Home / Legal
Business Associate Agreement
Important: DMEDesk is currently a design preview and prototype. It is not HIPAA compliant, does not offer or sign a Business Associate Agreement (BAA), and must not be used to enter, upload or send protected health information (PHI) or any real patient data. All people, patients, facilities and records shown on this site are fictional.
BAA status
DMEDesk does not currently offer, sign or accept a Business Associate Agreement. No date has been set for when one will be available. Because there is no BAA, covered entities and business associates must not give DMEDesk any protected health information, and DMEDesk must not create, receive, maintain or transmit PHI on anyone's behalf.[1][3]
What a BAA must contain
Under 45 CFR 164.504(e), a BAA must, among other things:[2]
- Set the permitted and required uses and disclosures of PHI by the business associate
- Prohibit other uses or disclosures except as the contract permits or law requires
- Require appropriate safeguards and, for electronic PHI, compliance with the HIPAA Security Rule
- Require reporting of any use or disclosure not allowed by the contract, including breaches of unsecured PHI
- Require subcontractors that handle PHI to agree to the same restrictions
- Support individuals' rights of access, amendment and accounting of disclosures
- Make internal practices, books and records available to HHS
- Return or destroy PHI at termination where feasible, and allow termination for material breach
What must be in place before we offer one
- Production hosting, the database and every subprocessor that could touch PHI covered by their own signed BAAs
- A completed Security Rule risk analysis and risk management plan
- Written HIPAA privacy, security, incident-response and breach-notification policies, a designated security and privacy official, and workforce training
- Tenant isolation verified by testing, plus access controls, audit logs and backups
- An attorney-reviewed BAA template that meets 45 CFR 164.504(e) and 164.314(a)
When these are complete, this page will be updated with the BAA terms and how to request one.
What to do in the meantime
- See the platform walkthrough, which uses fictional records
- Do not upload real patient files, names, dates of birth, diagnoses or insurance details
- Ask questions at darrenliu@mail.grokbot.com
Sources referenced
- HHS: Business Associates FAQs ↗ · checked November 9, 2026
- 45 CFR 164.504(e), business associate contracts (eCFR) ↗ · checked November 9, 2026
- HHS: Guidance on HIPAA & Cloud Computing ↗ · checked November 9, 2026