Business Associate Agreement

Version 1.1.0 — published 2026-10-17. It takes effect for a practice when an owner or administrator signs it.

BUSINESS ASSOCIATE AGREEMENT

Version 1.1.0

Last updated: October 17, 2026

This Business Associate Agreement (this "Agreement") is between Dentist Owners LLC, an Oregon limited liability company, d/b/a Dental Refer ("Business Associate"), and the dental practice or other organization whose authorized representative signs this Agreement in the Dental Refer service ("Customer"). This Agreement takes effect on the date Customer's authorized representative signs it (the "Effective Date").

1. Definitions

1.1 HIPAA terms. Terms that this Agreement uses but does not define have the meanings given to them in the HIPAA Rules. Those terms include Breach, Data Aggregation, Designated Record Set, Health Care Operations, Individual, Notice of Privacy Practices, Required by Law, Secretary, Security Incident, Subcontractor and Unsecured Protected Health Information, as well as "disclosure" and "use". When this Agreement uses "covered entity" or "business associate" in lower case, it means those terms as defined in 45 CFR 160.103.

1.2 HIPAA Rules. "HIPAA Rules" means the Privacy, Security, Breach Notification and Enforcement Rules at 45 CFR Parts 160 and 164, issued under the Health Insurance Portability and Accountability Act of 1996 and the Health Information Technology for Economic and Clinical Health Act.

1.3 PHI. "PHI" means protected health information, as defined in 45 CFR 160.103, that Business Associate creates, receives, maintains or transmits on behalf of Customer. PHI includes electronic PHI. "Unsecured PHI" means PHI that is Unsecured Protected Health Information.

1.4 Services. "Services" means the Dental Refer referral coordination service, and the related services, that Business Associate provides to Customer.

1.5 Terms of Service and Privacy Policy. "Terms of Service" means the Dental Refer Terms of Service that Customer has accepted, as in effect from time to time, published at dentalrefer.com/terms. A change to the Terms of Service applies to this Agreement only as Section 25 of the Terms of Service provides for material changes, and never to a claim that accrued before the change takes effect for Customer. "Privacy Policy" means the Dental Refer Privacy Policy published at dentalrefer.com/privacy.

1.6 Users and Account Owner. A "User" is a person whom Customer allows to use the Services under Customer's account. The "Account Owner" is the User who holds the owner role in Customer's account or, if there is none, a User who holds an administrator role.

1.7 Days and writing. "Days" means calendar days. "Business days" means Monday through Friday, except United States federal holidays. "In writing" and "written" include email.

2. Customer's Role and the Parties' Relationship

2.1 Covered entity customers. If Customer is a covered entity, Business Associate is Customer's business associate with respect to PHI.

2.2 Business associate customers. If Customer is a business associate of one or more covered entities, such as a dental support organization that serves dental practices, Business Associate is Customer's Subcontractor. This Agreement is then the written agreement that 45 CFR 164.502(e)(1)(ii), 164.504(e)(5) and 164.314(a)(2)(iii) require, and each reference to Customer's obligations under the HIPAA Rules means the obligations that apply to Customer as a business associate. Customer represents that its agreements with those covered entities allow it to engage Business Associate on the terms of this Agreement, including the uses and disclosures in Section 4. Customer will tell Business Associate in writing of any restriction in those agreements that limits what Business Associate may do under this Agreement. Customer is responsible for giving its covered entities any report or notice that their agreements with Customer require.

2.3 Other customers. If Customer is neither a covered entity nor a business associate, the information it submits to the Services may not be PHI under HIPAA. Business Associate will still protect that information as this Agreement requires for PHI, and each reference to PHI includes it.

2.4 Locations and affiliates. If Customer's account includes more than one practice location or affiliated legal entity, the person who signs this Agreement represents that they are authorized to sign for each of them, and each of them is bound as Customer.

