Legal Document

Business Associate Agreement

This Business Associate Agreement ("BAA") governs the relationship between GMB Billing Firm and any Covered Entity using the GMB Billing Firm platform in connection with Protected Health Information (PHI) under HIPAA.

Effective DateApril 22, 2026

Governing Law45 CFR Parts 160 & 164

RegulationHIPAA / HITECH Act

Version1.0

⚠️ Critical PHI Disclaimer — Read Before Using Platform

GMB Billing Firm's AI coding platform is NOT a HIPAA-compliant data processor for Protected Health Information (PHI). The platform is designed exclusively for processing de-identified clinical data that has been stripped of all 18 HIPAA identifiers per 45 CFR §164.514(b).

The PHI detection system embedded in this platform serves as a good-faith technical safeguard to identify and block common PHI patterns. However, GMB Billing Firm expressly disclaims liability for PHI that: (a) bypasses the automated detector, (b) is submitted after dismissing PHI warnings, or (c) is introduced through methods that circumvent the platform's safeguards.

By using this platform, you accept full responsibility for ensuring all submitted data is de-identified in compliance with HIPAA Safe Harbor or Expert Determination methods.

Section 1

Definitions

Business Associate ("BA")

GMB Billing Firm, LLC, a healthcare technology company providing AI-powered medical coding, billing assistance, and related services to healthcare providers. As used herein, "GMB Billing Firm" refers to the company, its platform, its AI systems, and any subcontractors engaged in service delivery.

Covered Entity ("CE")

Any healthcare provider, health plan, healthcare clearinghouse, or their workforce members who access or use the GMB Billing Firm platform in connection with the provision of healthcare services as defined under 45 CFR §160.103.

Protected Health Information ("PHI")

Individually identifiable health information transmitted or maintained in any form or medium that relates to: (i) the past, present, or future physical or mental health of an individual; (ii) the provision of healthcare to an individual; or (iii) the past, present, or future payment for healthcare. PHI includes the 18 identifiers enumerated in 45 CFR §164.514(b)(2).

De-Identified Data

Health information from which all 18 HIPAA identifiers have been removed pursuant to either the Safe Harbor method (45 CFR §164.514(b)(2)) or the Expert Determination method (45 CFR §164.514(b)(1)), such that there is no reasonable basis to believe the information could be used to identify an individual.

PHI Detection System

The automated pattern-recognition safeguard embedded in the GMB Billing Firm platform that scans user-submitted text for common PHI patterns including names, Social Security numbers, phone numbers, email addresses, dates, medical record numbers, addresses, and insurance identifiers. This system is a technical control, not a legal guarantee of de-identification compliance.

Breach

The acquisition, access, use, or disclosure of PHI in a manner not permitted under 45 CFR Part 164, Subpart E, which compromises the security or privacy of the PHI.

Section 2

Purpose & Permitted Use

GMB Billing Firm provides AI-powered medical coding assistance, claim analysis, appeal letter generation, and related billing services ("Services") to healthcare organizations. These Services are designed to process de-identified clinical documentation only.

Authorized Platform Use

The GMB Billing Firm platform is authorized solely for processing clinical documentation from which all PHI has been removed pursuant to 45 CFR §164.514. The platform generates ICD-10, CPT, HCPCS codes, and billing documentation based on de-identified clinical inputs. It is not authorized for use as a repository, processor, or transmitter of PHI.

If a Covered Entity enters into a formal Business Associate Agreement with GMB Billing Firm for services explicitly involving PHI processing, such engagement must be governed by a separate signed agreement, subject to compliance review, additional technical safeguards, and applicable service fees. This general BAA does not authorize PHI processing absent such a separate signed agreement.

PHI Submission — Strict Prohibition

Submission of PHI to the GMB Billing Firm platform without an executed, specific PHI-processing BAA is strictly prohibited. Users who submit PHI despite PHI warnings displayed by the platform's detection system do so in violation of this Agreement and in breach of their own HIPAA obligations as a Covered Entity.

