Business Associate Agreement (BAA)

⚠️ DRAFT TEMPLATE — pending legal review. Not legal advice. HIPAA BAAs carry specific regulatory requirements; complete all [[PLACEHOLDERS]] and obtain counsel approval before offering this to any covered entity.

This BAA supplements the Customer Agreement and applies only where Customer is a Covered Entity or Business Associate under HIPAA (45 CFR Parts 160 & 164) and uses the Service to create, receive, maintain, or transmit Protected Health Information ("PHI"). Customer is the Covered Entity (or upstream Business Associate); phi-cloud is the Business Associate. Terms used have the meaning in the HIPAA Rules.

1. Scope and a critical limitation

1.1 phi-cloud may Process PHI only through requests that (a) are flagged X-PHI: true and (b) resolve to a Provider that is itself under a HIPAA BAA for the selected U.S. jurisdiction. Today the only such path is Microsoft Azure / Azure OpenAI (U.S.) for the in-scope modalities (see the Sub-processor list).

1.2 Requests that do not resolve to a BAA-covered Provider are declined (phi_blocked / no_route); phi-cloud will not route PHI to a Provider lacking a BAA. Customer must set X-PHI and the region correctly. PHI submitted without the correct flags is outside this BAA's protections and is Customer's responsibility.

1.3 Consistent with the Service's stateless design, phi-cloud does not store PHI; it transmits PHI transiently to the BAA-covered Provider and returns the response.

2. Permitted uses and disclosures

phi-cloud will not use or disclose PHI other than as permitted by this BAA, as Required by Law, or for the proper management of and to provide the Service. phi-cloud will not use PHI to train or improve models, and will not sell PHI or use it for marketing.

3. Safeguards

phi-cloud will use appropriate administrative, physical, and technical safeguards, and comply with the Security Rule with respect to electronic PHI, to prevent use or disclosure of PHI other than as provided by this BAA.

4. Subcontractors

phi-cloud will ensure that any subcontractor that creates, receives, maintains, or transmits PHI on its behalf agrees in writing to restrictions and conditions at least as protective as those in this BAA (flow-down). The relevant subcontractor is the BAA-covered Provider to which PHI is routed (e.g., Microsoft), under that Provider's own HIPAA BAA.

5. Reporting

phi-cloud will report to Customer, without unreasonable delay and within [[number]] days of discovery: (a) any use or disclosure of PHI not permitted by this BAA of which it becomes aware; (b) any Security Incident affecting electronic PHI within its control; and (c) any Breach of Unsecured PHI, with the information Customer needs for its breach-notification obligations under 45 CFR 164.400–414. Unsuccessful/trivial security events are reported on an aggregate basis on request.

6. Access, amendment, accounting

Because phi-cloud maintains no Designated Record Set of PHI (stateless), it holds no PHI from which to satisfy individual access (164.524), amendment (164.526), or accounting (164.528) requests; phi-cloud will, as applicable, forward to Customer any such request it receives and provide reasonable cooperation. Customer satisfies these rights from its own systems and those of the BAA-covered Provider.

7. Government access

phi-cloud will make its internal practices, books, and records relating to the use and disclosure of PHI available to the Secretary of HHS as required to determine Customer's HIPAA compliance.

8. Term and termination

8.1 This BAA is effective when Customer accepts the Customer Agreement and uses the Service for PHI, and terminates when all PHI processing ceases.

8.2 On termination, because phi-cloud retains no PHI, there is no PHI to return or destroy; obligations of confidentiality and the limits on use/disclosure survive with respect to any PHI that may otherwise remain, which phi-cloud will continue to protect and limit use of for as long as retained.

8.3 Customer may terminate if phi-cloud materially breaches this BAA and fails to cure.

9. Miscellaneous

The parties will amend this BAA as needed to comply with changes to HIPAA/HITECH. In case of conflict regarding PHI, this BAA controls over the Customer Agreement and DPA. No third-party beneficiaries are created except as required by the HIPAA Rules. This BAA does not make phi-cloud responsible for Customer's own HIPAA compliance or its data classification.

---

HIPAA contact / breach notices: [[security@phi-cloud.com]]