Business Associate Agreement (draft)

Status of this draft

Published early so a compliance team can review the shape of the commitment. It is a draft, it has not been reviewed by counsel, and it is not an offer.

HIPAA does not award a certificate to a software vendor. What can exist is this agreement and the controls behind it, so treat a vendor claim of HIPAA approval — ours included — as something to check rather than accept.

1. When this applies

If you are a covered entity or a business associate and you intend to send protected health information through the platform, this agreement must be executed before you send it. Enable the HIPAA profile on your tenant so the associated controls and the two-person deletion process are active.

2. Permitted uses and disclosures

We use and disclose protected health information only to provide the service to you, for our own management and administration as the HIPAA rules permit, and where required by law. We do not sell it and we do not use it for marketing.

3. Safeguards

We maintain administrative, physical, and technical safeguards as the Security Rule requires. The technical controls implemented in the product are:

• Access limited by role, with a named permission checked before each action
• Multi-factor authentication for staff accounts
• Tenant scoping on every tenant-owned record
• Encryption in transit, and encryption at rest for stored files
• Append-only audit records of access and signing events
• Retention periods per tenant, including a separate period for declined documents
• A two-person approval process for deletion of protected health information

4. Reporting

We report a use or disclosure not permitted by this agreement, and any security incident or breach of unsecured protected health information, without unreasonable delay.

As with the data processing addendum, the documented incident response procedure is still being written. The reporting obligation stands on its own; we are not going to describe a runbook that does not exist yet.

5. Subcontractors

Each sub-processor that may receive protected health information is bound to restrictions and conditions at least as strict as those that apply to us. The functions involved are published on the sub-processors page, and identities are provided on request under a non-disclosure agreement.

6. Individual rights

We make protected health information available to you so you can respond to requests for access, amendment, and an accounting of disclosures. Export tools in the product cover most of this without our involvement.

7. Term and termination

The agreement runs for as long as we hold protected health information for you. On termination we return or destroy it where that is feasible; where it is not, these protections continue for as long as we retain it.

8. What this does not cover

An executed agreement does not make your workflow meet HIPAA on its own. Your policies, your training, your access decisions, and your retention choices remain yours. It also does not cover data you move outside the platform.

9. Requesting execution

Email partnerships@endorsedsign.com with your entity name and the workflow involved. We will send the current draft for your counsel to mark up, and the executed version is versioned rather than edited in place.