We sign a BAA with every customer. Even on the $10 plan.
The contract HIPAA requires before a vendor touches patient information, explained in plain English, with what ours covers and how it reaches you.
What a BAA is
A Business Associate Agreement is the contract HIPAA requires between a covered entity (your practice) and any vendor that creates, receives, stores or transmits protected health information (PHI) on its behalf. A team chat tool where staff mention patients is such a vendor. Without a signed BAA, using the tool for PHI is a HIPAA violation on its own, no breach needed.
What ours covers
- Permitted uses and disclosures of PHI: only to provide the service to you.
- Safeguards: encryption in transit and at rest, access controls, audit logging, retention and legal hold, workforce confidentiality.
- Subcontractors: our infrastructure providers sign BAAs with us; the current list is available on request.
- Breach notification: how and when we tell you if something goes wrong.
- Your rights: access, amendment and accounting of disclosures support; return or deletion of PHI at termination.
- No sale of data, no advertising use, no training of AI models on your messages.
How you get it
- Buy any plan on the pricing page.
- Within one business day we email your owner invite and the BAA for e-signature.
- Sign it before staff post any patient information. Keep the countersigned copy in your compliance file.
Enterprise customers can negotiate terms. Everyone else gets the same standard BAA, including the $10 plan. Want to read it before buying? Email [email protected] and we send the current version.
Team chat your clinic is allowed to use.
$10 a month for 5 people, one location and 20 GB. Signed BAA on every plan. Month to month, cancel anytime.