BAA offer

Our Business Associate Agreement offer

If a vendor will create, receive, maintain or transmit PHI for you, HIPAA treats that vendor as a business associate, and you need a signed agreement first. We would rather you ask for it on the first call than discover on the last one that it is missing.

Signed before access

No engineer on our side opens a production system, a data export or a real record until the BAA is in place.

Yours or ours

Send your standard BAA and we will review it, or ask for ours as a starting point. Either way your counsel has the final word.

Named people only

Access is limited to the named engineers on your project, under written confidentiality terms, and removed the day they leave the work.

Synthetic data by default

Development and staging use synthetic data. Real PHI is kept in production and only touched through approved, logged access.

Coverage

What a BAA with us covers

Permitted uses and disclosures

We use PHI only to build, run and support your system, and for nothing else. No analytics, no model training, no marketing.

Safeguards

The administrative, physical and technical safeguards we apply, referenced to the Security Rule and to the architecture we agree with you.

Breach and incident reporting

How fast we tell you about a suspected incident, what we include in the first report, and how we preserve evidence. The timeline is set in the agreement.

Subcontractors

Any subcontractor or cloud provider that touches PHI is bound by the same obligations, and you can see the list.

Access, amendment and accounting

Help for you to meet patient requests for access, amendment and an accounting of disclosures, using the audit data the system already records.

Return or destruction

When the work ends, PHI is returned or destroyed, including backups, and we give you a deletion record.

Vendor checklist

Ten questions to ask any software vendor before you share PHI

  • Will you sign a BAA before anyone sees real data, and can you show the last one you signed?
  • Which cloud provider hosts the data, and is it covered by their BAA?
  • Who exactly will have access, and how is it removed when they leave?
  • Is the production data ever copied into development or testing?
  • How are secrets, keys and backups protected, and how often is a restore tested?
  • What do your audit logs capture, where do they live and who can change them?
  • Which third party SDKs, analytics or AI services will receive any data, and under what terms?
  • What is your incident process and how fast will you tell us?
  • What happens to our data and backups if we end the contract?
  • Can we have an independent penetration test report before go live?
Getting started

How the BAA fits into starting a project

1

First call

You tell us what you want to build. We tell you we will need a BAA before any PHI is shared.

2

NDA and BAA

We exchange the NDA, then the BAA. Your counsel reviews. We answer technical questions on safeguards while that happens.

3

Access plan

We agree who gets access, to what, and how. This becomes an appendix to the agreement.

4

Work begins

Discovery starts with synthetic or de-identified examples. Real PHI only appears when and where the plan allows.

This page describes how we work. It is not legal advice and it is not a BAA. Your attorney should review any agreement before you sign it.

Questions we hear

Business Associate Agreement questions

Do we need a BAA if you only build the software and never see data?

If you will never give us access to PHI and we never host or operate the system, a BAA may not be required for the build itself. In real projects there is almost always some access: staging copies, support sessions, hosting. Most clients sign a BAA to cover that, and it costs nothing to have it ready.

Can you sign our BAA?

Yes. Send it with the first scoping call or afterward. We review it with our own counsel and come back with questions, usually about subcontractor terms, the incident timeline and deletion of backups.

What about our cloud provider and other tools?

Each vendor that touches PHI needs its own BAA with you or with us as a subcontractor. We help you list them, and we avoid tools that will not sign one.

How quickly can we get a BAA in place?

It depends mostly on your legal review. On our side we can usually respond within two business days of receiving a request or your draft.

Ask for the BAA on the first call

We will send ours or review yours, and agree who has access before any real data moves.

Request our BAA