Legal

Business associate agreement

We sign a BAA with every practice, on every plan, before any patient data goes in. Here is what that actually means.

Last updated August 10, 2026

What a BAA is

Under HIPAA, your practice is a covered entity. Any vendor that handles protected health information on your behalf is a business associate. The business associate agreement is the contract that puts specific, enforceable obligations on that vendor — rather than leaving your patients' records covered by a general terms-of-service document written for a photo-sharing app.

Practice management software is a business associate by definition. If a vendor will not sign a BAA, that is a complete answer about whether to use them.

What ours commits us to

  • Use it only for you. We process patient data to provide the service to your practice, and for nothing else. We do not mine it, sell it, or use it to train anything.
  • Safeguard it. Administrative, physical and technical safeguards — the specific controls are described on the security page rather than hidden behind the word "industry-standard".
  • Bind anyone downstream. Any subprocessor that could touch patient data is held to the same obligations. They are listed on thesubprocessors page.
  • Tell you if something goes wrong. We notify you of a breach of unsecured protected health information without unreasonable delay, with what we know and what we are doing.
  • Help you meet your own obligations. Including a patient's right to access their records and to have them amended.
  • Give it back or destroy it. On termination, your data is returned in a portable format or destroyed, at your choice.

When it gets signed

Before your practice enters any patient data — as part of setup, not as an upgrade or an add-on. It costs nothing and is not restricted to a particular plan.

A note on wording

You will see software described as "HIPAA compliant". Strictly, compliance is something apractice achieves, and no authority issues a certificate to a software vendor. What a vendor can honestly offer is a signed BAA and a specific description of its controls. That is what we offer, and it is why this page describes obligations instead of claiming a badge.

Getting a copy

Email [email protected] and we will send the agreement for review. You are welcome to have counsel read it before signing, and welcome to come back with redlines.

Questions about any of this: [email protected].