SIGNED FINAL BAA Emocha License Agreement, DBA Scene -Public Health 5-19-2025

BUSINESS ASSOCIATE AGREEMENT

This Business Associate Agreement (the “BAA”) to that certain emocha License Agreement, dba Scene dated [DATE] (the “Services Agreement”) is entered into by and between The Sauk County Health Department, a                                                                     (“Covered Entity”) and Scene, a Delaware corporation, ("Business Associate"), and will be made effective as of June 1, 2025                 (the “Effective Date”). Covered Entity and Business Associate are referred to herein collectively as the "Parties" and may be referred to individually as a "Party."

WHEREAS, the purpose of this BAA is to assure the privacy and security of Protected Health Information (“PHI”) and Electronic Protected Health Information (“EPHI”) (each as defined below) of the Covered Entity in accordance with the regulations (including, but not limited to, the "Privacy Rule" (45 C.F.R. Part 160, subpart A and C, and Part 164, subparts A and E), the "Security Rule" (45 C.F.R. Part 160, subpart A and C, and Part 164, subparts A and C), the "Breach Notification Rule" (45 C.F.R. Part 160, Subparts A and C, and 45 C.F.R. Subpart

1. , the "Enforcement Rule" (45 C.F.R. Part 160, Subparts C and D); and the "Electronic Transaction Rule" (45 C.F.R. Parts 160 and 162) issued by the U.S. Department of Health and Human Services ("DHHS") pursuant to the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") and the American Recovery and Reinvestment Act, including the Health Information Technology for Economic and Clinical Health Act (the "HITECH Act"), all such laws and regulations as may be amended from time to time. The Privacy Rule, the Security Rule, the Breach Notification Rule, the Enforcement Rule, and the Electronic Transaction Rule are collectively referred to as the "HIPAA Rules";

WHEREAS, HIPAA provides, among other things, that a covered entity is permitted to disclose and allow access to PHI and EPHI to a business associate, and to allow the business associate to obtain and receive PHI, if the covered entity obtains satisfactory assurances in the form of a written contract that the business associate will comply with all applicable HIPAA Rules;