This Business Associate Agreement (“Agreement”) is made and entered into between Sound Off, Inc., a Texas nonprofit corporation (“Sound Off”) and you, the individual or entity accepting this Agreement in the Application as the Counselor described herein (“Counselor”), upon your electronic affirmation.

This Agreement shall become effective on the later of (i) January 1, 2027 and (ii) the date of your electronic affirmation (the “Effective Date”). Notwithstanding the foregoing, from the date of your electronic affirmation until the Effective Date, (a) Sound Off shall handle any User information in its possession on a confidential basis in accordance with paragraph 5.1 (construing this Agreement as a general confidentiality agreement), and (b) the obligations of Sound Off under paragraphs 2.6 (mitigation) and 2.7 (reporting) shall apply to any such information.

RECITALS

A. Sound Off operates a program (the “Sound Off Program”) for veterans and military service members (“Users”) to obtain on-line support services that may be provided by licensed counselors and/or other practitioners such as Counselor (the “Counselors”).

B. Counselor is a licensed counselor and has been engaged to provide certain sub-clinical support services to Users within the scope of Counselor’s licensure.

C. Although Users of the Sound Off Program receive sub-clinical support services from the Counselors, out of an abundance of caution, Sound Off has decided to handle User Information in accordance with the provisions of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), the Health Information Technology for Economic and Clinical Health Act of 2009 (“HITECH”), the standards for the Privacy of Individually Identifiable Health Information (“Privacy Rule”), the standards for the Security of Electronic Protected Health Information (the “Security Rule”) and the Breach Notification Rule which regulations were promulgated by the United States Department of Health and Human Services (“DHHS”) pursuant to HIPAA and HITECH. The term “HIPAA,” is used to refer to HIPAA, HITECH, and all of the Rules promulgated thereto.

D. Accordingly, for the foregoing reasons, Sound Off and Counselor desire to enter into an agreement that complies with all the requirements of HIPAA regarding business associate “satisfactory assurances.”

NOW, THEREFORE, in consideration of the foregoing and of the mutual promises contained herein, Sound Off and Counselor agree as follows:

1. DEFINITION OF TERMS

1.1 Any terms used in this Agreement, including “Protected Health Information,” “PHI,” and “EPHI” that are defined in HIPAA shall have the same meaning when used in this Agreement as they have in HIPAA.

2. OBLIGATIONS OF SOUND OFF

2.1 Sound Off is authorized to access, generate, maintain, use, disclose or transmit PHI and EPHI only on behalf of or for Counselor as necessary and appropriate to perform Sound Off’s nonprofit mission services of offering sub-clinical mental health resources for veterans, service members, intelligence officers and such other first responders or other users to whom Sound Off extends its services from time to time, on an application platform that allows both anonymity and repeat contact with Counselors or Peer Supporters.

2.2 Except as otherwise limited in this Agreement, Sound Off may also use and disclose PHI and EPHI for the proper management and administration of Sound Off or to carry out the legal responsibilities of Sound Off, and as required by law, all in accordance with the terms of 45 CFR 164.502 and 164.504.

2.3 Sound Off shall not use or further disclose PHI and EPHI other than as permitted or required by this Agreement or as required by law. Sound Off acknowledges that it may be directly liable to the government for fines and other sanctions imposed by DHHS, and the State Attorney General for non-compliance with this Agreement.

2.4 Sound Off agrees to use appropriate safeguards to prevent use or disclosure of PHI and EPHI other than as provided for by this Agreement. Sound Off further agrees to implement the requirements of the Security Rule to protect EPHI in its possession, including administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of the EPHI that it creates, receives, maintains, or transmits on behalf of Counselor.

2.5 In making a permitted or required use or disclosure of PHI or EPHI, Sound Off shall comply with HIPAA’s minimum necessary requirements.

2.6 Sound Off agrees to perform such activities as are necessary or appropriate to mitigate, to the extent practicable, any harmful effect that is either independently known to Sound Off or brought to Sound Off’s attention by Counselor, as a result of a wrongful use or disclosure of PHI or EPHI by Sound Off. This obligation is in addition to the obligations stated in paragraph 2.7 of this Agreement.

