Business Associate Agreement
No Business Associate Agreement is offered with this demo build, so it must not be used with real client information. This page outlines what a BAA with Tidemend would cover once one is available.
What a BAA is
Under HIPAA, a covered entity, such as a clinician or practice that bills health plans electronically, may share protected health information (PHI) with a vendor that handles it on their behalf only if a Business Associate Agreement is in place. The BAA sets out how the vendor may use PHI and how it must protect it.
When you need one
Before any PHI is entered into Tidemend, including recordings, transcripts, notes or client details. Your practice’s own obligations may apply even if you are not a covered entity; check with your advisor.
What it would cover
- Permitted uses and disclosures of PHI, limited to providing the Service.
- Administrative, physical and technical safeguards for PHI.
- Reporting of security incidents and breaches within [timeframe].
- Flow-down obligations to subcontractors, such as hosting, transcription, AI, email, text-message and clearinghouse providers, listed at [subprocessor list location].
- Support for clients’ rights to access and amend their records, through the clinician.
- Making records available to the U.S. Department of Health and Human Services when required.
- Return or destruction of PHI when the agreement ends.
What Tidemend provides toward this
An audit log of access to clinical records, deletion of recordings after the note by default, encryption in transit in production deployments, per-account access controls, separate client portal logins, peer-to-peer encrypted video, reminders without clinical content and full data export. Read the security overview for the shared-responsibility model.
Requesting a BAA
[Describe how practices request and sign a BAA once production hosting is available: contact, process and timeline.]