Business Associate Agreements (BAA)

Informational sample forms: direct Business Associate Agreement version 2026.1 · downstream Business Associate Agreement version 2026.1-downstream

Sample form 1: Business Associate Agreement (customers that are covered entities)

Version 2026.1 · informational copy; not an executed agreement

1. Parties & Effective Date

This Business Associate Agreement ("BAA") is entered into as of the date of electronic signature ("Effective Date") by and between:

Business Associate: Accurecord AI, LLC ("Business Associate" or "BA")
Covered Entity: You / Your Organization ("Covered Entity" or "CE")

This BAA is incorporated into the service agreement for the eligible services expressly identified in the acceptance record and any mutually agreed service schedule (the "Service"). It applies only to the identified customer legal entity, capacity and services; a product or account label alone does not expand its scope. For PHI, this BAA controls over that service agreement and any order form. It supersedes an earlier BAA between these parties only for the same identified services and scope, preserving duties for PHI already retained. Adding a service or changing capacity requires the corresponding documented agreement before new PHI processing begins.

2. Definitions

Capitalized terms not otherwise defined herein shall have the meanings set forth in the HIPAA Privacy Rule (45 C.F.R. Parts 160 and 164), the HIPAA Security Rule, and the Health Information Technology for Economic and Clinical Health Act ("HITECH Act"), as amended.

3. HIPAA-Compliant AI Infrastructure

Business Associate operates AI-powered coding assistance features on HIPAA-eligible cloud infrastructure. The following safeguards apply:

AI retention and saved cases: Inference prompts and completions submitted through the AI features of the Service to the Microsoft-hosted Azure OpenAI and direct OpenAI inference endpoints are processed using configurations under which the provider does not use them to train models and does not retain them after completing the request, as verified for each provider before use. Business Associate stores case content, including a clarification draft or AI-assisted proposal, only when an authorized user affirmatively saves or accepts that content as part of a coding case. Stored customer files or retrieval indexes, if offered, are separately identified and governed by their stated retention and deletion terms.
Case storage: PHI that Covered Entity's users save in a coding case is created and maintained by Business Associate on Covered Entity's behalf, for the purpose of the coding services, under Sections 5 and 10.
Uploaded Documents: Project guideline uploads are a separate reference feature limited to non-PHI coding reference material. Covered Entity must not include patient details, clinical charts, notes or other PHI in those uploads. Permitted reference files and their retrieval indexes are stored in the separately disclosed customer and provider stores and follow their stated export and deletion terms. This restriction does not reduce any safeguard, incident-response, return or destruction duty that applies if PHI is nevertheless received; it does not authorize transmission of PHI to a service outside its applicable BAA coverage.
Zero Training: No PHI is used to train, fine-tune, or improve any AI model, whether operated by Business Associate or any sub-processor.
Encrypted Channels: All AI inference requests are transmitted over encrypted channels (TLS 1.2 or higher) and processed within HIPAA-eligible cloud infrastructure.
Sub-processor BAAs: Business Associate has executed Business Associate Agreements with all AI sub-processors that may receive PHI in the course of providing the Service.

4. Permitted Uses & Disclosures

Business Associate may use and disclose PHI solely to:

Provide the Service as described in the Corporate Client Agreement, or the other applicable service agreement identified by the parties, and its documentation, including AI-assisted medical coding guidance, ICD-10-CM code search, and project guideline analysis.
Perform data aggregation services relating to Covered Entity's healthcare operations, if applicable.
Carry out Business Associate's legal responsibilities as required by law.

Business Associate shall not use or disclose PHI in a manner that would violate HIPAA if done by Covered Entity.

Business Associate will not use or further disclose PHI other than as permitted or required by this BAA or as required by law. No Service documentation, product feature, or other service agreement expands the permitted uses and disclosures stated in this BAA.

5. Safeguards

Business Associate agrees to implement and maintain appropriate administrative, physical, and technical safeguards to protect the confidentiality, integrity, and availability of PHI it creates, receives, maintains, or transmits on behalf of Covered Entity, in accordance with the HIPAA Security Rule. Safeguards include, but are not limited to:

Authentication controls, including supported federated sign-in and email/password authentication, role-based access controls, authenticated sessions using access and refresh tokens, and mandatory multi-factor authentication enrollment and a verified multi-factor session for user access to saved coding cases, including reads, exports and case actions.
Tenant-isolated data storage.
Encryption of PHI at rest and in transit.
Audit logging of administrative actions (user, organization, administrative membership, single sign-on and project changes); of the execution and revocation of this Agreement, and of acceptances of versioned legal agreements, made through the in-product signing and consent flows; of uploads and downloads of project guideline documents; and of AI feature usage metadata (provider, model, token counts and timing, never message content).
Field-level encryption of PHI saved in coding cases, in addition to encryption at rest and in transit.
Row-level isolation of case data by organization in the database, in addition to application access checks.
An append-only access ledger recording every read of case PHI.
Support access to case PHI only through a documented break-glass procedure, recorded with a reason.
Regular security assessments and vulnerability monitoring.

