make return or destruction infeasible, and destroy the PHI when it becomes feasible to do so. Retention and auto-delete settings configured in the Services satisfy Customer’s election with respect to the content they govern.
4.4 Survival. The obligations of Business Associate under Section 4.3 and any provision that by its nature should survive shall survive termination of this BAA.
5.GENERAL PROVISIONS
5.1 Regulatory References. A reference in this BAA to a section in HIPAA means the section as in effect or as amended.
5.2 Interpretation. Any ambiguity in this BAA shall be interpreted to permit compliance with HIPAA. Nothing in this BAA is intended to make either Party the agent of the other or to create a partnership or joint venture between the Parties.
5.3 No Third-Party Beneficiaries. Nothing in this BAA confers any rights or remedies upon any person other than the Parties and their respective successors and permitted assigns.
5.4 Independent Contractors. The Parties are independent contractors.
5.5 Amendment. The Parties agree to take such action as is necessary to amend this BAA from time to time as required for compliance with HIPAA. Business Associate may amend this BAA by posting an updated version at chartnote.com/baa and providing at least ten (10) days’ advance notice by email and/or prominent notice within the Services before the amendment becomes effective, consistent with Section 29 of the Terms of Use and Section 10.10 of the MSA; provided that amendments required by changes in applicable law may become effective as required by such law. Customer’s continued use of the Services after the effective date constitutes acceptance of the amended BAA.
5.6 Notices. Notices from Business Associate to Customer may be given by email to the address associated with Customer’s account and/or by prominent notice within the Services. Notices from Customer to Business Associate concerning this BAA, including privacy matters and formal legal requests, shall be sent by email to privacy@chartnote.com, with a copy by mail to Chartnote, Inc., 2062 John Jones Rd, Ste 130, Davis, CA 95616, Attn: Legal.
5.7 Assignment. Neither Party may assign this BAA without the other Party’s consent, except that Business Associate may assign this BAA in connection with a merger, acquisition, or sale of all or substantially all of its assets, subject to Section 8.4 of the Chartnote Privacy Policy and applicable law.
5.8 Severability. If any provision of this BAA is held invalid or unenforceable, the remaining provisions remain in full force and effect.
5.9 Waiver. No failure or delay in exercising any right under this BAA constitutes a waiver of that right.
5.10 Governing Law. This BAA is governed by the laws of the State of California, consistent with the governing-law provisions of the Agreement (Section 26 of the Terms of Use and Section 10.1 of the MSA), without regard to conflict-of-laws principles, except to the extent preempted by federal law, including HIPAA.
5.11 Electronic Acceptance; Counterparts. This BAA may be accepted electronically, and electronic acceptance has the same force and effect as an original signature. Upon request to privacy@chartnote.com, Business Associate will provide Customer a countersigned copy of this BAA for Customer’s compliance records.
5.12 Order of Precedence. With respect to the use and disclosure of PHI, this BAA controls over any conflicting provision of the Agreement. For all matters concerning limitation of liability, Section 9 of the MSA governs as set forth in Section 6.3 below; for all other matters, the Agreement controls.
6.LIABILITY
6.1 Exclusion of Certain Damages. Except with respect to liability that cannot be limited under applicable law, neither Party shall be liable to the other for indirect, incidental, special, consequential, exemplary, or punitive damages, or for lost profits, revenues, or data, arising under or relating to this BAA, except as and to the extent provided in the liability regime referenced in Section 6.3.
6.2 Liability That Cannot Be Limited. Nothing in this BAA limits liability for a Party’s gross negligence, willful misconduct, or fraud, or liability that cannot be limited under applicable law.
6.3 Liability Cap. Except as provided in Section 6.2, each Party’s aggregate liability arising under or relating to this BAA shall be subject to the limitations and exclusions of liability set forth in Section 9 of the MSA (or, where the MSA does not apply to Customer’s account, the corresponding limitation-of-liability provisions of the Agreement, which incorporate Section 9 of the MSA by reference), which the Parties agree constitute the single liability regime applicable to claims arising under this BAA, the Agreement, and the Chartnote Terms of Use. In summary and without limiting Section 9 of the MSA, breaches of this BAA are subject to the enhanced cap of three (3) times the fees paid or payable by Customer in the twelve (12) months preceding the first event giving rise to liability, not to exceed one million dollars ($1,000,000), with a floor of one thousand dollars ($1,000) for free and trial accounts.
Version History
Version 2.2.1 (September 2026): harmonized liability regime with the Terms of Use and MSA; ten-day amendment notice; privacy@chartnote.com designated for notices and legal requests; no-AI-training and no-de-identification commitments stated; Subcontractor list referenced to the Trust Center; entity name updated to Chartnote, Inc.