2.5 Independent contractor. Business Associate is an independent contractor. Nothing in this Agreement makes Business Associate an agent, employee, partner or joint venturer of Customer, including under the federal common law of agency. Customer has no right to control the manner or means by which Business Associate performs the Services or this Agreement.

3. Obligations of Business Associate

3.1 No other use or disclosure. Business Associate will not use or disclose PHI other than as permitted or required by this Agreement or as Required by Law.

3.2 Safeguards. Business Associate will use appropriate administrative, physical and technical safeguards, and will comply with Subpart C of 45 CFR Part 164 with respect to electronic PHI, to prevent use or disclosure of PHI other than as this Agreement provides.

3.3 Reporting. Business Associate will report to Customer as Section 5 requires.

3.4 Subcontractors. In accordance with 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2), Business Associate will ensure that each Subcontractor that creates, receives, maintains or transmits PHI on behalf of Business Associate agrees in writing, in an agreement that meets 45 CFR 164.504(e)(5) and 164.314(a)(2)(iii), to the same restrictions and conditions on the use and disclosure of PHI that apply to Business Associate, and to comply with the applicable requirements of Subpart C of 45 CFR Part 164. A Subcontractor's agreement may differ from this Agreement in other respects, such as its reporting periods. Customer authorizes Business Associate to use Subcontractors that meet this Section. Business Associate publishes a list of the vendors it uses to provide the Services at dentalrefer.com/subprocessors.

3.5 Individuals' rights. Business Associate will meet the obligations in Section 6.

3.6 Delegated obligations. Business Associate will carry out an obligation of Customer under Subpart E of 45 CFR Part 164 only if Customer delegates it in a writing that Business Associate accepts. To the extent Business Associate carries out such an obligation, it will comply with the requirements of Subpart E that apply to Customer in performing that obligation.

3.7 Books and records. Business Associate will make its internal practices, books and records relating to the use and disclosure of PHI available to the Secretary for the purpose of determining Customer's or Business Associate's compliance with the HIPAA Rules. This Section does not waive any legal privilege.

3.8 Minimum necessary. Business Associate will make reasonable efforts to limit its uses and disclosures of, and requests for, PHI to the minimum necessary to accomplish the intended purpose, as 45 CFR 164.502(b) and 164.514(d) require.

3.9 Mitigation. Business Associate will take reasonable steps, to the extent practicable, to mitigate any harmful effect that is known to Business Associate of a use or disclosure of PHI by Business Associate in violation of this Agreement.

3.10 No sale or marketing. Business Associate will not sell PHI and will not use or disclose PHI for marketing, advertising or fundraising.

3.11 Information about safeguards. On Customer's reasonable written request, made not more than once in any 12-month period, Business Associate will give Customer a written summary of its safeguards for PHI. This Agreement gives Customer no other right to audit or inspect Business Associate's facilities, systems or records.

4. Permitted and Required Uses and Disclosures

4.1 Services. Business Associate may use and disclose PHI as necessary to provide the Services to Customer, including to:

(a) create, store, display, organize, route, transmit and track referrals and their attachments, images, messages, letters, reports, scheduling details and related records;

(b) send PHI to the recipients that Customer's Users choose, including other health care providers, their staff and other practices that use the Services, by the methods the Services support, such as delivery within the Services, fax and email;

(c) receive PHI for Customer from health care providers, patients and others, including referrals sent to Customer through the Services, by fax or through Customer's public pages in the Services;

(d) run the insurance eligibility checks that Customer's Users request;

(e) communicate with patients when Customer's Users use a feature of the Services for that purpose;

(f) operate the other features of the Services that Customer chooses to use;

(g) provide support, troubleshooting, maintenance, security monitoring, backup and recovery for the Services; and

(h) disclose PHI to Subcontractors that meet Section 3.4, as needed for any of these purposes.

4.2 Disclosures that Customer directs. When a User sends or shares PHI through the Services, for example by choosing the recipient of a referral, message, fax or email, the disclosure is Customer's disclosure, and Business Associate makes it on Customer's behalf. Customer is responsible for deciding what PHI its Users enter into and send through the Services, for making sure that each such disclosure is permitted by law, and for addressing it to the intended recipient. Business Associate may treat instructions given through a User's account as Customer's instructions.

