Privacy Policy

MAHLUM INNOVATIONS BUSINESS ASSOCIATE TERMS NOTICE

Updated October 7, 2026

This Business Associate Notice (“BA Notice”) describes the HIPAA-related obligations and practices of Mahlum Innovations LLC (“Mahlum Innovations”) when Mahlum Innovations provides services to a client that is a HIPAA Covered Entity and, in performing those services, creates, receives, maintains, or transmits Protected Health Information (“PHI”) on behalf of that client or is provided access to PHI in connection with the performance of such services.

This BA Notice is incorporated into and forms part of Mahlum Innovations’ Privacy Policy. However, this BA Notice does not independently create a Business Associate relationship where the services provided by Mahlum Innovations do not involve the creation, receipt, maintenance, or transmission of PHI on behalf of a Covered Entity or otherwise allow or require Mahlum Innovations to access PHI in connection with the performance of such services.

For purposes of this BA Notice, the applicable Mahlum Innovations client is referred to as the “Covered Entity” and Mahlum Innovations is referred to as the “Business Associate” (each a “Party” and collectively, the “Parties”), but only to the extent the relationship meets the requirements for a Business Associate relationship under HIPAA.

Engagement Process

As part of the process of retaining Mahlum Innovations, each client signs Mahlum Innovations’ Master Services Agreement (and any applicable statement of work or care plan) and accepts the Terms of Service and Privacy Policy published on this website, which collectively govern the client’s purchase and use of Mahlum Innovations’ services.

When a client engagement requires Mahlum Innovations to act as a Business Associate under HIPAA, Mahlum Innovations will also provide the applicable client or clinic with a separate, stand-alone Business Associate Agreement (“BAA”) for execution by both Parties. The executed BAA will govern the Parties’ respective HIPAA obligations with respect to PHI.

1. DEFINITIONS

Capitalized terms not otherwise defined in this BA Notice shall have the meanings assigned to them under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), the Health Information Technology for Economic and Clinical Health Act (“HITECH”), and the regulations promulgated thereunder, as amended from time to time, including 45 C.F.R. Parts 160 and 164 (collectively, the “HIPAA Rules”). Such terms include Breach, Designated Record Set, Disclosure, Electronic Protected Health Information (“ePHI”), Individual, Minimum Necessary, Protected Health Information (“PHI”), Required by Law, Secretary, Security Incident, Subcontractor, Unsecured Protected Health Information, and Use.

“Covered Entity” means a Mahlum Innovations client that is a covered entity under HIPAA and for which Mahlum Innovations performs services that may involve the creation, receipt, maintenance, or transmission of PHI on the client’s behalf, or that otherwise involve or require Mahlum Innovations to access PHI in connection with the performance of such services.

“Business Associate” means Mahlum Innovations LLC, a Montana limited liability company, to the extent Mahlum Innovations, in performing services for a Covered Entity, creates, receives, maintains, or transmits PHI on behalf of the Covered Entity, or is otherwise provided access to PHI in connection with the performance of such services, and the relationship meets the requirements for a Business Associate relationship under the HIPAA Rules.

2. PURPOSE AND SCOPE

This BA Notice is provided in advance of, and applies to the extent Mahlum Innovations is or will be acting as, a Business Associate of a Covered Entity under the HIPAA Rules. Nothing in this BA Notice independently creates a Business Associate relationship where the services performed by Mahlum Innovations do not involve the creation, receipt, maintenance, or transmission of PHI on behalf of a Covered Entity or otherwise involve or require Mahlum Innovations to access PHI in connection with the performance of such services.

Visitors to this website, and clients retaining Mahlum Innovations, are hereby notified that Mahlum Innovations, in connection with certain website design and development, hosting, AI and software development, integrations, analytics, and related technology services, may create, receive, maintain, transmit, view, or otherwise access PHI as necessary to perform the services for which Mahlum Innovations has been retained. Such activities may include website, booking, intake form, and patient-portal builds; integrations with EMR/EHR, scheduling, payment, and communication systems; hosting and database administration; data migration or transfer; AI automation and software development; account setup; troubleshooting; or other technology support services.

Mahlum Innovations will access, Use, or Disclose PHI only to the extent reasonably necessary to perform such services and as otherwise permitted by the applicable BAA and HIPAA Rules.

