![](media/image1.jpg){width="2.5077438757655295in"
height="1.7291666666666667in"}

**HIPAA BAA EXHIBIT TEMPLATES**

**EXHIBIT A-1: PLATFORM SERVICES (SaaS)**

**Service Description:** Access to the Phase Mirror Oracle platform for
AI governance and dissonance detection.

**1. Service Tier**

☐ **Team Tier**

-   Up to 10 seats

-   Extended rule sets

-   Cloud dashboard access

-   Basic SLA (99.0% uptime)

☐ **Business Tier**

-   Up to 50 seats

-   Full rule registry

-   Priority support

-   Enhanced SLA (99.5% uptime)

☐ **Enterprise Tier**

-   Unlimited seats

-   Dedicated instance

-   Technical Account Manager

-   Premium SLA (99.9% uptime)

**2. PHI Processing Activities**

Business Associate will process PHI in the following Platform
components:

  Component                                  PHI Present   Description of PHI
  ------------------------------------------ ------------- --------------------
  Configuration files uploaded by Customer   ☐ Yes ☐ No    
  AI system code repositories analyzed       ☐ Yes ☐ No    
  Dissonance reports generated               ☐ Yes ☐ No    
  Rule execution logs                        ☐ Yes ☐ No    
  Audit trails                               ☐ Yes ☐ No    
  API request/response data                  ☐ Yes ☐ No    
  Cloud dashboard displays                   ☐ Yes ☐ No    
  Support tickets and communications         ☐ Yes ☐ No    

**3. Data Storage and Retention**

**Primary Data Location:** \[US-East, US-West, EU, Custom\]

**Data Retention Period:**

-   Active subscription data: Duration of subscription

-   Audit logs: \[X\] years from creation

-   Terminated account data: 30 days, then destroyed

**Backup Retention:** \[X\] days

**4. Access Controls**

**Customer-Controlled Access:**

-   Customer manages user provisioning via dashboard

-   Role-based access controls (RBAC) available

-   SSO/SAML integration available (Enterprise tier only)

**Phase Mirror Personnel Access:**

-   Support engineers: Break-glass access for critical issues only

-   Platform engineers: No access to Customer Data in normal operations

-   Security team: Access for incident response only

All access is logged and auditable.

**5. Calibration Data (Optional)**

☐ Customer **OPTS IN** to calibration data collection\
☐ Customer **OPTS OUT** of calibration data collection

If opted in:

-   Only anonymized, aggregated false-positive rates are collected

-   No identifiable PHI is included in calibration data

-   Customer may opt out at any time

**6. Subcontractors with PHI Access**

  Subcontractor Name           Service Provided         BAA in Place?
  ---------------------------- ------------------------ ---------------
  \[Cloud hosting provider\]   Infrastructure hosting   ☐ Yes
  \[Backup provider\]          Encrypted backups        ☐ Yes
                                                        

**7. Platform-Specific Security Measures**

-   Encryption at rest: AES-256

-   Encryption in transit: TLS 1.3

-   Authentication: Multi-factor authentication available

-   Network security: Web application firewall, DDoS protection

-   Vulnerability scanning: Weekly automated scans

-   Penetration testing: Annual third-party testing

**8. Customer Responsibilities**

Customer is responsible for:

-   Proper configuration of access controls

-   Training authorized users on PHI handling

-   Monitoring user activity within their account

-   Promptly reporting suspected security incidents

-   De-identifying data before upload (if applicable per agreement)

**EXHIBIT A-2: HEALTHCARE & LIFE SCIENCES COMPLIANCE PACK**

**Service Description:** Proprietary compliance module with
HIPAA-specific AI governance rules, templates, and guidance.

**1. Compliance Pack Components**

The Healthcare & Life Sciences Compliance Pack includes:

☑ HIPAA AI provisions rule set\
☑ FDA Software as a Medical Device (SaMD) guidance alignment\
☑ Clinical decision support documentation templates\
☑ Patient safety governance frameworks\
☑ HIPAA-compliant audit logging configurations\
☑ Privacy impact assessment templates\
☑ Incident response playbooks for healthcare AI

**2. PHI in Compliance Pack Usage**

  Activity                                                      PHI Present   Description
  ------------------------------------------------------------- ------------- -------------
  Running HIPAA-specific rules against Customer\'s AI systems   ☐ Yes ☐ No    
  Generating compliance reports                                 ☐ Yes ☐ No    
  Populating documentation templates                            ☐ Yes ☐ No    
  Privacy impact assessments                                    ☐ Yes ☐ No    

**3. Deliverables Containing PHI**

The following deliverables may contain Customer PHI:

-   Compliance assessment reports

-   Privacy impact assessments

-   Documentation packages for regulatory submission

-   Audit trail summaries

**Ownership:** All deliverables containing Customer PHI are owned by
Customer upon creation.

**Retention:** Business Associate will destroy deliverables containing
PHI within 30 days of delivery unless Customer requests extended
retention for support purposes.

