MMG Fusion Settles HIPAA Violations for $10,000

RESOLUTION AGREEMENT I. Recitals 1. Parties. The Parties to this Resolution Agreement (“Agreement”) are: A. The United States Department of Health and Human Services, Office for Civil Rights (“HHS”), which enforces the Federal standards that govern the privacy of individually identifiable health information (45 C.F.R. Part 160 and Subparts A and E of Part 164, the “Privacy Rule”), the Federal standards that govern the security of electronic individually identifiable health information (45 C.F.R. Part 160 and Subparts A and C of Part 164, the “Security Rule”), and the Federal standards for notification in the case of breach of unsecured protected health information (45 C.F.R. Part 160 and Subparts A and D of 45 C.F.R. Part 164, the “Breach Notification Rule”). HHS has the authority to conduct compliance reviews and investigations of complaints alleging violations of the Privacy, Security, and Breach Notification Rules (the “HIPAA Rules”) by covered entities and business associates, and covered entities and business associates must cooperate with HHS compliance reviews and investigations. See 45 C.F.R. §§ 160.306(c), 160.308, and 160.310(b). B. MMG Fusion, LLC (“MMG”), which is a software company that focuses on helping oral healthcare professionals to market, manage and grow their practices. MMG receives the protected health information (“PHI “) of covered entities including names, phone numbers and email addresses, and uses its software to communicate directly with patients of covered entities. As such, MMG is a business associate, as defined at 45 C.F.R. § 160.103, and therefore is required to comply with the HIPAA Rules. C. HHS and MMG shall together be referred to herein as the “Parties.” II. Factual Background and Covered Conduct. 1. OCR initiated an investigation of MMG pursuant to a Complaint filed on January 6, 2023. OCR’s investigation revealed that on December 21, 2020, an unauthorized actor infiltrated MMG’s information system and accessed protected health information (PHI) including names, phone numbers, mailing addresses, email addresses, dates of birth and dates and times of medical appointments. As a result of the intrusion, PHI was made public on the Dark Web. The evidence gathered by OCR during the investigation indicates MMG’s noncompliance with the HIPAA Rules. HHS’ investigation indicated potential violations of the following provisions (“Covered Conduct”): A. The requirement not to use or disclose protected health information except as permitted or required by the Privacy Rule. (See 45 C.F.R. § 164.502(a). B. The requirement to conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of the electronic protected health information held by MMG. (See 45 C.F.R. § 164.308(a)(1)(ii)(A)).

1. The requirement that a business associate shall, following the discovery of a breach of unsecured protected health information, notify affected covered entities of such breach. (See 45 C.F.R. § 164.410). 2. No Admission. This Agreement is not an admission of liability by MMG. 3. No Concession. This Agreement is not a concession by HHS that MMG is not in violation of the HIPAA Rules and not liable for civil money penalties (“CMPs”). 4. Intention of Parties to Effect Resolution. This Agreement is intended to resolve OCR Transaction Number: 23-511805 and any potential violations of the HIPAA Rules related to the Covered Conduct specified in paragraph II.1 of this Agreement. In consideration of the Parties’ interest in avoiding the uncertainty, burden, and expense of further investigation and formal proceedings, the Parties agree to resolve this matter according to the Terms and Conditions below. III. Terms and Conditions 1. Payment. HHS has agreed to accept, and MMG has agreed to pay HHS, the amount of $10,000 (“Resolution Amount”). MMG agrees to pay the Resolution Amount on the Effective Date of this Agreement as defined in paragraph III.9 by automated clearing house transaction pursuant to written instructions to be provided by HHS. 2. Corrective Action Plan. MMG has entered into and agrees to comply with the Corrective Action Plan (“CAP”), attached as Appendix A, which is incorporated into this Agreement by reference. If MMG breaches the CAP and fails to cure the breach as set forth in the CAP, then MMG will be in breach of this Agreement and HHS will not be subject to the Release set forth in paragraph III.3 of this Agreement. 3. Release by HHS. In consideration of and conditioned upon MMG’s performance of its obligations under this Agreement, HHS releases MMG from any actions it may have against MMG under the HIPAA Rules arising out of or related to the Covered Conduct identified in paragraph II.1. of this Agreement. HHS does not release MMG from, nor waive any rights, obligations, or causes of action other than those arising out of or related to the Covered Conduct and referred to in this paragraph. This release does not extend to actions that may be brought under section 1177 of the Social Security Act, 42 U.S.C. § 1320d-6. 4. Agreement by Released Parties. MMG shall not contest the validity of its obligation to pay, nor the amount of, the Resolution Amount or any other obligations agreed to under this Agreement. MMG waives all procedural rights granted under Section 1128A of the Social Security Act (42 U.S.C. § 1320a- 7a) and 45 C.F.R. Part 160 Subpart E, and HHS claims collection regulations at 45 C.F.R. Part 30, including, but not limited to, notice, hearing, and appeal with respect to the Resolution Amount. 5. Binding on Successors. This Agreement is binding on MMG and its successors, heirs, transferees, and assigns. 6. Costs. Each Party to this Agreement shall bear its own legal and other costs incurred in connection with this matter, including the preparation and performance of this Agreement.