4.3 Required by Law, the Secretary and reports of violations. Business Associate may use and disclose PHI as Required by Law. Business Associate will disclose PHI (a) to the Secretary when the Secretary requires it to investigate or determine Business Associate's compliance with the HIPAA Rules, and (b) to Customer, an Individual or an Individual's designee when 45 CFR 164.502(a)(4)(ii) requires it, as described in Section 6.1. Business Associate may also use PHI to report violations of law to appropriate federal and state authorities, consistent with 45 CFR 164.502(j)(1).

4.4 Management and administration. As 45 CFR 164.504(e)(4) permits, Business Associate may use PHI for its proper management and administration or to carry out its legal responsibilities. Business Associate may disclose PHI for those purposes only if (a) the disclosure is Required by Law, or (b) Business Associate obtains reasonable assurances from the person to whom the PHI is disclosed that the PHI will be held confidentially and used or further disclosed only as Required by Law or for the purpose for which it was disclosed to that person, and that the person will notify Business Associate of any instance of which it is aware in which the confidentiality of the PHI has been breached.

4.5 De-identified information. Business Associate may use PHI to create information that is de-identified in accordance with 45 CFR 164.514(b). Business Associate will use de-identified information only to operate and improve the Services. It will not attempt to re-identify any Individual, will not sell de-identified information, and will not disclose it except to its Subcontractors and service providers for those purposes. De-identified information is not PHI, and Section 9 does not apply to it.

4.6 Data Aggregation. Business Associate will not provide Data Aggregation services relating to Customer's Health Care Operations unless Customer requests them in writing. If Customer does, Business Associate may use PHI to provide those services, as 45 CFR 164.504(e)(2)(i)(B) permits.

4.7 Limit on uses and disclosures. Business Associate will not use or disclose PHI in a manner that would violate Subpart E of 45 CFR Part 164 if done by Customer, except for the uses and disclosures that Sections 4.4 and 4.6 permit.

5. Reporting

5.1 Uses and disclosures not provided for. Business Associate will report to Customer any use or disclosure of PHI not provided for by this Agreement of which it becomes aware, without unreasonable delay and no later than 10 business days after becoming aware of it, or within any shorter period that applicable law requires of Business Associate.

5.2 Security Incidents. Business Associate will report to Customer any Security Incident of which it becomes aware, other than an Unsuccessful Security Incident as defined in Section 5.3, without unreasonable delay and no later than 10 business days after becoming aware of it, or within any shorter period that applicable law requires of Business Associate.

5.3 Unsuccessful Security Incidents. This Section is notice to Customer of the ongoing existence and occurrence of Unsuccessful Security Incidents, and Customer agrees that no further notice of them is required. An "Unsuccessful Security Incident" is an attempt that does not result in unauthorized access to, or use, disclosure, modification or destruction of, PHI or any information system that creates, receives, maintains or transmits PHI, or in interference with system operations in such an information system. Examples include pings and other broadcast attacks on firewalls, port scans, unsuccessful log-in attempts, denial-of-service attempts that do not interrupt the Services, and similar unsuccessful attempts. An incident in which Business Associate cannot determine whether PHI was accessed is not an Unsuccessful Security Incident.

5.4 Breaches of Unsecured PHI. Following discovery of a Breach of Unsecured PHI, Business Associate will notify Customer as 45 CFR 164.410 requires, without unreasonable delay and no later than 10 business days after discovery, or within any shorter period that applicable law requires of Business Associate. A Breach is treated as discovered as 45 CFR 164.410(a)(2) provides. To the extent possible, the notice will identify each Individual whose Unsecured PHI has been, or is reasonably believed by Business Associate to have been, accessed, acquired, used or disclosed during the Breach. At the time of the notice, or promptly afterwards as the information becomes available, Business Associate will also give Customer any other available information that Customer must include in its notice to Individuals under 45 CFR 164.404(c). That includes, to the extent known, a brief description of what happened, the date of the Breach and the date of its discovery, the types of Unsecured PHI involved, and what Business Associate is doing to investigate the Breach, mitigate harm and protect against further Breaches.

