FREE-CHECK BUSINESS ASSOCIATE AGREEMENT (version FC-1, October 22, 2026)
Between [Practice legal name], [address] (the "Practice" or "you"), a HIPAA covered entity, and Sloth Does LLC, a Wyoming limited liability company doing business as Sadler Billing, 30 N Gould St Ste R, Sheridan, WY 82801 ("Sadler Billing", "we" or "us").
1. What this agreement covers
1.1 The free check. You've asked for a free check of your insurance billing. For it, we receive one or more billing exports from your practice software (the "Export"). We review them to produce a one-page report on your unpaid claims, your rejection rate and how quickly your claims go out (the "Report"), and then we delete them. This agreement covers that work (the "Check") and nothing else.
1.2 No fee. The Check is free. Neither of us has to do any further business with the other.
1.3 Words. "HIPAA" means the Health Insurance Portability and Accountability Act of 1996, the HITECH Act and their regulations at 45 CFR Parts 160 and 164. These terms have the meanings HIPAA gives them (45 CFR 160.103, 164.304 and 164.402): breach, minimum necessary, protected health information, required by law, security incident and unsecured protected health information. "PHI" means the protected health information in the Export, and anything we make from it that still identifies a patient.
2. What we may do with the Export
2.1 Only for the Check. We use the Export only to carry out the Check and produce the Report, for your payment and health care operations. We don't use or disclose it for anything else, except as required by law. If the law does require it, we tell you first, where the law allows.
2.2 The Report holds totals only. It contains counts, amounts and percentages (for example by insurer and age band) and no information that identifies a patient. We email it to the address you give us.
2.3 Things we never do with the Export. We never sell PHI. We never use the Export, or figures from it, in marketing or case studies, or publish them, without your written permission. We never use it to train any software tools, de-identify it for our own use, combine it with other practices' data, or use it to contact your patients.
3. What you send, and how
3.1 Only the claim fields we need. Please export only these fields:
- the insurer (payer) and plan name;
- the date of service, and the date the claim was sent;
- the session code (CPT) and units;
- the billed, allowed and paid amounts, and the patient's share;
- the claim status, rejection or denial reason codes and messages, and the date of the insurer's latest response;
- the rendering clinician;
- a claim or account number to tell claims apart.
We don't need patient names, addresses, phone numbers, email addresses, dates of birth, member IDs, Social Security numbers or diagnosis codes, so leave them out where your software's report allows it. If it doesn't, send the report as it is: we use only the fields listed above. Never include session notes, psychotherapy notes, or records of a federally assisted substance-use disorder program.
3.2 Only through our secure upload page. Send the Export only through our secure upload page, which puts it straight into our encrypted US-hosted storage. Never send it by email, text, fax, file-sharing link or post. If PHI reaches us any other way, we delete it from there and ask you to use the upload page.
3.3 Plans that require US-only handling. Our system checks every file on arrival and automatically separates the rows for these plans (see clause 5.3) before anyone opens the file. Where a spreadsheet doesn't show the insurer, patient details are removed from it before anyone opens it. A file our system can't read, such as a PDF, is opened only if your answers on the upload page say none of your patients are on these plans; otherwise nobody opens it, and we ask you for a spreadsheet instead. If your practice is in Michigan and has patients on Michigan Medicaid, please also export their claims as a separate file where your software allows it, and use the separate upload box marked for them.
3.4 Your part. You confirm that HIPAA allows you to share the Export with us for the Check. You tell us about any restriction you have agreed with a patient, or any limit in your notice of privacy practices, that would affect our use of it. You won't ask us to do anything with the Export that HIPAA wouldn't allow you to do yourself.
4. How we protect it
4.1 The Security Rule. We comply with the HIPAA Security Rule for the Export. We use appropriate safeguards to prevent any use or disclosure of it that this agreement doesn't allow.
4.2 Storage. The Export goes straight from your browser into encrypted, private storage. That storage is in US-hosted, HIPAA-eligible systems run by our hosting provider, under our own business associate agreement with it. Every access is logged.
4.3 Review. We open and review the Export only on a secured, access-controlled desktop hosted in the United States, with two-step sign-in. Nothing can be copied or downloaded from it to anyone's own computer. Any software tools used to work out the figures run inside those same US-hosted systems, under the same hosting agreement, and they don't keep or learn from your data.
4.4 Who sees it. Only the people who need to see the Export for the Check see it. It never passes through our website or email, or onto anyone's own computer or phone.
