HIPAA and BAAs — Exhibit B — your responsibilities

Covered Entity will: (a) store no PHI in the Services before the Agreement is executed, and none outside the scope of Exhibit A after it; (b) configure and use the access controls the Services provide — workspace membership, roles, table privacy, field-level permissions, and two-factor authentication or single sign-on for its workforce — as appropriate to the sensitivity of what it stores; (c) not request any use or disclosure of PHI that would be impermissible under HIPAA if made by Covered Entity; (d) notify Business Associate in writing of any restriction, revocation or confidential-communication arrangement under 45 C.F.R. §§ 164.508, 164.510 or 164.522 that affects Business Associate's permitted handling of PHI; and (e) be responsible for the lawfulness of the PHI it collects and places in the Services.