SNOWFLAKE SUB-PROCESSOR BUSINESS ASSOCIATE AGREEMENT

Last Updated: May 16, 2025

This Snowflake Sub-Processor Business Associate Agreement (“BAA”) is entered into in connection with the Professional Services Subcontracting Agreement between the parties under which Vendor provides Services (“Principal Agreement(s)”) by and between the member of the Snowflake Group that is a party to the Agreement with Vendor for Vendor’s Services (“Snowflake”) and the party identified as Vendor (“Vendor”), which provides services to Snowflake and/or Snowflake’s customers (“Snowflake Customers”) (collectively, “Vendor Services”). Snowflake and Vendor agree that notwithstanding anything to the contrary in the Principal Agreement, including an integration clause, this BAA is hereby incorporated into and made an essential part of the Principal Agreement as of the later of (i) the date of the second party’s signature below and (ii) the effective date of the Principal Agreement (“BAA Effective Date”). Capitalized terms used and not defined in this BAA have the meanings given to them in the HIPAA Regulations or the Principal Agreement(s), as applicable.

This BAA sets forth Vendor’s obligations as a Business Associate or Subcontractor under applicable provisions of: (i) the Health Insurance Portability and Accountability Act of 1996, Pub. L. 104-191, as amended; (ii) the privacy standards (at 45 C.F.R. Part 160 and Part 164, Subparts A and E (the “Privacy Rule”)) and security standards (at 45 C.F.R. Part 160 and Part 164, Subparts A and C (the “Security Rule”)) and; (iii) Subtitle D of the Health Information Technology for Economic and Clinical Health Act, Pub. L 111-5, including as implemented by 45 C.F.R. Part 164, Subpart D, all as they may be amended from time to time (collectively, the “HIPAA Regulations”).

This BAA applies in connection with the Protected Health Information (as defined in 45 C.F.R. § 160.103) that Vendor receives from Snowflake and/or Snowflake Customers, or that Vendor creates, receives, maintains or transmits on behalf of Snowflake and/or Snowflake Customers (“PHI”).

1.     Use and Disclosure of PHI.

1.1.   Permitted Uses. Except as otherwise limited in this BAA, Vendor may Use or Disclose PHI to provide the Vendor Services to Snowflake and/or Snowflake Customers as specified in the Principal Agreements and applicable SOW, provided such Use or Disclosure does not violate the Privacy Rule if done by Snowflake and/or Snowflake Customers. Vendor shall comply with HIPAA Regulations and all applicable privacy and security laws and regulations in connection with its Use and/or Disclosures of PHI.

2.     Vendor Obligations and Responsibilities.

2.1.      Nondisclosure. Vendor shall not Use or Disclose PHI other than as permitted or required by this BAA or as Required by Law and shall comply with the Privacy Rule to the extent Vendor carries out an obligation of Snowflake and/or a Snowflake Customer that is regulated by the Privacy Rule.

2.2.      Minimum Necessary. When Using or Disclosing PHI, Vendor shall limit PHI to the minimum necessary, taking into account the nature of the services provided by Vendor.

2.3.      Safeguards. Vendor shall implement and maintain administrative, physical and technical safeguards designed to reasonably and appropriately protect the confidentiality and availability of PHI and shall comply with applicable compliance and enforcement obligations under the Security Rule.

2.4.      Notice of Security Incident or Breach. Upon discovery of any unauthorized Use or Disclosure of PHI not provided for by this BAA, or any Security Incident or Breach of Unsecured PHI, Vendor shall notify Snowflake without undue delay and in any event, within twenty-four (24) hours. To the extent possible, Vendor’s notification shall include at the time of the notice or thereafter as the information becomes available, all information required and/or recommended to be reported under the HIPAA Regulations, including, but not limited to, a brief description of what happened, the types of unsecured PHI involved, any remedial actions taken, and any other information reasonably requested that relates to a risk assessment by Snowflake or a Snowflake Customer. Vendor shall assist Snowflake in any relevant investigations, including by promptly providing all reasonably requested information and documentation related to such unauthorized Use or Disclosure, Breach, or Security Incident. Any logs, reports, or other documentation relevant to the Security Incident shall be preserved for at least one year and made available to Snowflake upon its reasonable request.

2.5.      Mitigation and Remediation. Vendor shall mitigate and remediate, to the extent practicable, any harmful effect that is known to Vendor caused by a Use or Disclosure of PHI in violation of the requirements of this BAA.

2.6.      Agents and Subcontractors. Vendor shall not use agents or Subcontractors to process PHI without the prior express written approval of Snowflake in an SOW. Vendor shall ensure that any of those approved agents and Subcontractors which receive access to or are provided PHI agree in writing to comply with the same requirements herein. Upon Snowflake’s written request, Vendor shall permit Snowflake to review its business associate agreement(s) with such agents and Subcontractors.