5.5 Combined and interim reports. One report may satisfy more than one paragraph of this Section. Business Associate may report an event under Section 5.1 or 5.2 while it determines whether the event is a Breach. A report under this Section is not an admission of fault or liability.

5.6 Law enforcement delay. Business Associate will delay a report or notice when a law enforcement official requires a delay under 45 CFR 164.412.

5.7 Notices to Individuals and others. Except for a notice that the law requires Business Associate itself to give, Customer is responsible for deciding whether and how to notify Individuals, the Secretary, the media and any state authority of a Breach, and for giving those notices. Business Associate will not give those notices on Customer's behalf unless Customer asks in writing and Business Associate agrees in writing. Business Associate will reasonably cooperate with Customer's notification by providing the information described in Section 5.4.

5.8 How reports are made. Business Associate will send each report under this Section by email to every User who holds the owner or administrator role in Customer's account, and to any other address that Customer designates in writing for security notices. For a report under Section 5.4, Business Associate will also post a notice in the Services that the report has been sent. If Business Associate learns that none of the emails carrying a report under Section 5.4 was delivered, or if Customer has not acknowledged that report within 2 business days after it was sent, Business Associate will also call Customer at the telephone number on file in the Services and send the report by mail to Customer's postal address on file. Business Associate will not put Individual-level details in ordinary unencrypted email. It will provide them by encrypted email or another secure method.

5.9 State law. If a state law requires Business Associate itself to notify Customer of a breach of security sooner than this Section allows, or to notify a government authority, Business Associate will do so as that law requires. This applies in particular to information that is not PHI under HIPAA, as Section 2.3 describes. For example, ORS 646A.604 generally requires a vendor to notify the business for which it holds personal information about Oregon residents no later than 10 days after discovering a breach of security of that information, and in some cases to notify the Oregon Attorney General.

6. Individuals' Rights

6.1 Access. To the extent Customer cannot obtain PHI in a Designated Record Set through its own access to the Services, Business Associate will make that PHI available to Customer no later than 15 days after Customer's written request, as necessary for Customer to meet its obligations under 45 CFR 164.524. When an Individual requests an electronic copy of PHI, Business Associate will provide it to Customer, the Individual or the Individual's designee, as Customer directs and as 45 CFR 164.502(a)(4)(ii) requires.

6.2 Amendment. To the extent Customer cannot make an amendment itself through the Services, Business Associate will, no later than 30 days after Customer's written request, make PHI in a Designated Record Set available for amendment and incorporate any amendment that Customer directs or agrees to under 45 CFR 164.526.

6.3 Accounting of disclosures. Business Associate will maintain, and will make available to Customer no later than 30 days after Customer's written request, the information about disclosures of PHI made by Business Associate that Customer needs to provide an accounting of disclosures under 45 CFR 164.528.

6.4 Requests made to Business Associate. If an Individual asks Business Associate directly for access to, amendment of, or an accounting of disclosures of, PHI, Business Associate will forward the request to Customer no later than 5 business days after receiving it, and may tell the Individual that it has done so. Business Associate will not grant or deny the request itself unless Customer has delegated that to it under Section 3.6.

6.5 Restrictions and confidential communications. Business Associate will comply with any restriction on the use or disclosure of PHI, and any confidential-communications arrangement, that Customer has agreed to or must accommodate under 45 CFR 164.522, once Customer notifies Business Associate of it in writing. Business Associate may comply by stopping, for the PHI it covers, the uses and disclosures that it prohibits, including by turning off a feature of the Services for that PHI or, if the Services cannot do that, for Customer's account. For the uses and disclosures that Customer's Users direct, and those made by a feature of the Services that Customer has chosen to use, Customer carries out the restriction or arrangement as Section 7.3(b) describes.