3. PERMITTED USES AND DISCLOSURES OF PHI

Mahlum Innovations may Use or Disclose PHI only as necessary to perform the services for which it has been retained, as permitted by the applicable BAA, or as Required by Law. Mahlum Innovations shall not Use or Disclose PHI in a manner that would violate the HIPAA Privacy Rule if done by the Covered Entity, except as expressly permitted for a Business Associate under the HIPAA Rules.

Mahlum Innovations may Use PHI for its proper management and administration or to carry out its legal responsibilities. Mahlum Innovations may Disclose PHI for those purposes only if the Disclosure is Required by Law or Mahlum Innovations obtains reasonable assurances from the recipient that the PHI will remain confidential, will be Used or further Disclosed only as Required by Law or for the purpose for which it was disclosed, and the recipient will notify Mahlum Innovations of any breach of confidentiality of which it becomes aware.

Mahlum Innovations shall limit its Uses, Disclosures, and requests for PHI to the Minimum Necessary to accomplish the intended purpose, to the extent the Minimum Necessary standard applies under the HIPAA Rules.

4. SAFEGUARDS AND SECURITY

Mahlum Innovations shall use appropriate administrative, physical, and technical safeguards to prevent Use or Disclosure of PHI other than as permitted by applicable law and the applicable BAA. With respect to ePHI, Mahlum Innovations shall comply with the applicable requirements of the HIPAA Security Rule, including 45 C.F.R. Part 164, Subpart C.

Mahlum Innovations shall maintain policies, procedures, and reasonable security measures appropriate to the nature of the PHI and ePHI it creates, receives, maintains, transmits, or otherwise accesses in connection with services performed for a Covered Entity.

5. REPORTING OF IMPERMISSIBLE USES, DISCLOSURES, SECURITY INCIDENTS, AND BREACHES

Mahlum Innovations shall report to the applicable Covered Entity any Use or Disclosure of PHI not permitted by the applicable BAA of which Mahlum Innovations becomes aware, including any Breach of Unsecured PHI as required by 45 C.F.R. § 164.410 and any Security Incident as required by the HIPAA Rules.

Mahlum Innovations shall provide notice of a Breach of Unsecured PHI without unreasonable delay and in no event later than sixty (60) calendar days after discovery, or within any shorter period required by applicable law or expressly agreed upon in the applicable BAA. The notice shall include, to the extent known, the information required by 45 C.F.R. § 164.410.

The Parties acknowledge that unsuccessful Security Incidents that do not result in unauthorized access, Use, Disclosure, modification, or destruction of ePHI—including routine pings, scans, unsuccessful login attempts, and similar events—may occur in the ordinary course. The applicable BAA may address notice regarding such routine unsuccessful Security Incidents.

6. SUBCONTRACTORS AND INDEPENDENT CONTRACTORS

Mahlum Innovations shall ensure that any Subcontractor, including any independent contractor acting as a Subcontractor, that creates, receives, maintains, or transmits PHI on behalf of Mahlum Innovations agrees in writing to the applicable restrictions, conditions, safeguards, and requirements imposed upon Mahlum Innovations with respect to such PHI, as required by the HIPAA Rules.

7. ACCESS TO PHI

To the extent Mahlum Innovations maintains PHI in a Designated Record Set, Mahlum Innovations shall make such PHI available to the Covered Entity, or as directed by the Covered Entity to an Individual, as necessary for the Covered Entity to satisfy its obligations under 45 C.F.R. § 164.524 and the applicable BAA.

8. AMENDMENT OF PHI

To the extent Mahlum Innovations maintains PHI in a Designated Record Set, Mahlum Innovations shall make PHI available for amendment and incorporate amendments as directed or agreed to by the Covered Entity as necessary for the Covered Entity to satisfy 45 C.F.R. § 164.526 and the applicable BAA.

9. ACCOUNTING OF DISCLOSURES

Mahlum Innovations shall document Disclosures of PHI and maintain information concerning such Disclosures as necessary for a Covered Entity to respond to a request for an accounting of disclosures under 45 C.F.R. § 164.528.

10. AVAILABILITY TO THE SECRETARY

Mahlum Innovations shall make its internal practices, books, and records relating to the Use and Disclosure of PHI received from, or created or received by Mahlum Innovations on behalf of, a Covered Entity available to the Secretary of the U.S. Department of Health and Human Services as required by the HIPAA Rules.

11. COVERED ENTITY OBLIGATIONS

A Covered Entity shall notify Mahlum Innovations of any limitation in the Covered Entity’s Notice of Privacy Practices to the extent such limitation may affect Mahlum Innovations’ permitted Use or Disclosure of PHI.