2. No Additional Releases. This Agreement is intended to be for the benefit of the Parties only, and by this instrument the Parties do not release any claims against or by any other person or entity. 8. Effect of Agreement. This Agreement constitutes the complete agreement between the Parties. All material representations, understandings, and promises of the Parties are contained in this Agreement. Any modifications to this Agreement shall be set forth in writing and signed by all Parties. 9. Execution of Agreement and Effective Date. The Agreement shall become effective (i.e., final and binding) upon the date of signing of this Agreement and the CAP by the last signatory (“Effective Date”). 10. Tolling of Statute of Limitations. Pursuant to 42 U.S.C. § 1320a-7aI(1), a CMP must be imposed within six (6) years from the date of the occurrence of the violation. To ensure that this six-year period does not expire during the term of this Agreement, MMG agrees that the time between the Effective Date of this Agreement (as set forth in paragraph III.9) and the date the Agreement may be terminated by reason of MMG’s breach, plus one-year thereafter, will not be included in calculating the six (6) year statute of limitations applicable to the violations which are the subject of this Agreement. MMG waives and will not plead any statute of limitations, laches, or similar defenses to any administrative action relating to the Covered Conduct identified in paragraph II.1 that is filed by HHS within the time period set forth above, except to the extent that such defenses would have been available had an administrative action been filed on the Effective Date of this Agreement. 11. Disclosure. HHS places no restriction on the publication of the Agreement. In addition, HHS may be required to disclose material related to this Agreement to any person upon request consistent with the applicable provisions of the Freedom of Information Act, 5 U.S.C. § 552, and its implementing regulations, 45 C.F.R. Part 5. 12. Execution in Counterparts. This Agreement may be executed in counterparts, each of which constitutes an original, and all of which shall constitute one and the same agreement. 13. Authorizations. The individual(s) signing this Agreement on behalf of MMG represent and warrant that they are authorized by MMG to execute this Agreement. The individual(s) signing this Agreement on behalf of HHS represent and warrant that they are signing this Agreement in their official capacities and that they are authorized to execute this Agreement. For MMG Fusion, LLC /s/ redacted ____________________________ Christopher E. Rom SVP, HIQOR Dental (Successor in interest to MMG Fusions, LLC) June 30, 2025 ____________ Date For the United States Department of Health and Human Services /s/ redacted June 30, 2025 ____________________________ _____________ Jamie Rahn Ballay Regional Manager Date

CORRECTIVE ACTION PLAN BETWEEN THE U.S. DEPARTMENT OF HEALTH AND HUMAN SERVICES AND MMG Fusion, LLC I. Preamble MMG Fusion, LLC (“MMG”) hereby enters into this Corrective Action Plan (“CAP”) with the United States Department of Health and Human Services, Office for Civil Rights (“HHS”). Contemporaneously with this CAP, MMG is entering into a Resolution Agreement (“Agreement”) with HHS, and this CAP is incorporated by reference into the Resolution Agreement as Appendix A. MMG enters into this CAP as part of consideration for the release set forth in paragraph III.3 of the Agreement. II. Contact Persons and Submissions A. Contact Persons MMG has identified the following individual as its authorized representative and contact person regarding the implementation of this CAP and for receipt and submission of notifications and reports: NAME: Chris Rom TITLE SVP, HIQOR Dental (Successor in Interest to MMG Fusion, LLC) HHS has identified the following individual as its authorized representative and contact person with whom MMG is to report information regarding the implementation of this CAP: Jamie Rahn Ballay, Regional Manager Mid-Atlantic Region U.S. Department of Health and Human Services MMG and HHS agree to promptly notify each other of any changes in the contact persons or the other information provided above. B. Proof of Submissions. Unless otherwise specified, all notifications and reports required by this CAP may be made by any means, including certified mail, overnight mail, or hand delivery, provided that there is proof that such notification was received. For purposes of this requirement, internal facsimile confirmation sheets do not constitute proof of receipt. III. Effective Date and Term of CAP The Effective Date for this CAP shall be calculated in accordance with paragraph III.9 of the Agreement (“Effective Date”). The period for compliance (“Compliance Term”) with the obligations assumed by MMG under this CAP shall begin on the Effective Date of this CAP and end three (3) years from the Effective Date, unless HHS has notified MMG under Section VIII hereof of its determination that MMG breached this CAP. In the event HHS notifies MMG of a breach under section VIII hereof, the Compliance Term shall not end until HHS notifies MMG that HHS has determined MMG failed to meet the requirements of section V of this CAP and issues a written notice of intent to proceed with an