2.7 Sound Off agrees to report to Counselor any use or disclosure of PHI or EPHI in violation of this Agreement. Without limiting the generality of the first sentence of this paragraph, Sound Off agrees to notify Counselor of any Breach of unsecured PHI or EPHI that Sound Off discovers or should reasonably have discovered. Sound Off further agrees to report to Counselor, at such time and in such manner as Counselor determines and requests, any successful security incident regarding EPHI of which it becomes aware. Security incidents could include the following types of activity, but are not limited to: attempts to gain unauthorized access to EPHI or a system that contains EPHI; unwanted disruption or denial of service to systems that contain EPHI; unauthorized use of a system for the processing or storage of EPHI data; changes to system hardware, firmware, or software characteristics without the owner’s knowledge, instruction, or consent. Sound Off shall provide notification of a successful security incident or Breach within five (5) business days of the date upon which it discovered the Breach or successful security incident. Sound Off shall cooperate with Counselor in the investigation of a security incident or Breach, preparation and distribution of notices of the Breach to the affected individuals, and with providing notice to DHHS and media outlets as required by HIPAA. Sound Off shall pay all expenses of applicable investigations and Breach notification whenever Sound Off caused the security incident or Breach.

2.8 Sound Off agrees to ensure that any agent, including a subcontractor, that creates, receives, maintains, or transmits PHI or EPHI received from, or created or received by Sound Off on behalf of Counselor, agrees to the same restrictions and conditions that apply through this Agreement to Sound Off, including that each such agent or subcontractor agrees to implement reasonable and appropriate safeguards to protect EPHI.

2.9 Sound Off agrees to notify Counselor within five (5) business days of receipt of a request by an individual for access to the individual’s PHI or EPHI.

2.10 Sound Off agrees to notify Counselor within five (5) business days of receipt of a request by an individual to amend the individual’s PHI or EPHI.

2.11 To the extent that Sound Off is required pursuant to this Agreement to carry out one or more of Counselor’s obligations under the Privacy Rule, Sound Off shall comply with the requirements of the Privacy Rule applicable to Counselor’s performance of such obligation.

2.12 Sound Off agrees to make its internal practices, books, and records relating to its use and disclosure of PHI and EPHI available to Counselor or the Secretary of DHHS (or his/her designee), for purposes of the Secretary of DHHS (or his/her designee) determining Counselor’s and Sound Off’s compliance with HIPAA, or for purposes of Counselor’s auditing and monitoring of Sound Off’s performance.

2.13 Sound Off agrees to document all disclosures, if any, of PHI and EPHI and information related to such disclosures as would be required for Counselor to respond to a request by an individual for an accounting of disclosures of PHI and EPHI in accordance with the Privacy Rule and HITECH. Within five (5) business days of Counselor’s request, Sound Off shall provide to Counselor the information so collected, to the extent reasonably within the possession or control of Sound Off, to permit Counselor to respond to a request by an individual for an accounting of disclosures of PHI and EPHI.

2.14 Sound Off agrees to honor any restriction on the use or disclosure of PHI or EPHI that Counselor agrees to, provided that Counselor notifies Sound Off of such restriction.

2.15 Sound Off shall establish specific procedures and mechanisms to implement Sound Off’s obligations pursuant to HIPAA and pursuant to this Agreement. Such procedures and mechanisms shall be in writing, and shall be available to Counselor for review upon request.

3. OBLIGATIONS OF COUNSELOR

3.1 Counselor shall provide Sound Off with the notice of privacy practices and minimum necessary policy that Counselor produces in accordance with the Privacy Rule, as well as any changes to such notice or policy.

3.2 Counselor shall notify Sound Off of any restriction to the use or disclosure of PHI and EPHI that Counselor has agreed to in accordance with the Privacy Rule.

3.3 Counselor shall not request Sound Off to use or disclose PHI or EPHI in any manner that would not be permissible under the Privacy Rule or the Security Rule if done by Counselor, except for uses or disclosures of PHI for the proper administration and management of Sound Off or as required by law.

4. TERM AND TERMINATION

4.1 The term of this Agreement shall commence on the Effective Date and shall continue conterminously with the term of all services being performed by Sound Off for or on behalf of Counselor that could reasonably and foreseeably involve PHI and EPHI, unless sooner terminated in accordance with paragraph 4.2 hereof.

4.2 Upon Counselor’s knowledge of a material breach by Sound Off, or Sound Off’s knowledge of a material breach by Counselor, Counselor or Sound Off (as applicable) shall, at its sole option, do either of the following:

4.2.1 Provide a 15 day opportunity for the breaching party to cure the breach to the satisfaction of the non-breaching party, or terminate this Agreement and the services relationship with Sound Off if the breaching party does not cure the breach to the satisfaction of the non-breaching party; or

4.2.2 Immediately terminate this Agreement and the services relationship with Sound Off without an opportunity to cure if the non-breaching party determines, in its sole discretion, that cure is not possible.

