Legal
APEX Business Associate Agreement
Version 2026-10-16.1. Practices accept it inside APEX under Compliance; the acceptance is recorded with the signer, time and network address.
This Business Associate Agreement ("BAA") is between the dental or health practice that accepts it ("Practice") and TK Hub LLC (doing business as APEX), a Delaware limited liability company based in Texas ("APEX"). It applies whenever APEX creates, receives, keeps or sends protected health information for the Practice. It becomes binding when an authorized person for the Practice clicks to accept it inside APEX; that acceptance is recorded with the signer's name, the time and the network address.
1. Words used here
Capitalized terms not defined here (for example Breach, Business Associate, Covered Entity, Electronic Protected Health Information, Individual, Protected Health Information or "PHI", Required by Law, Secretary, Security Incident, Subcontractor and Unsecured PHI) mean what they mean in the HIPAA Privacy, Security, Breach Notification and Enforcement Rules at 45 C.F.R. Parts 160 and 164, as amended by the HITECH Act (together, "HIPAA").
2. What APEX may do with PHI
APEX may use and disclose PHI only (a) to provide the APEX software and support the Practice signed up for, (b) as this BAA allows, or (c) as Required by Law. It will limit each use, disclosure and request to the minimum necessary.
APEX may use PHI for its own proper management and administration or to carry out its legal duties, and may disclose it for those purposes only if Required by Law or if the recipient gives reasonable written assurance it will keep the PHI confidential, use it only for the purpose it was given, and report any known breach of confidentiality.
APEX will not sell PHI, use it for marketing, or use or disclose it in any way that would break HIPAA if the Practice did it, except for the management uses above. De-identification is allowed only to the standard of 45 C.F.R. 164.514(b) and only to run and improve the service for the Practice.
3. No outside artificial intelligence
APEX will not send PHI to any third-party artificial-intelligence or machine-learning service (for example a hosted large-language-model API), and will not use PHI to train any AI model, unless the Practice first agrees in writing for that specific service. Any AI features APEX provides run on APEX-controlled infrastructure or on the Practice's own devices.
4. Safeguards
APEX will use reasonable and appropriate administrative, physical and technical safeguards, and comply with Subpart C of 45 C.F.R. Part 164, to protect Electronic PHI. These include encryption in transit, encryption of sealed chart fields, role-based access, multi-factor sign-in options and an audit trail.
5. Reporting incidents and breaches
APEX will report to the Practice any use or disclosure of PHI not allowed by this BAA, and any Breach of Unsecured PHI, without unreasonable delay and in no case later than 5 business days after discovery (discovery as defined in 45 C.F.R. 164.410(a)(2)). The report will include, as soon as known, the Individuals affected, what happened, the PHI involved, what APEX is doing to limit harm, and contact information. APEX will supplement the report as facts develop.
Security Incidents that do not result in unauthorized access, use or disclosure (for example pings, port scans or blocked sign-in attempts) are reported in aggregate on request; this sentence is notice of their ongoing existence.
APEX will reasonably cooperate with the Practice's breach risk assessment and notifications, and will reimburse the Practice's reasonable, documented costs of legally required notifications to the extent the Breach was caused by APEX or its Subcontractors.
6. Subcontractors
APEX will make sure every Subcontractor that creates, receives, keeps or sends PHI for it first agrees in writing to restrictions, conditions and requirements at least as strict as this BAA (including sections 3, 4 and 5), as required by 45 C.F.R. 164.502(e)(1)(ii) and 164.308(b)(2). APEX remains responsible to the Practice for its Subcontractors' handling of PHI. A current list of Subcontractors that handle PHI is available on request.
7. Patient rights
Within 10 business days of the Practice's request, APEX will (a) make PHI in a Designated Record Set available so the Practice can meet 45 C.F.R. 164.524, including in electronic form, (b) make amendments the Practice directs under 164.526, and (c) provide the information needed for an accounting of disclosures under 164.528. If an Individual asks APEX directly, APEX will forward the request to the Practice within 5 business days.
8. Government access
APEX will make its internal practices, books and records about PHI available to the Secretary of HHS to determine HIPAA compliance, and will tell the Practice of such a request unless the law forbids it.
9. State law, including Texas
Where state law is stricter than HIPAA, APEX will follow the stricter rule. For Practices in Texas this includes the Texas Medical Records Privacy Act (Texas Health & Safety Code Chapter 181, as amended by House Bill 300, 2011), including its limits on electronic disclosure and its ban on selling PHI, and the breach-notice duties of Texas Business & Commerce Code Section 521.053. APEX will give the Practice the facts it needs to meet those deadlines and the Texas Attorney General notice threshold.
10. Practice duties
The Practice will tell APEX about any limits in its notice of privacy practices, any changes in an Individual's permission, and any restriction it has agreed to under 45 C.F.R. 164.522, to the extent they affect APEX. The Practice will not ask APEX to use or disclose PHI in a way HIPAA would not allow the Practice to.
11. Term and ending
This BAA lasts as long as the Practice uses APEX. If either side learns the other has materially broken this BAA, it may give written notice; if the problem is not fixed within 30 days, it may end this BAA and the service.
When this BAA ends, APEX will, at the Practice's choice, return all PHI (a full electronic export is available at no charge) or destroy it, including copies held by Subcontractors, within 30 days, and confirm in writing. Backups roll off on their normal schedule and stay protected until then. If returning or destroying some PHI is not feasible, APEX will tell the Practice why, keep protecting it under this BAA, and limit further use to the reasons that make return or destruction infeasible, for as long as it keeps it.
12. Other terms
This BAA controls over any conflicting term in the APEX Terms of Use as to PHI. Any ambiguity is read to permit compliance with HIPAA. The parties will amend this BAA as needed to keep up with changes in the law. Nothing here creates rights for anyone else. Sections 2 (limits), 3, 5, 6 and 11 survive termination for as long as APEX holds PHI.
Texas law governs to the extent federal law does not; venue is the State of Texas. Notices to APEX go to support.apex@tkhub.app.