imposition of a civil money penalty against MMG pursuant to 45 C.F.R. Part 160. After the Compliance Term ends, MMG shall still be obligated to: (a) submit the final Annual Report as required by section VI; and (b) comply with the document retention requirement in section VII. Nothing in this CAP is intended to eliminate or modify MMG’s obligation to comply with the document retention requirements in 45 C.F.R. § 164.316(b) and § 164.530(j). IV. Time In computing any period of time prescribed or allowed by this CAP, all days referred to shall be calendar days. The day of the act, event, or default from which the designated period of time begins to run shall not be included. The last day of the period so computed shall be included, unless it is a Saturday, a Sunday, or a legal holiday, in which event the period runs until the end of the next day which is not one of the aforementioned days. V. Corrective Action Obligations MMG agrees to the following: A. Security Management Process 1. MMG shall conduct a comprehensive, accurate, and thorough analysis of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information (ePHI) held by MMG (“Risk Analysis”). This Risk Analysis shall incorporate all MMG facilities, whether owned or rented, and evaluate the risks to the ePHI on all of its electronic equipment, data systems, and applications controlled, administered or owned by MMG or any MMG entity, that create, store, transmit, or receive ePHI. Prior to conducting the Risk Analysis, MMG shall develop a complete inventory of all of its facilities, electronic equipment, data systems, and applications that create, store, transmit, or receive ePHI that will then be incorporated into its Risk Analysis. 2. MMG shall provide the Risk Analysis, consistent with section V.A.1, to HHS within ninety (90) days of the Effective Date for HHS’ review. Within sixty (60) days of its receipt of MMG’s Risk Analysis, HHS will inform MMG whether HHS approves or disapproves of the Risk Analysis. If HHS disapproves of the Risk Analysis, HHS shall provide MMG with technical assistance, as necessary, regarding the basis for the disapproval so that MMG may prepare a revised Risk Analysis. MMG shall have sixty (60) days in which to revise its Risk Analysis accordingly, and then submit the revised Risk Analysis to HHS for review and approval. This submission and review process shall continue until HHS approves the Risk Analysis. 3. MMG shall develop an enterprise-wide Risk Management Plan to address and mitigate any security risks and vulnerabilities found in the Risk Analysis described above in paragraph V.A.1. The Risk Management Plan shall include a process and timeline for MMG’s implementation, evaluation, and revision of its risk remediation activities. 4. Within ninety (90) days of HHS’ final approval of the Risk Analysis described in section V.A.2 above, MMG shall submit MMG’s Risk Management Plan for HHS’ review. Within sixty (60) days of its receipt of MMG’s Risk Management Plan, HHS will inform MMG whether HHS approves the Risk Management Plan or HHS requires revisions. If HHS requires revisions to the Risk Management Plan, HHS shall provide MMG with a written explanation of the basis of its revisions, including comments and recommendation that MMG can use to prepare a revised Risk Management Plan. Upon receiving HHS’s

