HIPAA Addendum

This HIPAA Addendum is included to help protect customer health information and define each party’s responsibilities for maintaining HIPAA compliance. It outlines the security and privacy measures used when protected health information (PHI) may be processed or accessed.

Lumelight HIPAA Addendum

Version: HIPAA-2026-01
Effective Date: May 8, 2026

This HIPAA Addendum (“Addendum”) forms part of and is incorporated into any applicable Lumelight Order Form or other ordering document referencing this Addendum between Compliance Holdings LLC d/b/a Lumelight (“Lumelight”) and the applicable contracting party (“Client”).

1. APPLICABILITY

This Addendum applies only to the extent Lumelight creates, receives, maintains, processes, or transmits Protected Health Information (“PHI”) in connection with the Services.

Depending on Client’s role under HIPAA and the nature of the Services:

Client may act as a Covered Entity, Plan Sponsor, or Business Associate; and
Lumelight may act as either:
- a Business Associate; or
- a Subcontractor to a Business Associate,

in each case as defined under HIPAA.

This Addendum shall apply only to the extent required by HIPAA and only with respect to PHI subject to HIPAA.

2. DEFINITIONS

“HIPAA” means collectively the Health Insurance Portability and Accountability Act of 1996, the HITECH Act, and related regulations promulgated by the U.S. Department of Health and Human Services (“HHS”).
“PHI” “Protected Health Information” or “PHI” shall have the meaning assigned under HIPAA and shall be limited to information created, received, maintained, or transmitted by Lumelight on behalf of Client in connection with the Services.
“Security Incident” means the attempted or successful unauthorized access, use, disclosure, modification, or destruction of information or interference with system operations.
“Subcontractor” shall have the meaning assigned under HIPAA.

3. PERMITTED USES AND DISCLOSURES

Lumelight may use and disclose PHI:

to perform the Services;
for proper management and administration of Lumelight’s business;
as required by law;
to provide data aggregation services as permitted under HIPAA;
to create de-identified information in accordance with HIPAA;
to report violations of law; and
for any other purpose permitted under HIPAA.

Lumelight shall limit uses and disclosures of PHI to the minimum necessary amount required to accomplish the intended purpose.

4. LUMELIGHT OBLIGATIONS

Lumelight shall:

not use or disclose PHI except as permitted by this Addendum or required by law;
implement appropriate administrative, technical, and physical safeguards to protect PHI;
comply with applicable provisions of the HIPAA Privacy Rule, Security Rule, and Breach Notification Rule;
report to Client any Breach of Unsecured PHI or Security Incident without unreasonable delay following discovery;
ensure that any Subcontractor receiving PHI agrees in writing to substantially similar restrictions and conditions;
provide access, amendment, and accounting support to the extent required under HIPAA;
cooperate with Client regarding HIPAA compliance obligations reasonably related to the Services; and
mitigate harmful effects of any unauthorized use or disclosure of PHI to the extent practicable.

5. CLIENT OBLIGATIONS

Client shall:

obtain all necessary authorizations, consents, and permissions relating to PHI;
not request Lumelight to use or disclose PHI in any manner that would violate HIPAA;
notify Lumelight of any applicable restrictions or limitations affecting PHI;
remain solely responsible for plan administration decisions, benefit determinations, legal compliance obligations applicable to Client, and communications with individuals unless otherwise expressly agreed.

6. BREACH RESPONSE

In the event of a Breach of Unsecured PHI:

Lumelight shall provide reasonably available information necessary for Client to satisfy applicable breach notification obligations;
the parties shall reasonably cooperate in investigating and mitigating the incident; and
unless otherwise agreed in writing, Client shall be responsible for determining whether notifications are legally required and for providing such notifications.

7. SUBCONTRACTORS

Lumelight may use Subcontractors in connection with the Services. Lumelight shall require any Subcontractor that creates, receives, maintains, or transmits PHI on Lumelight’s behalf to agree to written obligations substantially similar to those contained in this Addendum.

8. DE-IDENTIFIED AND AGGREGATED DATA

Lumelight may de-identify PHI in accordance with HIPAA, create aggregated or anonymized data sets, and use such de-identified or aggregated data for any lawful business purpose. De-identified and aggregated data shall not constitute Protected Health Information and may be used by Lumelight for lawful business purposes.

9. TERM AND TERMINATION

This Addendum shall remain in effect for so long as Lumelight maintains PHI in connection with the Services.

Either party may terminate this Addendum for material breach if such breach remains uncured thirty (30) days after written notice.

Upon termination, Lumelight shall return or destroy PHI where required under HIPAA unless retention is legally required or operationally infeasible, in which case Lumelight shall continue protecting such PHI in accordance with this Addendum.

10. LIABILITY

Liability arising under this Addendum shall be governed by the limitation of liability provisions contained in the applicable Order Form and Service Terms unless otherwise expressly stated therein.

11. ORDER OF PRECEDENCE

If there is a conflict between this Addendum and the applicable Order Form or Service Terms regarding PHI or HIPAA compliance obligations, this Addendum shall control solely with respect to HIPAA-related matters.

12. ENTERPRISE / NEGOTIATED BAAS

If Client requires a separate negotiated business associate agreement, the parties may execute such agreement, which shall supersede this Addendum solely with respect to HIPAA-related matters addressed therein.

13. AMENDMENTS

Lumelight may publish updated versions of this Addendum from time to time. The version referenced in the applicable Order Form shall govern unless otherwise agreed in writing by the parties.