**4. HIPAA-Specific Features**

-   Pre-configured minimum necessary access controls

-   HIPAA accounting of disclosures tracking

-   Business associate audit log templates

-   Breach notification workflow automation

-   Patient rights management checklist

**5. Updates and Regulatory Changes**

Business Associate will update the Compliance Pack to reflect changes
in:

-   HIPAA regulations and guidance

-   FDA enforcement priorities

-   HHS Office for Civil Rights guidance

-   Industry best practices

Updates are provided as part of annual subscription at no additional
cost.

**EXHIBIT A-3: CONSULTING SERVICES**

**Service Description:** Professional consulting services for AI
governance strategy and implementation.

**1. Consulting Service Type**

☐ **AI Governance Diagnostic** (6-8 week engagement)\
☐ **Compliance-Accuracy Tradeoff Workshop** (2-day workshop)\
☐ **Advisory Retainer** (Ongoing monthly retainer)

**2. Scope of Consulting Services**

Business Associate will provide the following services that may involve
PHI:

**Discovery Phase:**

-   ☐ Stakeholder interviews (healthcare staff, clinicians, compliance
    > officers)

-   ☐ Document review (policies, procedures, system documentation)

-   ☐ System walkthroughs and demonstrations

-   ☐ Review of AI system specifications and data flows

**Analysis Phase:**

-   ☐ Tension mapping (identifying governance gaps)

-   ☐ Risk assessment

-   ☐ Compliance gap analysis

-   ☐ Policy review

**Deliverable Creation:**

-   ☐ Governance artifacts (specs, SLAs, policies)

-   ☐ Risk registers and mitigation plans

-   ☐ Board presentation materials

-   ☐ Implementation roadmaps

**3. PHI Handling During Consulting**

**Customer will provide access to:**

  Access Type                        PHI Present?   Safeguards
  ---------------------------------- -------------- ------------------------------------
  System demonstrations              ☐ Yes ☐ No     Screen sharing only, no downloads
  Documentation (policies, specs)    ☐ Yes ☐ No     Secure file transfer
  Interview discussions              ☐ Yes ☐ No     Hypothetical examples only
  On-site observation                ☐ Yes ☐ No     Observer role only, no data access
  Development/staging environments   ☐ Yes ☐ No     View-only access, time-limited

**4. Consultant Personnel**

The following Business Associate personnel will have access to PHI:

  Name   Role              HIPAA Training Date   Access Duration
  ------ ----------------- --------------------- -----------------
         Lead Consultant                         
         Senior Analyst                          
                                                 

All consultants:

-   Have completed HIPAA privacy and security training

-   Are bound by confidentiality obligations

-   Will access PHI only as necessary for services

-   Will not copy or retain PHI except as specified below

**5. Work Product and Deliverables**

**Deliverables that may contain Customer PHI:**

-   Executive summary and findings report

-   Tension map and dissonance analysis

-   Governance artifact templates (populated with Customer data)

-   Risk register

-   Board presentation deck

**Ownership:** Customer owns all deliverables upon payment.

**Phase Mirror Retention:** Business Associate may retain de-identified
versions of methodologies and frameworks for improvement of services.
Customer-specific identifiable information will be destroyed within 30
days of project completion unless Customer requests extended retention.

**6. Communication Channels**

PHI may be discussed or transmitted via:

-   ☐ Email (encrypted)

-   ☐ Video conferencing (Zoom, Teams) - screen sharing only

-   ☐ Secure file sharing portal

-   ☐ Phone calls (not recorded)

-   ☐ In-person meetings at Customer site

-   ☐ Slack/Teams workspace (Customer-controlled)

**Prohibited channels:**

-   ✗ Unencrypted email

-   ✗ Personal devices without encryption

-   ✗ Public file sharing services (Dropbox, Google Drive, etc.)