notice of required revisions, if any, MMG shall have sixty (60) days in which to revise its Risk Management Plan accordingly and submit the revised Risk Management Plan to HHS for review and approval. This submission and review process shall continue until HHS approves the Risk Management Plan. 5. Within thirty (30) days of HHS’s approval of the Risk Management Plan, MMG shall finalize and officially adopt the Risk Management Plan in accordance with its applicable administrative procedures and distribute the plan to workforce members involved with implementation of the plan. B. Policies and Procedures 1. MMG shall review, and as necessary, develop, or revise written policies and procedures to address the Minimum Content set forth in Section V.D. to comply with the HIPAA Rules. 2. MMG shall provide the policies and procedures identified in section V.B.1 above to HHS for review and approval within sixty (60) days of HHS’ approval of the Risk Management Plan, as required by V.A.4. Upon receiving any recommended changes to such policies and procedures from HHS, MMG shall have forty-five (45) days to revise such policies and procedures accordingly and provide the revised policies and procedures to HHS for review and approval. This process shall continue until HHS approves such policies and procedures. 3. MMG shall adopt (in accordance with its applicable administrative procedures) the policies and procedures approved by HHS pursuant to section V.B.2 within thirty (30) days of receipt of HHS’ approval. C. Distribution and Updating of Policies and Procedures 1. MMG shall distribute the policies and procedures identified in Section V.B to all members of the workforce and all business associates that have access to PHI within thirty (30) days of the adoption of such policies pursuant to Section V.B.3 and to new members of the workforce and new business associates that have such access within thirty (30) days of their beginning of service. 2. MMG shall require, at the time of distribution of the policies and procedures, a signed written or electronic initial compliance certification from all members of the workforce stating that the workforce members have read, understand, and shall abide by such policies and procedures. 3. MMG shall assess, update, and revise, as necessary, the policies and procedures at least annually. MMG shall provide the revised policies and procedures to HHS for review and approval to HHS within 30 days of revision. Within thirty (30) days of the effective date of any approved substantive revisions, MMG shall distribute such revised policies and procedures to all members of its workforce and business associates with access to PHI and shall require new compliance certifications. 4. MMG shall not provide any member of its workforce or any business associate with access to PHI if that workforce member or business associate has not signed or provided the written or electronic certification required by sections 2 and 3 of this section. D. Minimum Content of the Policies and Procedures

1. The Policies and Procedures subject to this CAP shall include policies and procedures that address the following Privacy and Security Rule provisions: a. Risk Analysis---45 C.F.R. § 164.308(a)(1)(ii)(A), including provisions to conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI held by MMG and to conduct the accurate and thorough assessment on an annual basis. b. Risk Management---45 C.F.R. § 164.308(a)(1)(ii)(B), including provisions to implement security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level to comply with § 164.306(a). c. Information System Activity Review---45 C.F.R. § 164.308(a)(1)(ii)(D), including procedures to regularly review records of information system activity, such as audit logs, access reports, and security incident tracking reports. d. Assigned Security Responsibility---45 C.F.R. § 164.308(a)(2), including identifying security official responsible for development and implementation of Security Rule policies and procedures. e. Security Awareness and Training---45 C.F.R. § 164.308(a)(5), including implementation of a security awareness and training program for all workforce members. f. Password Management---45 C.F.R. § 164.308(a)(5)(ii)(D), including procedures for creating, changing, and safeguarding passwords. g. Data Backup Plan---45 C.F.R. § 164.308(a)(7), including establishing and implementing procedures to create and maintain retrievable exact copies of electronic protected health information. h. Access Control—45 C.F.R. § 164.312(a)(1), including provisions to address access between systems, such as network or portal segmentation, provisions to limit access to ePHI to individuals and software programs granted access rights, and provisions to enforce password management requirements, such as password age, and encryption and decryption. i. Audit Controls---45 C.F.R. § 164.312(b), including procedures for the implementation of hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use electronic protected health information. j. Breach Risk Assessment---45 C.F.R. § 164.402, including how to conduct a breach risk assessment. k. Breach Notification Rule---45 C.F.R. § 164.410, including notification by a business associate.
