PPL AI Business Associate Agreement

Version 2.0, Last updated: October 19, 2026. Part of the PPL AI Terms of Service (ppl-ai.com/terms) and accepted by its own checkbox at checkout.

This Business Associate Agreement ("BAA") is between the Customer under the PPL AI Terms of Service ("Covered Entity") and PPL AI Inc. d/b/a People AI Workforce ("Business Associate") and forms part of those Terms (the "Agreement"). It applies to all Protected Health Information that Business Associate creates, receives, maintains or transmits on behalf of Covered Entity through the Services for any Community. Capitalized terms not defined here have the meanings given in HIPAA (45 C.F.R. Parts 160 and 164) or in the Agreement.

B.1 Permitted uses and disclosures. Business Associate may use and disclose PHI only (a) to provide, support, secure and improve the Services for Covered Entity; (b) for Business Associate's proper management and administration; (c) to provide data aggregation services relating to Covered Entity's health care operations; (d) to de-identify PHI in accordance with 45 C.F.R. § 164.514(b), after which the data is not PHI and may be used as Usage Data; and (e) as required by law.

B.2 Prohibited uses. Business Associate will not sell PHI, use PHI for marketing, use PHI in identifiable form to train models made available to other customers, or attempt to re-identify de-identified data.

B.3 Safeguards. Business Associate will implement the administrative, physical and technical safeguards required by the Security Rule (45 C.F.R. Part 164, Subpart C), including encryption of PHI in transit and at rest, access limited to trained personnel, annual risk analysis, storage primarily in the United States, and access by personnel outside the United States only through Business Associate-controlled environments that do not permit download or local storage.

B.4 Subcontractors. Business Associate will enter into a written agreement meeting 45 C.F.R. § 164.504(e) with each subcontractor that creates, receives, maintains or transmits PHI on its behalf (including cloud hosting, telephony, transcription and model providers), and will provide a list of such subcontractors on request.

B.5 Reporting. Business Associate will report to Covered Entity (a) any use or disclosure of PHI not permitted by this BAA, (b) any Security Incident, and (c) any Breach of Unsecured PHI, without unreasonable delay and in no case later than 10 business days after discovery, including the information required by 45 C.F.R. § 164.410(c) to the extent available. Unsuccessful Security Incidents such as pings and port scans are reported in aggregate on request. Covered Entity is responsible for notifications to individuals, HHS and the media unless the parties agree otherwise in writing.

B.6 Individual rights. Within 15 business days of Covered Entity's request, Business Associate will make PHI in a Designated Record Set available for access (§ 164.524) and amendment (§ 164.526), and will provide the information needed for an accounting of disclosures (§ 164.528). Requests received directly from individuals are forwarded to Covered Entity.

B.7 Minimum necessary; books and records. Business Associate will limit uses, disclosures and requests of PHI to the minimum necessary, and will make its internal practices, books and records relating to PHI available to the Secretary of HHS for determining compliance.

B.8 Covered Entity obligations. Covered Entity will not request Business Associate to use or disclose PHI in a manner not permitted under HIPAA, will notify Business Associate of any limitation in its notice of privacy practices, any change in or revocation of an individual's authorization, and any restriction agreed under § 164.522, to the extent they affect Business Associate's use or disclosure of PHI.

B.9 Term and termination. This BAA runs with the Agreement. Covered Entity may end the affected subscription, or the Agreement, if Business Associate materially breaches this BAA and does not cure within 30 days of written notice. On termination, Business Associate will return or destroy all PHI in accordance with Section 13.5 of the Terms; where return or destruction is infeasible, Business Associate will extend the protections of this BAA to that PHI and limit further uses and disclosures to the purposes that make return or destruction infeasible, for as long as it retains the PHI.

B.10 Breach costs, liability and precedence. Where a Breach of Unsecured PHI is caused by Business Associate's breach of this BAA, Business Associate will reimburse Covered Entity's reasonable, documented costs of legally required individual notifications, subject to Section 19 of the Terms; all other breach-response costs are Covered Entity's. Business Associate's liability under this BAA is subject to the limitations in Section 19 of the Terms. This BAA controls over the Terms on matters concerning PHI. Any ambiguity is resolved to permit compliance with HIPAA. This BAA is amended automatically to the extent required by a change in HIPAA.