7. Obligations of Customer

7.1 Notices to Business Associate. Customer will notify Business Associate in writing of (a) any limitation in Customer's Notice of Privacy Practices under 45 CFR 164.520, (b) any change in, or revocation of, an Individual's permission to use or disclose PHI, and (c) any restriction on the use or disclosure of PHI that Customer has agreed to or must comply with under 45 CFR 164.522, in each case to the extent it may affect Business Associate's use or disclosure of PHI.

7.2 Permissible requests. Customer will not ask Business Associate to use or disclose PHI in any manner that would not be permissible under Subpart E of 45 CFR Part 164 if done by Customer, except as Sections 4.4 and 4.6 permit.

7.3 Restrictions and confidential communications.

(a) Except for a restriction or request that Customer is required by law to accept, including under 45 CFR 164.522(a)(1)(vi) and 164.522(b)(1)(i), Customer will not agree to a restriction or a confidential-communications request that would require Business Associate to change how the Services work, unless Business Associate first agrees in writing.

(b) For each restriction or confidential-communications arrangement that Customer has agreed to, including one that Customer is required by law to accept, Customer is responsible for not directing through the Services any use or disclosure that it prohibits, such as an eligibility check, fax, email or message to the patient. Customer is also responsible for not using any feature of the Services that would make such a use or disclosure automatically for the PHI it covers.

7.4 Permissions. Customer will obtain any consent, authorization or other permission that the law requires for the PHI that Customer and its Users submit to the Services and for each disclosure that they direct.

7.5 Users and accounts. Customer is responsible for its Users, including for giving and removing their access, for the roles it assigns them, for the security of their sign-in credentials, verification methods and devices, and for their compliance with this Agreement. If Customer learns or suspects that a User's account, password, verification method or device has been lost, stolen or used without authorization, Customer will tell Business Associate promptly, and in any case within 24 hours after Customer learns of it. Customer may give this notice by email to security@dentalrefer.com, without PHI, or by telephone at (503) 662-8088, instead of as Section 11.1 provides.

7.6 No PHI by ordinary email. Customer will send PHI to Business Associate only through the Services or by another secure method that Business Associate approves, and will not include PHI in ordinary email to any Dental Refer address.

7.7 Compliance. Customer will comply with the HIPAA Rules as they apply to Customer.

8. Term and Termination

8.1 Term. This Agreement starts on the Effective Date and continues until the earliest of (a) the closure or termination of Customer's account for the Services under the Terms of Service, (b) termination under Section 8.2 or 8.3, and (c) its replacement by a later version under Section 8.4.

8.2 Termination by Customer. If Customer determines that Business Associate has violated a material term of this Agreement, Customer may give Business Associate written notice describing the violation. If Business Associate does not cure the violation, or end it if it is continuing, within 30 days after receiving the notice, Customer may terminate this Agreement, and the Services that involve PHI, by written notice. If the violation cannot be cured, Customer may terminate them in the same way without waiting for that period. Fees are governed by the Terms of Service.

8.3 Termination or suspension by Business Associate. If Customer violates a material term of this Agreement, Business Associate may give Customer written notice describing the violation. If Customer does not cure the violation within 30 days after the notice, Business Associate may terminate this Agreement, and the Services that involve PHI, by written notice. Business Associate may instead suspend the Services that involve PHI until the violation is cured. It may suspend them without waiting for the cure period if it reasonably believes that suspension is needed to protect PHI or to comply with law.

8.4 New versions. Business Associate may publish a new version of this Agreement in the Services, including to comply with a change in law. A new version binds Customer when Customer's authorized representative signs it, and from then on it replaces this version. Until then, this version continues to apply to the PHI that Business Associate maintains for Customer. Except where a change in law requires a new version to apply sooner, Business Associate will give Customer at least 30 days' notice before requiring Customer to sign it. After that notice period ends, Business Associate may require Customer to sign the new version before Customer's Users can create or send referrals, add new PHI, or open referrals sent to Customer after that period ends. Business Associate will continue to let Customer's Users view the referrals and other PHI that the Services held for Customer when that period ended, and will tell any practice that sends Customer a referral through the Services that Customer cannot open it until Customer signs. Replacement by a new version is not an end of this Agreement for the purposes of Section 9.

