Home / Legal

Business Associate Agreement

Effective date: November 9, 2026 · Last updated: November 9, 2026

BAA status

DMEDesk does not currently offer, sign or accept a Business Associate Agreement. No date has been set for when one will be available. Because there is no BAA, covered entities and business associates must not give DMEDesk any protected health information, and DMEDesk must not create, receive, maintain or transmit PHI on anyone's behalf.^[1][3]

What a BAA must contain

Under 45 CFR 164.504(e), a BAA must, among other things:^[2]

• Set the permitted and required uses and disclosures of PHI by the business associate
• Prohibit other uses or disclosures except as the contract permits or law requires
• Require appropriate safeguards and, for electronic PHI, compliance with the HIPAA Security Rule
• Require reporting of any use or disclosure not allowed by the contract, including breaches of unsecured PHI
• Require subcontractors that handle PHI to agree to the same restrictions
• Support individuals' rights of access, amendment and accounting of disclosures
• Make internal practices, books and records available to HHS
• Return or destroy PHI at termination where feasible, and allow termination for material breach

What must be in place before we offer one

• Production hosting, the database and every subprocessor that could touch PHI covered by their own signed BAAs
• A completed Security Rule risk analysis and risk management plan
• Written HIPAA privacy, security, incident-response and breach-notification policies, a designated security and privacy official, and workforce training
• Tenant isolation verified by testing, plus access controls, audit logs and backups
• An attorney-reviewed BAA template that meets 45 CFR 164.504(e) and 164.314(a)

When these are complete, this page will be updated with the BAA terms and how to request one.

What to do in the meantime

• Explore the fictional Acme and PlatinumMED example workspaces
• Do not upload real patient files, names, dates of birth, diagnoses or insurance details
• Ask questions at [Contact email]