-   ✗ SMS/text messaging

**7. Travel and On-Site Access**

If consultants will access Customer facilities:

**On-site access includes:**

-   Badge/visitor access: \[Details\]

-   System access: \[Details\]

-   Duration: \[Start date\] to \[End date\]

**On-site security requirements:**

-   Consultants will comply with Customer\'s facility security policies

-   Devices will be encrypted and password-protected

-   No PHI will be downloaded to consultant devices without explicit
    > approval

-   Visitor badges will be returned at end of each day

**EXHIBIT A-4: IMPLEMENTATION SERVICES**

**Service Description:** Technical implementation of Phase Mirror
platform in Customer\'s environment.

**1. Implementation Package**

☐ **Starter Package** (2 weeks)

-   Single repository integration

-   5 core rules configured

-   GitHub Actions workflow setup

☐ **Professional Package** (4-6 weeks)

-   Multi-repository deployment

-   Full rule registry configuration

-   Custom rule development (up to 3)

-   CI/CD pipeline integration

-   Terraform infrastructure as code

☐ **Enterprise Package** (8-12 weeks)

-   Organization-wide deployment

-   SSO/SAML integration

-   Custom rules (up to 10)

-   Dedicated instance setup

-   Advanced integrations (SIEM, GRC platforms)

**2. Implementation Activities Involving PHI**

  Activity                               PHI Exposure Risk       Mitigation
  -------------------------------------- ----------------------- --------------------------------------------
  Environment access for configuration   ☐ High ☐ Medium ☐ Low   View-only access, no data extraction
  Code repository review                 ☐ High ☐ Medium ☐ Low   Scanning only, no local clones with PHI
  Testing and validation                 ☐ High ☐ Medium ☐ Low   Synthetic/de-identified test data required
  Integration with Customer systems      ☐ High ☐ Medium ☐ Low   API keys time-limited, least privilege
  Training Customer administrators       ☐ High ☐ Medium ☐ Low   Non-production environment

**3. Access Requirements**

**Business Associate implementation team requires:**

  Access Type              Scope                 Duration      PHI Access?
  ------------------------ --------------------- ------------- -------------
  Source code repository   Read-only             \[X\] weeks   ☐ Yes ☐ No
  CI/CD pipeline           Configure             \[X\] weeks   ☐ Yes ☐ No
  Cloud environment        Deploy Phase Mirror   \[X\] weeks   ☐ Yes ☐ No
  Customer admin panel     Configuration         \[X\] weeks   ☐ Yes ☐ No

**Access will be:**

-   Time-limited to implementation period

-   Revoked immediately upon project completion

-   Logged and auditable

-   Subject to Customer approval for extensions

**4. Implementation Team**

  Name   Role                     HIPAA Training   Access Level
  ------ ------------------------ ---------------- --------------
         Implementation Lead      \[Date\]         
         DevOps Engineer          \[Date\]         
         Integration Specialist   \[Date\]         

**5. Test Data Requirements**

**Customer agrees to provide ONLY:**

-   ☑ Synthetic test data (no real PHI)

-   ☑ De-identified data per HIPAA Safe Harbor method

-   ☑ Limited data set with Data Use Agreement

**Customer will NOT provide:**

-   ✗ Production data containing identifiable PHI

-   ✗ Patient records, even if \"anonymized\" without proper
    > de-identification

**6. Deliverables**

**Implementation deliverables include:**

-   Deployed Phase Mirror instance in Customer environment

-   Configuration documentation

-   Integration specifications

-   Administrator training materials

-   Runbooks and troubleshooting guides

**PHI in deliverables:** Implementation deliverables should not contain
Customer PHI. If PHI inadvertently appears in documentation (e.g.,
screenshots), Business Associate will redact or destroy such materials.

**7. Post-Implementation Support**

Following implementation:

-   Implementation team access is revoked

-   Ongoing support transitions to standard support channels per Exhibit
    > A-1

-   Documentation is transferred to Customer

-   Business Associate retains no copies of Customer configuration
    > containing PHI

**EXHIBIT A-5: TRAINING PROGRAMS**

**Service Description:** Phase Mirror training courses and certification
programs.

**1. Training Type**

☐ **Self-Paced eLearning**

-   PMD Foundations (8 hours)

-   PMA Exam Prep (4 hours)

☐ **Instructor-Led Training**

-   Applied Phase Mirror for AI Governance (2 days, virtual)

-   Phase Mirror Implementation Workshop (3 days, in-person/virtual)

-   CPMP Exam Prep (1 day, virtual)

☐ **Executive Briefing**

-   Executive AI Governance Briefing (half-day, on-site or virtual)