9. Return or Destruction of PHI

9.1 Return or destruction. When this Agreement ends for any reason, Business Associate will, if feasible, return to Customer or destroy all PHI that Business Associate or its Subcontractors still maintain in any form, and will retain no copies, except as Sections 9.2 to 9.4 provide. Customer should save any PHI it needs before its account is closed. No later than 30 days after this Agreement ends, Customer may ask in writing for the return of PHI. Business Associate will return it no later than 30 days after receiving the request, in a commonly used electronic format of its choosing, such as JSON files, with attachments in their original file formats, and may charge its reasonable costs for any other format that Customer requests. Business Associate will destroy the remaining PHI no later than 90 days after this Agreement ends. On Customer's written request, Business Associate will confirm the destruction in writing.

9.2 Records shared with other practices. A referral, and the attachments, messages, letters, reports and other records that go with it, is a record of each practice that sends or receives it through the Services. When this Agreement ends, Business Associate will end Customer's access to those records. Business Associate will continue to maintain them for each other practice that uses the Services, under that practice's own agreement with Business Associate, and Section 9.1 does not require Business Associate to return or destroy them while it does so.

9.3 PHI kept for legal responsibilities. Business Associate may retain PHI that it needs to continue its proper management and administration or to carry out its legal responsibilities, such as security and audit records that it must keep.

9.4 Infeasibility. If returning or destroying any PHI is infeasible, Business Associate will notify Customer of the conditions that make it infeasible. Customer agrees that return or destruction is infeasible only for:

(a) PHI in backups, which is deleted as the backups expire on their regular schedule, and in any case no later than 90 days after the PHI is deleted from the systems that those backups protect; and

(b) copies of PHI that a Subcontractor keeps in its own transmission logs or records, such as fax and email delivery records, where Business Associate cannot delete them itself and the Subcontractor will not delete them at Business Associate's request. Those copies are deleted when the Subcontractor deletes them under its own retention schedule. On Customer's request, Business Associate will tell Customer which Subcontractor holds them and why their deletion is infeasible.

This Section does not cover PHI in Business Associate's databases or file storage, including storage that a Subcontractor operates for Business Associate, which Business Associate will return or destroy as Section 9.1 requires. This Section is notice of the conditions it describes.

9.5 Continuing protection. For as long as Business Associate or its Subcontractors maintain PHI after this Agreement ends, Business Associate will extend the protections of this Agreement to that PHI, will continue to comply with Subpart C of 45 CFR Part 164 for electronic PHI, will limit further uses and disclosures of that PHI to the purposes for which it was retained or that make its return or destruction infeasible, and will return or destroy it when it is no longer needed for those purposes.

9.6 Survival. Sections 2.5, 5, 9, 10 and 11 survive the end of this Agreement. Business Associate's obligations under this Agreement continue to apply to PHI for as long as Business Associate or its Subcontractors maintain it.

10. Responsibility and Liability

10.1 Customer's responsibility. Business Associate is not responsible for a use or disclosure of PHI that Customer or its Users make or direct, for the accuracy, completeness or lawfulness of PHI that Customer or its Users submit, or for the consequences of Customer's failure to meet its obligations under this Agreement.

10.2 Safeguards are not a guarantee. Business Associate's obligation is to maintain the safeguards that this Agreement and Subpart C of 45 CFR Part 164 require. No safeguard can prevent every Security Incident or Breach, and the occurrence of one is not, by itself, a breach of this Agreement.