Section 3

Obligations of the Covered Entity

The Covered Entity agrees to the following obligations when accessing or using the GMB Billing Firm platform:

De-identification Responsibility: The Covered Entity bears sole and exclusive responsibility for de-identifying all clinical data before submission to the platform, in compliance with 45 CFR §164.514(b). This responsibility cannot be delegated to GMB Billing Firm's automated PHI detector.
PHI Detector Acknowledgment: The Covered Entity acknowledges that the PHI Detection System is a technical safeguard intended to assist with de-identification verification, not a substitute for the Covered Entity's own HIPAA compliance obligations. The detector does not guarantee detection of all PHI patterns, especially contextual, narrative, or non-standard PHI expressions.
Workforce Training: The Covered Entity must ensure that all workforce members who access the platform are trained on HIPAA de-identification requirements and understand that submission of PHI to this platform is prohibited without a specific signed PHI-processing agreement.
Minimum Necessary Standard: The Covered Entity shall apply the minimum necessary standard (45 CFR §164.502(b)) to all data prepared for submission to this platform, ensuring that only information necessary for the coding or billing purpose is included.
Incident Reporting: In the event the Covered Entity discovers or suspects that PHI was submitted to the platform, the Covered Entity must notify GMB Billing Firm at support@gmbcoding.com within 24 hours of discovery.
Access Controls: The Covered Entity must implement appropriate access controls to prevent unauthorized individuals from accessing the platform using the Covered Entity's credentials.
Audit Log Review: The Covered Entity acknowledges that GMB Billing Firm maintains a Medical Coding Audit Log recording platform access, submission timestamps, PHI detection events, and confirmation acknowledgments. The Covered Entity consents to this logging as a condition of platform use.
Prohibition on Circumvention: The Covered Entity must not attempt to bypass, disable, or circumvent the PHI Detection System or any other security control embedded in the platform.

Section 4

Obligations of GMB Billing Firm

As the provider of the platform and, where applicable, Business Associate, GMB Billing Firm agrees to the following:

PHI Detection Maintenance: GMB Billing Firm will maintain and update the PHI Detection System to identify common PHI patterns and will display prominent warnings when potential PHI is detected, blocking submission until the user explicitly confirms de-identification.
Data Minimization: GMB Billing Firm will not use or disclose de-identified data submitted through the platform except as necessary to provide the requested Services (code generation, claim analysis, appeal letters) or as required by law.
Subcontractor Oversight: GMB Billing Firm will obtain satisfactory assurances from any subcontractors who handle data submitted through the platform that such subcontractors will apply equivalent safeguards.
Security Safeguards: GMB Billing Firm will implement appropriate administrative, physical, and technical safeguards to protect the platform and data submitted to it, including encrypted data transmission (TLS 1.2+), API key protection, and access logging.
Audit Log Maintenance: GMB Billing Firm will maintain a Medical Coding Audit Log recording: (i) session timestamps, (ii) PHI detection events and user responses, (iii) de-identification confirmations, (iv) code generation requests, and (v) file upload events. Logs are retained for a minimum of 6 years.
Breach Response: If GMB Billing Firm discovers a security incident involving data submitted to the platform, GMB Billing Firm will notify the affected Covered Entity within 60 days of discovery to the extent required by 45 CFR §164.410.
No PHI Storage: GMB Billing Firm does not store, retain, or create databases from clinical notes submitted through the platform. Input data is processed in-memory and not persisted beyond the active session unless explicitly saved by the user.
Limitation on AI Training: GMB Billing Firm will not use de-identified data submitted through the platform to train, fine-tune, or improve AI models without explicit written consent from the submitting organization.

Section 5

PHI Detection System — Scope & Limitations

The PHI Detection System provides real-time pattern scanning of user-submitted text using regular expression matching for the following categories:

Names: Common name prefixes (Mr., Mrs., Dr., Patient, Nurse) followed by capitalized surname patterns
Social Security Numbers: XXX-XX-XXXX and unformatted 9-digit SSN patterns
Phone Numbers: US domestic and international phone number formats
Email Addresses: Standard email address patterns
Dates: MM/DD/YYYY, MM-DD-YYYY, and Month DD, YYYY formats
Medical Record Numbers: MRN:, Account#, Patient ID: followed by numeric sequences
Street Addresses: Numeric street address patterns with common street type suffixes
ZIP Codes: 5-digit and ZIP+4 postal codes
Insurance/Policy IDs: Policy#, Member#, Group# followed by alphanumeric sequences