☐ **Corporate Subscription**

-   Team, Department, or Enterprise subscription

**2. PHI in Training Context**

**Use of PHI during training:**

  Training Element        Real PHI Allowed?          Guidance
  ----------------------- -------------------------- ---------------------------------------------------
  Course examples         ❌ No                       Use synthetic data or publicly available examples
  Hands-on exercises      ❌ No                       Instructor provides de-identified datasets
  Customer case studies   ⚠️ Only if de-identified   Requires legal review before inclusion
  Q&A discussions         ⚠️ Hypothetical only       Participants must not share real PHI
  Lab environments        ❌ No                       Sandbox environments only

**3. Training Materials**

**Training materials provided by Business Associate:**

-   Course slides and handouts

-   Exercise files and sample data (synthetic only)

-   Reference documentation

-   Certification study guides

**License:** Customer may use training materials for internal training
purposes only. Redistribution prohibited.

**PHI Policy:** Training materials do not contain real PHI. If Customer
requests customized training materials incorporating their data, a
separate Statement of Work will address PHI handling.

**4. Participant Confidentiality**

**For instructor-led training:**

Participants are reminded:

-   Do not share real PHI during class discussions

-   Use hypothetical examples only

-   If you accidentally disclose PHI, notify the instructor immediately

Business Associate will:

-   Include confidentiality reminder at start of each session

-   Stop discussions if PHI is inadvertently disclosed

-   Not record sessions if PHI might be discussed

**5. Custom Training Engagements**

If Customer requests custom training using their actual systems or data:

**Requirements:**

-   Separate Statement of Work required

-   Must specify whether PHI will be present

-   If PHI present, training team must complete HIPAA training

-   Training environment must be non-production

-   All training materials containing PHI destroyed within 30 days

**EXHIBIT A-6: SUPPORT SERVICES**

**Service Description:** Technical support for Phase Mirror platform and
services.

**1. Support Tier**

☐ **Standard Support** (included with Team tier)

-   Email support

-   24-hour critical response

-   48-hour high response

-   5 business days normal response

☐ **Priority Support** (included with Business tier)

-   Email and phone support

-   4-hour critical response

-   8-hour high response

-   24-hour normal response

☐ **Premium Support / TAM** (included with Enterprise tier)

-   Email, phone, and Slack/Teams support

-   1-hour critical response

-   4-hour high response

-   8-hour normal response

-   Dedicated Technical Account Manager

-   Quarterly business reviews

**2. PHI in Support Interactions**

**Support channels and PHI handling:**

  Channel                             PHI Allowed?      Requirements
  ----------------------------------- ----------------- ------------------------------------------
  Support tickets (web portal)        ⚠️ If necessary   Encrypted, access logged
  Email support                       ⚠️ If necessary   Encrypted email required
  Phone support                       ⚠️ Verbal only    Not recorded, no screen sharing with PHI
  Screen sharing (critical issues)    ⚠️ If necessary   Session not recorded, time-limited
  Remote access to Customer systems   ❌ No              Customer performs actions under guidance
  Slack/Teams channels                ⚠️ If necessary   Customer-controlled workspace only

**3. Support Team Access**

**Phase Mirror support engineers may access:**

  Access Type              Conditions                          Duration        Logging
  ------------------------ ----------------------------------- --------------- ------------------
  Platform audit logs      Break-glass only, critical issues   Session-based   Full audit trail
  Customer configuration   View-only, troubleshooting          Session-based   Full audit trail
  Dissonance reports       Customer-shared only                Session-based   Full audit trail

**Support engineers will NOT:**

-   Access Customer Data without explicit permission

-   Download or retain Customer Data locally

-   Share PHI with other customers or third parties

**4. Support Data Retention**

**Support ticket data retention:**

-   Active tickets: Until resolution + 90 days

-   Closed tickets: 2 years from closure

-   PHI in tickets: Redacted after resolution unless Customer requests
    > retention for historical reference

**5. Critical Issue Escalation**

**For critical issues requiring PHI access:**

1.  Support engineer requests Customer approval

2.  Customer provides time-limited access credentials

3.  Access is logged and monitored

4.  Access revoked immediately upon issue resolution

5.  Incident report documents PHI accessed

**6. Offshore Support Restrictions**

**For customers requiring U.S.-only support:**

☐ Customer requires U.S.-based support personnel only\
☐ No restriction on support personnel location

If U.S.-only support required:

-   All support engineers accessing PHI will be U.S.-based

-   Data will not be transferred to non-U.S. locations

-   Available for Enterprise tier only

**EXHIBIT A-7: ADVISORY RETAINER SERVICES**

**Service Description:** Ongoing strategic advisory services for AI
governance.

**1. Retainer Tier**

☐ **Advisor Tier** (\$10,000/month)

