---
title: "Business Associate Agreement"
subtitle: "Belmont Labs Inc. d/b/a EMRfi · Version 2026-09-20"
---

This Business Associate Agreement ("Agreement") is between the healthcare organization that accepts it at EMRfi signup ("Covered Entity") and Belmont Labs Inc., doing business as EMRfi ("Business Associate"). It is effective on the date of electronic acceptance. Capitalized terms not defined here have the meanings given in HIPAA, 45 CFR Parts 160 and 164.

## 1. Purpose
Business Associate provides patient-financing technology under the EMRfi Terms of Service (the "Services") and may receive or create Protected Health Information ("PHI") on behalf of Covered Entity in doing so, limited to payment amounts, account references, contact information used to deliver payment links, and payment outcomes.

## 2. Permitted uses and disclosures
Business Associate may use and disclose PHI only (a) to perform the Services, (b) as Required by Law, and (c) for its own proper management and administration, provided that any disclosure for that purpose is Required by Law or made under written assurances of confidentiality and notification of breaches. Business Associate will not sell PHI or use it for marketing.

## 3. Safeguards
Business Associate will implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of electronic PHI as required by 45 CFR Part 164 Subpart C, including encryption in transit and at rest, access controls, audit logging, and workforce training.

## 4. Reporting
Business Associate will report to Covered Entity any use or disclosure of PHI not permitted by this Agreement, any Security Incident, and any Breach of Unsecured PHI, without unreasonable delay and no later than ten (10) business days after discovery, including the information Covered Entity needs to meet its obligations under 45 CFR 164.410. Unsuccessful Security Incidents (pings, port scans, blocked login attempts) are reported in aggregate on request.

## 5. Subcontractors
Business Associate will ensure that any subcontractor that creates, receives, maintains, or transmits PHI on its behalf agrees in writing to the same restrictions and conditions. Current subcontractors are listed in the Data Flow & Subprocessors document. Stripe, Affirm, and Sunbit receive information directly from the patient under their own agreements and are not subcontractors of Business Associate.

## 6. Individual rights
Within ten (10) business days of Covered Entity's request, Business Associate will make PHI available to Covered Entity to fulfill an individual's rights of access (45 CFR 164.524), amendment (164.526), and accounting of disclosures (164.528).

## 7. Books and records
Business Associate will make its internal practices, books, and records relating to PHI available to the Secretary of Health and Human Services for purposes of determining compliance with HIPAA.

## 8. Minimum necessary
Business Associate will request, use, and disclose only the minimum PHI necessary to perform the Services. Covered Entity will not transmit PHI beyond what the Services require and will not place PHI in free-text or reference fields.

## 9. Term and termination
This Agreement remains in effect for as long as Business Associate holds PHI for Covered Entity. Covered Entity may terminate this Agreement and the Services if Business Associate materially breaches it and fails to cure within thirty (30) days of written notice. On termination, Business Associate will return or destroy all PHI; where return or destruction is infeasible, it will extend these protections to the retained PHI and limit further uses to those purposes that make return infeasible.

## 10. General
This Agreement is to be interpreted to permit compliance with HIPAA and will be amended as necessary to remain compliant. In a conflict with the Terms of Service, this Agreement controls as to PHI. No third-party beneficiaries are created. Texas law governs except where preempted by federal law.

## Execution
Electronic acceptance at signup, with the signer's typed name, title, date, time, and IP address, constitutes execution by both parties. Organizations requiring their own form may submit it through https://emrfi.com/contact.