HIPAA & the Business Associate Agreement

Health plans, healthcare clearinghouses, and providers who bill electronically — including IME/QME physicians and evaluation practices that also treat patients or bill health plans. If this is you, HIPAA requires a BAA with us before we touch your PHI. Ours is built into signup.

Organizations serving covered entities with access to PHI — TPAs administering health plans, legal nurse consulting firms, record-retrieval companies, defense counsel engaged by health systems. When you use Medrecords AI on that PHI, we become your subcontractor business associate (45 CFR 164.502(e)); our BAA is written to sit correctly underneath your upstream BAA.

Personal-injury and defense firms receiving records by patient authorization or subpoena, property-casualty carriers and self-insurers, and workers'-compensation insurers and agencies (disclosures to whom HIPAA expressly permits at 45 CFR 164.512(l)) are generally not HIPAA covered entities or business associates. HIPAA still shaped how those records reached you, state medical-privacy laws still apply to them, and your clients and courts expect HIPAA-grade care. So we don't tier it: the identical safeguards, audit logging, breach-notice clocks, and never-train commitments bind us for your data through the BAA-equivalent protections incorporated in the DPA and the BAA you accept at signup.

Because it's the cleanest way to bind us to HIPAA-grade obligations for your clients' records regardless of regulatory status — and because your malpractice carrier, referral partners, and opposing counsel increasingly ask whether your vendors are under one. It costs you nothing and closes questions before they're asked.

Largely, yes — HIPAA expressly permits providers to disclose PHI to workers'-compensation insurers, agencies, and employers to the extent state law provides (45 CFR 164.512(l)), and comp carriers are not covered entities. But state comp statutes impose their own confidentiality duties on that data, which is why our safeguards don't switch off for comp files.

Part 2 records carry consent and redisclosure rules stricter than HIPAA. Flag them when uploading (or instruct us in writing); the platform's access controls and your instructions under DPA Section 4.1 govern their handling, and required redisclosure notices belong on any output you export from them. You remain responsible for the consents that got the records to you.

Yes. The BAA is accepted before the upload control activates, the file gets production-grade safeguards, it's deleted 30 days after your sample is delivered, and it is never used to train anything. Evaluation terms: Terms, Section 6.

No one is — HHS certifies no product. The honest claim is the one we make: HIPAA-eligible architecture, documented Security Rule safeguards, an executed BAA, PHI audit logging, and SOC 2 audit-ready controls documentation, verifiable through the Trust Center security package.

Email [email protected] for a countersigned BAA or DPA, or request the full security package — controls documentation, subprocessor detail, and SOC 2 evidence summary — under NDA from the Trust Center.