2. Breach Assessment and Breach Notification 1. Within thirty (30) days of the Effective Date, MMG shall provide HHS with its breach risk assessment of the December 21, 2020, cyber-attack pursuant to 45 C.F.R. § 164.402. Such assessment shall include a complete and accurate list of all covered entity clients of MMG that were affected by the breach incident. 2. HHS shall review and provide feedback to MMG on the breach risk assessment’s accuracy and thoroughness within thirty (30) days of receipt. MMG shall incorporate HHS’s feedback, if any, into the breach risk assessment and re-submit to HHS for approval or additional feedback within ten (10) days of receipt. This process shall continue until HHS approves the breach risk assessment. 3. Within thirty (30) days of HHS’s approval of the breach risk assessment, MMG shall provide HHS with evidence that it has, to the extent possible, provided to affected covered entities an accurate notice of the breach. 4. Within thirty (30) days of HHS’s approval of the breach risk assessment, MMG shall provide HHS with evidence that it has, to the extent possible, provided to affected covered entities the identification of each individual whose PHI has been, or is reasonably believed by MMG to have been, accessed, acquired, used, or disclosed as a result of the December 20, 2021, cyber-attack. F. Training 1. MMG shall provide HHS with training materials for all members of the workforce that have access to PHI within thirty (30) days of HHS approval of MMG policies and procedures pursuant to section V.B.2. 2. Upon receiving notice from HHS specifying any required changes, MMG shall make the required changes and provide revised training materials to HHS within thirty (30) days. 3. Within sixty (60) days after receiving HHS’ final approval and at least every 12 months thereafter, MMG shall provide training for each workforce member who has access to PHI. MMG shall also provide such training to each new member of the workforce who has access to PHI within 30 days of their beginning of service. 4. Each workforce member who is required to attend training shall certify, in electronic or written form, that he or she has received the training. The training certification shall specify the date training was received. All course materials shall be retained in compliance with Section VII and the Privacy Rule. 5. MMG shall review the training at least annually, and, where appropriate, update the training to reflect changes in Federal law or HHS guidance, any issues discovered during audits or reviews, and any other relevant developments. G. Reportable Events 1. During the Compliance Term, MMG shall, upon learning that a workforce member or business associate likely failed to comply with its policies and procedures described in Section V.B, promptly investigate this matter. If MMG, after review and investigation, determines that a member of its workforce or a business associate that has agreed to comply with policies and procedures under section V.C.2 has failed to comply with its policies and procedures, MMG shall report such events to HHS as provided in section VI.B.3. Such violations shall be known as Reportable Events. The report to HHS shall include the following: a. A complete description of the event, including the relevant facts, the persons involved, and the applicable provision(s) of MMG’s Privacy, Security, and Breach Notification policies and procedures; and b. A description of the actions taken and any further steps MMG plans to take to address the matter to mitigate any harm, and to prevent it from recurring, including application of any appropriate sanctions against workforce members who failed to comply with its Privacy, Security, and Breach Notification policies and procedures. 2. If no Reportable Events occur during the Compliance term, MMG shall so inform HHS in the Annual Report as specified in Section VI below. VI. Implementation Report and Annual Reports A. Implementation Report. Within one hundred twenty (120) days after HHS approves MMG’s HIPAA training materials for workforce members specified in Section V.F above, MMG shall submit a written report with the documentation described below to HHS for review and approval (“Implementation Report”). The Implementation Report shall include: 1. An attestation signed by an officer of MMG attesting that the policies and procedures are being implemented, have been distributed to all appropriate members of the workforce and business associates, and that MMG has obtained all of the compliance certifications required by Sections V.C.2 and V.C.3; 2. A copy of all training materials used for the training required by this CAP, a description of the training, including a summary of the topics covered, the length of the session(s) and a schedule of when the training session(s) were held; 3. An attestation signed by an officer of MMG attesting that all members