2.7.      Access and Amendment. Upon receiving an Individual’s request to access or amend PHI from an Individual who identifies Snowflake or a Snowflake Customer, Vendor shall immediately notify Snowflake in order to help facilitate compliance with requirements under 45 C.F.R. § 164.524 and 45 C.F.R. § 164.526 with respect to such request and shall not respond to such request without Snowflake’s prior express written instruction.

2.8.      Documentation of Disclosures. Vendor shall document Vendor’s Disclosures of PHI and information related to such Disclosures as would be required for Snowflake and a Snowflake Customer to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 C.F.R. § 164.528. 

2.9.      Accounting of Disclosures. Vendor shall make available to Snowflake or a Snowflake Customer within five (5) days of a written request, such information as is required for Snowflake and a Snowflake Customer to make an accounting required by 45 C.F.R. § 164.528. 

2.10.   No Remuneration in Exchange for PHI. Vendor shall not receive direct or indirect remuneration for an exchange of PHI not otherwise authorized under the HIPAA Regulations.

2.11.   No Marketing/Fundraising. Vendor shall not perform marketing or fundraising on behalf of Snowflake or Snowflake Customers regarding PHI or engage in the types of communications on behalf of Snowflake or Snowflake Customers that are excepted from the definition of marketing established under 45 C.F.R. § 164.501 regarding PHI.

2.12.   Qualified Service Organization Responsibilities. If, as part of Vendor Services, Vendor uses, discloses, maintains, or transmits PHI that is protected by 42 U.S.C. § 290dd-2 and C.F.R. Part 2 (collectively, “Part 2”) relating to substance use disorder patient identifying information, Vendor: (i) acknowledges and agrees that it is a Qualified Service Organization for the purpose of Part 2; (ii) acknowledges and agrees that in receiving, storing, processing, or otherwise dealing with any such patient records, it is fully bound by Part 2; and, (iii) Vendor will resist in judicial proceedings any efforts to obtain access to patient identifying information related to substance use disorder diagnosis, treatment, or referral for treatment, except as permitted by Part 2.

2.13.   Internal Practices. Upon reasonable written request by Snowflake, Vendor shall make its internal practices, books and records directly relating to the Use and Disclosure of PHI available to the Secretary of the U.S. Department of Health and Human Services, for the purpose of the Secretary determining the compliance by Snowflake and/or a Snowflake Customer with applicable provisions of the HIPAA Regulations.

3.     Term and Termination.

3.1.      Term. The term of this BAA shall be effective as of the BAA Effective Date and the rights and obligations set forth in this BAA shall survive termination or expiration of this BAA and the Principal Agreements.

3.2.      Termination for Cause. Upon Snowflake’s knowledge of a material breach of this BAA by Vendor, Snowflake may either:

3.2.1.   provide an opportunity for Vendor to cure the breach or end the violation within a period of time not to exceed thirty (30) days and if Vendor does not cure the breach or end the violation within such time period, terminate this BAA and the Principal Agreements; or

3.2.2.   immediately terminate this BAA and the Principal Agreements.

3.3.      Effect of Termination. Upon termination of this BAA for any reason, Vendor shall make available for retrieval by Snowflake and/or any relevant Snowflake Customer, and after such retrieval, Vendor shall destroy all PHI in Vendor’s possession or control and shall retain no copies of such PHI. If such return or destruction is not feasible, Vendor shall notify Snowflake and shall extend the protections of this BAA to the PHI and limit further Uses and Disclosures of such PHI to those purposes that make the retrieval or destruction infeasible, for so long as Vendor maintains such PHI.

4.     Miscellaneous.

4.1.      Regulatory References. A reference in this BAA to a section in the HIPAA Regulations means the section as in effect or as amended.

4.2.      Amendment. The parties agree to take such action as is reasonably necessary to amend or interpret this BAA as necessary for Vendor and Snowflake and/or Snowflake Customers to comply with the applicable requirements of the HIPAA Regulations.  

4.3.      Survival. The obligations of Vendor under this BAA shall survive the termination of this BAA.

4.4.      No Third Party Beneficiaries. Nothing express or implied in this BAA is intended to confer, nor shall anything herein confer, upon any person other than Snowflake or Vendor any rights whatsoever.

4.5.      Interpretation. Any ambiguity in this BAA shall be resolved to permit Vendor, Snowflake and Snowflake Customers to comply with the HIPAA Regulations.

4.6.      Conflicts. To the extent there is any conflict between the provisions of this BAA and the Principal Agreements, the provisions of this BAA shall prevail.

4.7.      No Agency. Vendor shall not be deemed to be the common law agent of Snowflake.

4.8.      Counterparts. The parties may execute this BAA in counterparts, including PDF or other electronic copies, which taken together will constitute one instrument.

4.9.      Entire Agreement. This BAA, the Principal Agreements, and any agreements expressly referenced therein, constitute the entire agreement between the parties with respect to the subject matter hereof and supersede all previous written or oral understandings, agreements, negotiations, commitments and any other writing or communication by or between the parties with respect to the subject matter hereof. Except as amended and supplemented by this BAA, the Principal Agreement remains unchanged and in full force and effect.