10.3 Limitation of liability. To the fullest extent permitted by law, Business Associate's liability arising out of or relating to this Agreement is subject to the disclaimers, exclusions and limitations of liability in the Terms of Service, which apply to this Agreement as if they were set out in it. This Agreement does not create any obligation of Business Associate to indemnify Customer.

11. General

11.1 Notices. Notices under this Agreement must be in writing. Business Associate will send notices to Customer at the email address of Customer's Account Owner on file in the Services, or at another contact that Customer designates in writing, except that reports under Section 5 are sent as Section 5.8 provides. Customer is responsible for keeping its contact information in the Services current. Customer will send notices to Business Associate at: Privacy Officer, Dentist Owners LLC d/b/a Dental Refer, PO Box 2007, Beaverton, OR 97075, privacy@dentalrefer.com. Business Associate may change its notice contact by notice to Customer or by publishing the new contact at dentalrefer.com/hipaa. A notice to Customer is effective when sent, except that if Business Associate learns that none of the emails carrying a report under Section 5.4 was delivered, that report is effective when Business Associate gives it by telephone or mail under Section 5.8. A notice to Business Associate is effective when received. Neither party will include PHI in a notice sent by ordinary email.

11.2 Changes in law. The parties will take such action as is necessary to amend this Agreement to comply with the HIPAA Rules and other applicable law as they change. Business Associate will do so by publishing a new version under Section 8.4.

11.3 Interpretation. Any ambiguity in this Agreement will be resolved in favor of a meaning that permits compliance with the HIPAA Rules. A reference to a section of the HIPAA Rules means that section as in effect or as amended. "Including" means "including without limitation". Section headings are for convenience only.

11.4 Relationship to other terms. This Agreement, the Terms of Service and the Privacy Policy together govern Customer's use of the Services. If any of them conflicts with this Agreement about the use, disclosure or protection of PHI, this Agreement controls. In all other matters, including fees, disclaimers, limitations of liability and dispute resolution, the Terms of Service control.

11.5 Earlier versions. From its Effective Date, this Agreement replaces every earlier version of the Business Associate Agreement that Customer signed through the Services. Each earlier version that names "Dental Refer, Inc." as a party was made with Dentist Owners LLC, which operates Dental Refer.

11.6 No third-party beneficiaries. Nothing in this Agreement gives any right or remedy to any person other than the parties and their permitted successors and assigns. No Individual is a third-party beneficiary of this Agreement.

11.7 Assignment. Customer may assign this Agreement only as the Terms of Service allow. Business Associate may assign this Agreement, without Customer's consent, to a successor to the Services that agrees in writing to be bound by it.

11.8 Governing law and disputes. This Agreement is governed by the HIPAA Rules and other applicable federal law and, where federal law does not apply, by the laws of the State of Oregon, without regard to its conflict-of-law rules. Any dispute arising out of or relating to this Agreement will be resolved as the Terms of Service provide for disputes.

11.9 Severability and waiver. If any provision of this Agreement is held invalid or unenforceable, it will be enforced to the maximum extent permitted, and the rest of this Agreement will remain in effect. A party's failure to enforce a provision is not a waiver of it.

11.10 Electronic signatures. The parties agree to sign this Agreement electronically. Electronic signatures and records have the same effect as handwritten signatures and paper records under the federal Electronic Signatures in Global and National Commerce Act (15 U.S.C. 7001 and following) and the Oregon Uniform Electronic Transactions Act (ORS 84.001 to 84.061). Customer's authorized representative signs in the Services, which record the signer's name and title, the account used, the date and time of signing, the IP address and browser used, the version signed and a cryptographic hash of this text. Business Associate signs by publishing this Agreement in the Services with the signature below. The person who signs for Customer confirms that they have read this Agreement and are authorized to bind Customer to it.

Signatures

Business Associate: Dentist Owners LLC d/b/a Dental Refer

By: Merat Ostovar

Title: Authorized Representative; HIPAA Privacy and Security Officer

Customer: signed electronically in the Dental Refer service by Customer's authorized representative, whose name, title and date of signing are recorded with this version.