of the workforce and business associates have completed the initial training required by this CAP and have executed the training certifications required by Section V.F.4; 4. An attestation signed by an officer of MMG listing all MMG locations (including locations and mailing addresses), the corresponding name under which each location is doing business, the corresponding phone numbers, and fax numbers, and attesting that each such location has complied with the obligations of this CAP; and 5. An attestation signed by an officer of MMG stating that he or she has reviewed the Implementation Report, has made a reasonable inquiry regarding its content, and believes that, upon such inquiry, the information is accurate and truthful. B. Annual Reports. The one-year period beginning on the Effective Date and each subsequent one-year period during the course of the period of compliance obligations shall be referred to as “the Reporting Periods.” MMG also shall submit to HHS Annual Reports with respect to the status of and

findings regarding MMG’s compliance with this CAP for each of the two (2) Reporting Periods. MMG shall submit each Annual Report to HHS no later than sixty (60) days after the end of each corresponding Reporting Period. The Annual Report shall include: 1. A schedule, topic outline, and copies of the training materials for the training programs attended in accordance with this CAP during the Reporting Period that is the subject of the report; 2. An attestation signed by an officer of MMG attesting that it is obtaining and maintaining written training certifications from all persons that require training that they received training pursuant to the requirements set forth in this CAP; 3. A summary of Reportable Events (defined in Section V.G.1) identified during the Reporting Period and the status of any corrective and preventative action relating to all such Reportable Events; 4. An attestation signed by an officer of MMG attesting that he or she has reviewed the Annual Report, has made a reasonable inquiry regarding its content, and believes that, upon such inquiry, the information is accurate and truthful. VII. Document Retention MMG shall maintain for inspection and copying, and shall provide to HHS upon request, all documents and records relating to compliance with this CAP for six (6) years from the Effective Date. VIII. Breach Provisions MMG is expected to fully and timely comply with all provisions contained in this CAP. A. Timely Written Requests for Extensions. MMG may, in advance of any due date set forth in this CAP, submit a timely written request for an extension of time to perform any act required by this CAP. A “timely written request” is defined as a request in writing received by HHS at least five days prior to the date such an act is required or due to be performed. This requirement may be waived by OCR only. B. Notice of Breach of this CAP and Intent to Impose Civil Monetary Penalty. The parties agree that a breach of this CAP by MMG constitutes a breach of the Agreement. Upon a determination by HHS that MMG has breached this CAP, HHS may notify MMG of: (1) MMG’s breach; and (2) HHS’ intent to impose a CMP pursuant to 45 C.F.R. Part 160, or other remedies for the Covered Conduct set forth in paragraph II.1 of the Agreement and any other conduct that constitutes a violation of the HIPAA Privacy, Security, or Breach Notification Rules (“Notice of Breach and Intent to Impose CMP”). C. MMG’s Response. MMG shall have thirty (30) days from the date of receipt of the Notice of Breach and Intent to Impose CMP to demonstrate to HHS’ satisfaction that: 1. MMG is in compliance with the obligations of the CAP that HHS cited as the basis for the breach; 2. The alleged breach has been cured; or

1. The alleged breach cannot be cured within the thirty-day period, but that: (a) MMG has begun to take action to cure the breach; (b) MMG is pursuing such action with due diligence; and (c) MMG has provided to HHS a reasonable timetable for curing the breach. D. Imposition of CMP. If at the conclusion of the thirty-day period, MMG fails to meet the requirements of Section VIII.C of this CAP to HHS’ satisfaction, HHS may proceed with the imposition of a CMP against MMG pursuant to 45 C.F.R. Part 160 for any violations of the Covered Conduct set forth in paragraph II.1 of the Agreement and for any other act or failure to act that constitutes a violation of the HIPAA Rules. HHS shall notify MMG in writing of its determination to proceed with the imposition of a CMP pursuant to 45 C.F.R. Part 160. For MMG Fusion, LLC /s/ redacted June 30, 2025 ____________________________ ____________ Christopher E. Rom SVP, HIQOR Dental (Successor in Interest to MMG Fusion, LLC) Date For United States Department of Health and Human Services /s/ redacted June 30, 2025 ____________________________ _____________ Jamie Rahn Ballay Regional Manager Date