Known Limitations — Covered Entity Responsibility

The PHI Detection System does not detect: (i) narrative descriptions identifying individuals by context (e.g., "the 45-year-old schoolteacher in Room 302"); (ii) employer names or workplace identifiers; (iii) geographic data smaller than state; (iv) full-face photographs or biometric identifiers embedded in text; (v) device serial numbers; (vi) web URLs or IP addresses in text form; (vii) account numbers not prefixed with recognized keywords; (viii) non-standard date formats. The Covered Entity must manually verify de-identification for all 18 HIPAA identifiers listed in 45 CFR §164.514(b)(2).

The PHI Detection System blocks submission and displays a warning when potential PHI is detected. If the user overrides this warning by removing the checkbox confirmation or otherwise bypassing the control, GMB Billing Firm assumes no liability for any PHI submitted thereafter. Such override constitutes a knowing violation of this Agreement by the Covered Entity.

Section 6

Indemnification, Liability & Disclaimer

Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, PULSELINE HEALTH SHALL NOT BE LIABLE FOR ANY HIPAA VIOLATIONS, OCR ENFORCEMENT ACTIONS, CIVIL MONETARY PENALTIES, BREACH NOTIFICATION COSTS, OR DAMAGES OF ANY KIND ARISING FROM: (i) THE COVERED ENTITY'S SUBMISSION OF PHI TO THE PLATFORM IN VIOLATION OF THIS AGREEMENT; (ii) FAILURE OF THE PHI DETECTION SYSTEM TO IDENTIFY ALL PHI; (iii) THE COVERED ENTITY'S OVERRIDE OF PHI WARNINGS; OR (iv) THE COVERED ENTITY'S FAILURE TO DE-IDENTIFY DATA PRIOR TO SUBMISSION.

Covered Entity Indemnification: The Covered Entity agrees to indemnify, defend, and hold harmless GMB Billing Firm, its officers, directors, employees, and agents from and against any claims, damages, fines, penalties, or costs (including reasonable attorney's fees) arising from: (a) the Covered Entity's breach of this Agreement; (b) the Covered Entity's submission of PHI to the platform; (c) the Covered Entity's HIPAA violations; or (d) any regulatory enforcement action resulting from the Covered Entity's misuse of the platform.

No Warranty: The PHI Detection System is provided "as-is" without warranty of any kind, express or implied. GMB Billing Firm does not warrant that the detection system will identify all PHI or that the platform will be error-free. The PHI Detection System is a compliance aid, not a compliance guarantee.

Regulatory Enforcement

HIPAA violations are subject to civil monetary penalties of $100 to $50,000 per violation (up to $1.9 million per violation category per year) under 45 CFR §160.404. Criminal violations may result in fines up to $250,000 and imprisonment up to 10 years under 42 U.S.C. §1320d-6. The Covered Entity is solely responsible for its own HIPAA compliance.

Section 7

Medical Coding Audit Log

GMB Billing Firm maintains a Medical Coding Audit Log as a compliance and accountability measure. The audit log records the following events for each platform session:

Session Timestamp: Date, time (UTC), and IP address range of platform access
PHI Detection Events: Whether the PHI scanner detected potential identifiers and the user's response (warning dismissed or PHI removed)
De-identification Confirmation: Whether the user checked the PHI confirmation checkbox prior to code generation
Code Generation Requests: Timestamp of each coding analysis request (no clinical content is logged)
File Upload Events: Whether a file was uploaded, file type, and PHI scan result (no file content is logged)
Appeal and Claim Analysis Events: Timestamps of billing assistant usage (no content is logged)

What Is NOT Logged

GMB Billing Firm does NOT log or retain: the clinical text entered by users, the specific codes generated, the content of claim data, the text of appeal letters, or any information that could identify a patient. Audit logs contain only event metadata, not clinical content.

Audit logs are retained for a minimum of 6 years from the date of creation, consistent with HIPAA requirements under 45 CFR §164.530(j). Covered Entities may request their organization's audit log summary by contacting support@gmbcoding.com.

Section 8

Term, Termination & Survival

Term: This Agreement is effective upon the Covered Entity's first use of the GMB Billing Firm platform and remains in effect until terminated by either party.