-   4 hours/month advisory calls

-   Email access

-   24-48 hour response time

☐ **Strategic Partner Tier** (\$25,000/month)

-   Unlimited advisory calls

-   Quarterly on-site visits

-   4-8 hour response time

☐ **Board Advisor Tier** (\$50,000/month)

-   Board meeting attendance

-   Crisis response

-   2-hour response time

**2. Advisory Activities Involving PHI**

**Advisor may provide guidance on:**

-   Strategic AI governance decisions

-   Regulatory compliance questions

-   Policy development and review

-   Incident response (if PHI breach occurs)

-   Board reporting and risk communication

**PHI Handling:**

-   Discussions use hypothetical examples or de-identified scenarios
    > when possible

-   If Customer shares specific PHI-containing documents for review,
    > they are handled per consulting services provisions (Exhibit A-3)

-   Advisor does not retain Customer PHI between calls unless explicitly
    > requested for continuity

**3. Communication and Documentation**

**Advisory communications:**

-   Calls are not recorded

-   Advisor may take notes for continuity (stored securely, destroyed at
    > contract termination)

-   Email advice does not include quoted PHI

-   Document reviews use secure file sharing only

**4. Crisis Response (Board Advisor Tier Only)**

**If Customer experiences a PHI breach or compliance incident:**

Advisor will:

-   Provide immediate strategic guidance (within 2 hours)

-   Assist with breach assessment and regulatory notification planning

-   Support board/executive communications

-   Not perform technical breach investigation (separate engagement
    > required)

**Access to breach information:**

-   Advisor will have access to breach details as necessary to provide
    > guidance

-   All breach information handled as PHI under this BAA

-   Advisor subject to confidentiality obligations for sensitive breach
    > details

**EXHIBIT SELECTION GUIDE**

**Use this guide to determine which exhibits to attach:**

  Customer Using                  Required Exhibits         Optional Exhibits
  ------------------------------- ------------------------- -------------------------------------------------------
  Platform only (no consulting)   A-1                       A-2 (if using Healthcare Pack), A-6 (support details)
  Platform + Healthcare Pack      A-1, A-2                  A-6 (support details)
  Consulting only (no platform)   A-3                       A-5 (if training included)
  Implementation project          A-1, A-4                  A-6 (post-implementation support)
  Training only                   A-5                       None
  Full enterprise engagement      A-1, A-2, A-3, A-4, A-6   A-7 (if retainer included)

**Multiple exhibits may be attached to a single BAA.**

**EXHIBIT SIGNATURE PAGE**

**The undersigned acknowledge that the following exhibits are attached
to and form part of the Business Associate Agreement dated \[Date\]:**

**Attached Exhibits:** (check all that apply)

-   ☐ Exhibit A-1: Platform Services (SaaS)

-   ☐ Exhibit A-2: Healthcare & Life Sciences Compliance Pack

-   ☐ Exhibit A-3: Consulting Services

-   ☐ Exhibit A-4: Implementation Services

-   ☐ Exhibit A-5: Training Programs

-   ☐ Exhibit A-6: Support Services

-   ☐ Exhibit A-7: Advisory Retainer Services

**COVERED ENTITY:**

Signature: \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

Name: \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

Title: \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

Date: \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

**BUSINESS ASSOCIATE (Phase Mirror):**

Signature: \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

Name: \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

Title: \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

Date: \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

These exhibit templates provide detailed, service-specific PHI handling
procedures while maintaining consistency with the main BAA. Would you
like me to create:

-   A simplified checklist version for sales to determine which exhibits
    > to use

-   An exhibit amendment template for adding services mid-contract

-   Customer-facing summaries of each exhibit

-   Internal implementation checklists for each exhibit\'s requirements?

⁂

1.  A Clear Guide to Phase Mirror\'s Services.pdf

2.  Phase mirror dissonance\_\_\_Open core must be useful.pdf

3.  Phase Mirror\_ Comprehensive Services Catalog.docx.pdf

4.  License\_ Strategic & Legal Analysis.pdf

5.  Phase Mirror\_ Consultation & SaaS.pdf

6.  Agentic Domain-Specific Reasoning.pdf

7.  Policy Memo\_ Managing Agentic AI Liability with the Phase Mirror
    > Framework.pdf

8.  The Phase Mirror does not resolve dissonance---it names it.pdf

9.  Understanding Phase Mirror Dissonance\_ A Beginner\'s Guide.pdf

10. The Phase of Mirror Dissonance.pdf

11. Implementation Guide\_ Applying Phase Mirror Dissonance.pdf