5. Where the work is done
5.1 Your data stays on US-hosted systems. The PHI is kept on US-hosted systems and never leaves them.
5.2 Our principal. Our principal, Alexander Sadler, may work on those US-hosted systems from outside the United States.
5.3 Plans that require US-only handling. These are plans whose rules require their members' information to be handled only inside the United States: for example Michigan Medicaid and Aetna Medicare Advantage, until Aetna approves. Their rows are kept in separate storage that Alexander can't open. They are turned into totals automatically inside our US-hosted systems and then deleted, without anyone opening them. Alexander sees only totals for them, or, where a spreadsheet doesn't show the insurer, figures with patient details removed.
6. Subcontractors
Our hosting provider and our US-based billers may create, receive, keep or send the Export for us. Each has agreed in writing to the same restrictions and conditions that this agreement places on us (45 CFR 164.502(e)(1)(ii) and 164.504(e)(5)). We use no other subcontractor for the Check without your written consent.
7. Deleting the Export
7.1 When. We delete the Export, and every working copy of it, within 5 business days after we send the Report. If we don't produce a Report (for example because the file can't be read and you don't send another), we delete it within 30 days after upload.
7.2 What we keep. We keep nothing from the Export except the Report (totals only) and a record of the upload and deletion dates. On request, we confirm the deletion in writing.
7.3 If you become a client. The Export is still deleted. From then on we work in your own practice software.
7.4 If deletion isn't feasible. If deleting any of the PHI is ever not feasible, we tell you why. We keep protecting it under this agreement and use it only for the reason deletion isn't feasible, for as long as we hold it.
8. Reporting problems
8.1 What we report, and when. We tell you of any use or disclosure of the Export that this agreement doesn't allow, any security incident affecting it, and any breach of unsecured PHI. We give you a first notice within 24 hours after we discover it, with what we know so far, and a written report within 5 business days, updated as we learn more (or sooner if the law requires).
8.2 Breaches. For a breach, we give you, as soon as we have it, the information you need for notices under 45 CFR 164.410: who was affected, what happened and when, what PHI was involved, what we are doing about it, and what patients can do to protect themselves. We help you with your notices and take reasonable steps to limit any harm.
8.3 Unsuccessful attempts. This clause is notice that some unsuccessful attempts aren't reported one by one, because they don't lead to any access to the Export. Examples: pings, scans and blocked sign-in attempts.
9. Patients' rights and HHS
9.1 Patients' requests. The Export is a copy: the original records stay in your software. While we still hold the Export, if a patient's request involves it, we help you within 10 business days. That covers a request to see their information (45 CFR 164.524), to correct it (164.526), or for an account of who it was shared with (164.528). We record any disclosure of the Export that you would need to include in that account.
9.2 Your Privacy Rule duties. If we carry out any of your own Privacy Rule duties for you, we comply with the Privacy Rule requirements that apply to you.
9.3 HHS. We make our internal practices, books and records about the Export available to the Secretary of the US Department of Health and Human Services, so that compliance with HIPAA can be checked.
10. Ending this agreement
10.1 Term. This agreement starts when you sign it. It ends when we have deleted the Export after sending the Report, or earlier if either of us ends it.
10.2 Ending early. Either of us may end it at any time by email. If we break this agreement, you may end it at once. When it ends, we stop the Check and delete the Export within 5 business days.
10.3 What continues. Clauses 2, 7, 8 and 9 continue for as long as we hold any PHI from the Export.
11. If you become a client
This agreement is separate from any service agreement. If you sign our Billing Services Agreement, its business associate agreement replaces this one from the day it is signed. Until then, this agreement applies.
12. General
12.1 Law. Wyoming law governs this agreement, except where HIPAA or other federal law applies. Any dispute goes to the courts of Sheridan County, Wyoming.
12.2 Reading this agreement. This agreement is read so that it complies with HIPAA. If HIPAA changes, we update this agreement to match. A reference to a regulation means that regulation as amended.
12.3 Who has rights. No one else has any rights under this agreement.
12.4 Signing electronically. Typing your name and ticking "I agree on behalf of the practice" signs this agreement for the Practice, and you confirm you are authorized to sign for it. We keep a record of the time, this version and your details. Electronic signatures count as originals. Sadler Billing's signature below applies to every practice that signs this version.
12.5 Whole agreement. This is the whole agreement between us about the Export.
Signatures
For [Practice legal name]
Typed name: Title: Email:
☐ I agree on behalf of the practice. Date and time: [recorded automatically]
For Sloth Does LLC, doing business as Sadler Billing
Alexander Sadler, Managing Member Signature: /s/ Alexander Sadler Date: October 22, 2026