Termination for Cause: Either party may terminate this Agreement if the other party materially breaches any provision and fails to cure the breach within 30 days of written notice. GMB Billing Firm reserves the right to immediately terminate platform access upon discovery of PHI submission in violation of this Agreement.

Obligations Upon Termination: Upon termination, GMB Billing Firm will, to the extent practicable, return or destroy any data submitted by the Covered Entity that remains in GMB Billing Firm's systems. Where return or destruction is not feasible, the protections of this Agreement will continue to apply to any retained data.

Survival: The provisions of Sections 5 (PHI Detector Limitations), 6 (Indemnification), 7 (Audit Log), and this Section 8 shall survive termination of this Agreement.

Section 9

Governing Law & Dispute Resolution

This Agreement is governed by the laws of the United States, including HIPAA (42 U.S.C. §1320d et seq.), the HITECH Act (42 U.S.C. §17921 et seq.), and their implementing regulations at 45 CFR Parts 160 and 164. To the extent state law applies, this Agreement shall be governed by the laws of the state in which the Covered Entity's principal place of business is located.

Any dispute arising from this Agreement shall be resolved by binding arbitration under the rules of the American Arbitration Association, with proceedings conducted in English. Notwithstanding the foregoing, either party may seek injunctive relief in a court of competent jurisdiction to prevent imminent irreparable harm.

Section 10

Miscellaneous

Entire Agreement: This BAA, together with GMB Billing Firm's Terms of Service and Privacy Policy, constitutes the entire agreement between the parties regarding HIPAA compliance and supersedes all prior agreements on the subject matter hereof.

Amendment: GMB Billing Firm may amend this BAA at any time by posting an updated version to the platform. Continued use of the platform after the effective date of any amendment constitutes acceptance of the amended BAA.

Severability: If any provision of this Agreement is held invalid or unenforceable, the remaining provisions shall continue in full force and effect.

No Third-Party Beneficiaries: This Agreement is for the sole benefit of GMB Billing Firm and the Covered Entity. Nothing herein shall create any rights in any third party, including patients whose de-identified data may be processed.

Contact for Privacy Matters: All privacy inquiries, breach reports, and BAA-related correspondence should be directed to: support@gmbcoding.com

Section 11

Active Acceptance & Acknowledgment

GMB Billing Firm requires explicit, active acceptance of this Business Associate Agreement. You must complete all acknowledgments and provide your information below before accessing the platform. Passive use alone does not constitute acceptance.

E-SIGN Act Compliance

This electronic acceptance is legally binding under the Electronic Signatures in Global and National Commerce Act (E-SIGN Act, 15 U.S.C. §7001 et seq.) and the Uniform Electronic Transactions Act (UETA). Your checked acknowledgments, typed name, and submission timestamp constitute a valid electronic signature. A reference ID is generated upon acceptance for your records.

📝 BAA Acceptance Form — All Fields Required

Step 1 — Check All Acknowledgments

I have read and fully understand this Business Associate Agreement, including all 11 sections and the stated limitations of the PHI Detection System. I am an authorized representative of a Covered Entity under HIPAA (45 CFR §160.103) with authority to legally bind my organization to this Agreement. I understand this platform is authorized for de-identified data only. Submitting PHI without a separate signed processing agreement is strictly prohibited and violates HIPAA. I acknowledge the PHI Detection System does not detect all PHI forms. My organization bears sole responsibility for de-identifying all data per 45 CFR §164.514(b) before submission. I consent to GMB Billing Firm maintaining a Medical Coding Audit Log of platform event metadata (not clinical content) and understand its purpose as described in Section 7. My organization agrees to fully indemnify and hold harmless GMB Billing Firm from any HIPAA violations, OCR enforcement actions, or damages resulting from my organization's PHI submission or platform misuse.

Step 2 — Provide Your Information

Full Legal Name *

Title / Role *

Organization Name *

Business Email *

Complete all 6 acknowledgments and all 4 fields to enable signing

📬

Need a Wet-Signed or Countersigned BAA?

Contact support@gmbcoding.com with subject "BAA Execution Request". Include your organization name, NPI, and contact information. We respond within 2 business days.