A Covered Entity shall notify Mahlum Innovations of any change in, or revocation of, an Individual’s authorization or permission to Use or Disclose PHI to the extent such change may affect Mahlum Innovations’ Use or Disclosure of PHI.

A Covered Entity shall notify Mahlum Innovations of any restriction on the Use or Disclosure of PHI to which the Covered Entity has agreed under 45 C.F.R. § 164.522 to the extent such restriction may affect Mahlum Innovations.

A Covered Entity shall not request Mahlum Innovations to Use or Disclose PHI in any manner that would not be permissible under the HIPAA Rules if performed by the Covered Entity, except to the extent a Business Associate is expressly permitted to do so.

12. PERFORMANCE OF COVERED ENTITY OBLIGATIONS

To the extent Mahlum Innovations is expressly retained and authorized to carry out one or more of a Covered Entity’s obligations under the HIPAA Privacy Rule, Mahlum Innovations shall comply with the requirements of the Privacy Rule applicable to the Covered Entity in the performance of those delegated obligations.

13. TERM AND TERMINATION

The HIPAA-related obligations described in this BA Notice apply for so long as Mahlum Innovations is acting as a Business Associate of a Covered Entity. The specific effective date, term, termination rights, and obligations of the Parties shall be governed by the applicable stand-alone BAA.

Upon termination of the applicable Business Associate relationship, Mahlum Innovations shall, if feasible and as required by the applicable BAA and HIPAA Rules, return to the Covered Entity or destroy PHI received from the Covered Entity or created, maintained, or received by Mahlum Innovations on its behalf.

If return or destruction is infeasible, Mahlum Innovations shall continue to protect the retained PHI and limit further Uses and Disclosures to those purposes that make return or destruction infeasible, consistent with the HIPAA Rules and applicable BAA.

14. STATE LAW AND MORE STRINGENT REQUIREMENTS

The Parties shall comply with applicable federal and state privacy, confidentiality, security, and breach-notification laws governing the PHI at issue. To the extent applicable state law provides greater privacy protection or affords an Individual greater rights than HIPAA and is not preempted, the more protective applicable requirement shall control.

15. NO SALE OR UNAUTHORIZED MARKETING OF PHI

Mahlum Innovations will not sell PHI or receive remuneration in exchange for PHI.

Mahlum Innovations will not Use or Disclose PHI for Mahlum Innovations’ own marketing purposes. Mahlum Innovations may assist a Covered Entity with communications or marketing activities involving PHI only when such services are within the scope of Mahlum Innovations’ engagement and are permitted by the applicable BAA, the HIPAA Rules, and other applicable law.

16. REGULATORY CHANGES

Mahlum Innovations may update this BA Notice as reasonably necessary to reflect changes in HIPAA, HITECH, implementing regulations, or other applicable privacy and security laws.

Any executed BAA between Mahlum Innovations and a Covered Entity shall be amended as reasonably necessary to maintain compliance with applicable law.

17. INTERPRETATION; SURVIVAL

This BA Notice is intended to describe Mahlum Innovations’ practices and obligations when acting as a Business Associate and shall be interpreted consistently with the HIPAA Rules.

Obligations concerning PHI that are required by HIPAA or an applicable BAA to continue following termination of a Business Associate relationship shall survive termination as required by law or the applicable BAA.

Nothing in this BA Notice is intended to create rights in any third party except as required by applicable law.

18. RELATIONSHIP TO MAHLUM INNOVATIONS TERMS AND STAND-ALONE BAA

This BA Notice is incorporated into Mahlum Innovations’ Privacy Policy and should be read together with Mahlum Innovations’ Terms of Service and other applicable website policies.

This BA Notice does not expand the scope of services Mahlum Innovations has agreed to provide, require Mahlum Innovations to receive or access PHI when PHI is unnecessary to the services being provided, or authorize either Party to Use or Disclose PHI beyond what is permitted by applicable law.

When Mahlum Innovations will act as a Business Associate in connection with a client engagement, Mahlum Innovations will provide the applicable client or clinic with a separate, stand-alone BAA for execution by both Parties. The executed BAA will govern the Parties’ specific obligations concerning PHI and will control over this BA Notice in the event of a conflict concerning HIPAA or PHI.

19. CONTACT

Questions regarding this Business Associate Notice or requests concerning Mahlum Innovations’ stand-alone Business Associate Agreement may be directed to colter@mahluminnovations.com.