4.3 In addition to the termination for cause provisions stated in paragraph 4.2, this Agreement may also be terminated in any of the following circumstances:

4.3.1 The services relationship between Sound Off and Counselor is terminated for any reason;

4.3.2 The provisions of HIPAA are amended, modified or changed such that an Agreement such as this is no longer mandated;

4.3.3 By the mutual agreement of Counselor and Sound Off, provided that a new Agreement is substituted if the services relationship continues between Sound Off and Counselor and the relationship could foreseeably require Sound Off to access, use, generate, maintain, disclose or transmit PHI or EPHI.

4.4 Effect of Termination.

4.4.1 Except as provided in paragraph 4.4.2, upon termination of this Agreement for any reason, Sound Off shall return or destroy all PHI and EPHI, if any, received from Counselor, or created or received by Sound Off on behalf of Counselor. This provision shall apply to PHI and EPHI that is in the possession of subcontractors or agents of Sound Off. Sound Off shall retain no copies of PHI or EPHI.

4.4.2 In the event that Sound Off believes that returning or destroying PHI or EPHI in its entirety is infeasible, Sound Off shall provide to Counselor an explanation of the conditions that make return or destruction infeasible. Upon Counselor’s concurrence that return or destruction of PHI or EPHI is infeasible, Sound Off shall extend the protections of this Agreement to such PHI and limit further uses and disclosures of such PHI and EPHI to those purposes that make the return or destruction infeasible, for so long as Sound Off maintains such PHI or EPHI.

4.4.3 If this Agreement is terminated and not immediately replaced with a substitute business associate agreement, and if the Privacy Rule and/or the Security Rule in effect at that time continues to mandate the execution of a business associate agreement between covered entities and their business associates, then Sound Off shall immediately terminate the services provided to Counselor to the extent that Sound Off’s services could reasonably and foreseeably involve access, use, generation, maintenance, disclosure or transmission of PHI or EPHI.

5. GENERAL PROVISIONS

5.1 The parties agree that the terms and conditions of this Agreement shall be construed as a general confidentiality agreement that is binding upon the parties regardless of whether HIPAA applies to the relationships.

5.2 Counselor and Sound Off shall not be deemed to be partners, joint venturers, agents or employees of each other solely by virtue of the terms and conditions of this Agreement. Sound Off is an independent contractor of Counselor for all purposes, including the application of the federal common law.

5.3 This Agreement shall not be modified or amended except by a written document that is signed by both parties. Counselor and Sound Off agree to modify or amend this Agreement if HIPAA changes in a manner that affects the terms and conditions of this Agreement, or the obligations of covered entities and/or business associates.

5.4 Any communications between Counselor and Sound Off regarding this Agreement shall be in writing, whether or not oral communications have also occurred. Such communications shall be sent to the Parties at the contact information provided in connection with the Application, or as otherwise designated by a Party in writing from time to time.

5.5 Written communications may be sent by certified or registered U.S. Mail, receipted courier service, receipted hand delivery, receipted fax, or by receipted email.

5.6 No waiver of any provision of this Agreement, including this paragraph, shall be effective unless the waiver is in writing and signed by the party making the waiver.

5.7 This Agreement is entered into solely for the benefit of the parties, and is not entered into for the benefit of any third party, including without limitation, any patients of Counselor or their legal representatives.

5.8 This Agreement is not assignable or delegable without the express advance written consent of the party not seeking to assign or delegate.

5.9 This Agreement shall be governed by and construed in accordance with the laws of the United States of America and the laws of the state of Texas. This Agreement shall be interpreted and construed so as to render it compliant with HIPAA.

5.10 If any provision of this Agreement is determined by a court of competent jurisdiction to be invalid or unenforceable, this Agreement shall be construed as though such invalid or unenforceable provision were omitted, provided that the remainder of this Agreement continues to satisfy all of HIPAA requirements for a business associate agreement. If it does not, then the parties shall immediately renegotiate this Agreement so that it does comply with the requirements of HIPAA or terminate this Agreement and the service relationship between Sound Off and Counselor to the extent that Sound Off’s services could reasonably and foreseeably involve access, use, generation, maintenance, disclosure or transmission of PHI or EPHI.

5.11 This Agreement contains the entire agreement between the parties pertaining to this subject matter, and supersedes all prior understandings, whether written or oral, regarding the same subject matter.

5.12 The provisions of this Agreement dealing with indemnification, security incident or Breach notification, the construction of this Agreement as a general confidentiality agreement, and Sound Off’s obligations to return or destroy PHI and EPHI upon termination of this Agreement and to maintain protections for any PHI and EPHI that is unfeasible to return or destroy upon termination of this Agreement shall be deemed to be continuing obligations of Sound Off that survive the termination of this Agreement for any reason.

[effective between Sound Off, Inc. and you upon your electronic affirmation]