Legal, Governance & Compliance
When a 501(c)(3) partners with a commercial licensor and government laboratories, the structure has to satisfy tax, procurement, and healthcare privacy standards.
| Regulatory domain | Requirement | Operational implementation |
|---|---|---|
| IRS 501(c)(3) and UBIT | Charitable mission fit | Program-related activity; lessening the burdens of government |
| Private inurement / benefit | Arms-length relationship | Free license / pass-through cost |
| Government procurement | FAR / 2 CFR 200 bidding rules | Zero-cost software acquisition |
| HIPAA / HITECH | BAA and privacy safeguards | Agency-dedicated Snowflake host; 45 CFR 164.512(b) |
| FedRAMP / StateRAMP | Government-grade hosting | Snowflake Government Cloud / FedRAMP Moderate infrastructure |
1. IRS 501(c)(3) and UBIT
Advancing public health and assisting government agencies in disease surveillance fulfills a tax-exempt charitable purpose: lessening the burdens of government under Treas. Reg. § 1.501(c)(3)-1(d)(2).
The software license is given at $0.00, so there is no commercial sale. Snowflake hosting is a pass-through reimbursement without markup. Maintenance fees charged to agencies represent direct cost-recovery for program-related services (IRC § 513(a)).
2. Private inurement and the license deed
JIL Sovereign Holdings, LLC, which owns Salus Agentic outright, executes a perpetual, royalty-free, non-exclusive license deed granting Global Hands, Inc. the right to operate it for non-profit and government deployments. Maintenance paid to technical contractors must be documented at or below fair market value.
3. Government procurement
Because the core software license is $0.00, government agencies do not need to conduct a formal software-acquisition RFP for the license itself. Pass-through cloud hosting and maintenance can proceed as simplified acquisition, a cooperative agreement, or a sole-source non-profit grant, subject to each agency's counsel.
4. HIPAA, HITECH, and public health exceptions
Covered entities are authorized under 45 CFR § 164.512(b) to disclose PHI to public health authorities for disease prevention and control without individual patient authorization. Where Salus Agentic processes identifiers on behalf of a covered entity, Global Hands executes an HHS-style Business Associate Agreement.
5. Cloud hosting and data sovereignty
Deployments use dedicated Snowflake instances and, when the agency requires it, Snowflake Government Cloud / FedRAMP Moderate authorized infrastructure. Global Hands does not claim a standalone FedRAMP authorization. Role-based access, encryption, and SOC 2 Type II alignment are inherited from that hosting foundation under a signed BAA.