6. Subcontractors

Business Associate may disclose PHI to approved subcontractors solely to assist in providing the Service, provided that Business Associate has entered into a written agreement with each such subcontractor requiring equivalent HIPAA-compliant safeguards and BAA obligations. Business Associate is responsible for any HIPAA violation caused by a subcontractor to the same extent as if Business Associate had committed the violation directly. Business Associate will maintain a versioned list identifying every subcontractor that creates, receives, maintains, or transmits PHI on its behalf, including hosting, storage, inference, retrieval, and support providers, and identifying each provider's role. Before access to PHI, each applicable subcontractor must have a written agreement imposing the same restrictions, conditions, and applicable Security Rule obligations that apply to Business Associate. Inference zero retention does not describe hosting, customer-file storage, or retrieval-index storage; those flows are governed by their disclosed retention and deletion terms. The list provided to Covered Entity must reflect verified deployment configuration before PHI processing begins.

Business Associate will maintain a current list of subcontractors that create, receive, maintain, or transmit PHI and will provide at least thirty (30) days' advance notice before authorizing a new listed subcontractor to receive PHI. Covered Entity may object during that period on reasonable data-protection grounds. The parties will work in good faith to resolve the objection; if they cannot, Business Associate will not use that subcontractor for Covered Entity's PHI or Covered Entity may terminate the affected Service without penalty.

7. Minimum Necessary

Business Associate shall use or disclose only the minimum PHI necessary to accomplish the intended purpose of each use or disclosure.

8. Individual Rights

At Covered Entity's written direction, Business Associate will make relevant PHI available to Covered Entity, incorporate or link an amendment directed by Covered Entity, and provide information needed for an accounting of disclosures, in each case as necessary for Covered Entity to comply with 45 CFR 164.524, 164.526, and 164.528. Business Associate will respond to Covered Entity within ten (10) business days, or within a shorter reasonable period specified by Covered Entity to meet an applicable legal deadline. Business Associate will promptly route a request received directly from an individual to Covered Entity and will not make a determination or disclose PHI to the individual except as expressly directed by Covered Entity or required by law.

To the extent Business Associate carries out an obligation of Covered Entity under Subpart E of 45 CFR Part 164, Business Associate will comply with the requirements of that subpart that apply to Covered Entity in performing that obligation.

9. Security Incidents & Breach Notification

Business Associate shall:

Report to Covered Entity any use or disclosure of PHI not provided for by this BAA of which Business Associate becomes aware, without unreasonable delay and no later than seventy-two (72) hours after becoming aware. If the event is a Breach of Unsecured PHI, the discovery standard and notice requirements below also apply.
Report to Covered Entity any Security Incident of which Business Associate becomes aware without unreasonable delay.
Business Associate will notify Covered Entity of a Breach of Unsecured PHI without unreasonable delay and no later than seventy-two (72) hours after discovery. Discovery occurs on the first day the Breach is known to Business Associate or, through reasonable diligence, would have been known to an employee, officer, or other agent, consistent with 45 CFR 164.410. Business Associate may provide an initial notice with the information then available and will supplement it promptly as additional information becomes available.
Cooperate with Covered Entity in any required breach notification to individuals, HHS, or the media.

10. Return or Destruction of PHI

Covered Entity may export its saved coding cases during the applicable organization service and for thirty (30) calendar days after termination or expiration of that service. At the end of that export period, Business Associate will delete the affected PHI from live systems and instruct each applicable subcontractor to delete its copies. Subject only to the documented exceptions in the following paragraph, PHI remaining solely in disaster-recovery backups will remain protected, inaccessible for ordinary use, and expire no later than ninety (90) calendar days after live-system deletion. If a backup is restored during that period, Business Associate will reapply the deletion before resuming ordinary processing. Business Associate will retain non-content deletion evidence under its compliance-document retention schedule and provide a destruction certificate on request.

If applicable law requires retention of particular PHI, a legally applicable preservation duty prevents its deletion, or its return or destruction is infeasible within the meaning of this BAA, Business Associate will document the affected records or categories, the specific legal or factual basis, the limited purpose of retention, the responsible custodian and the date or condition for review and release. Business Associate will notify Covered Entity of the exception and its scope unless legally prohibited. It will retain only the affected PHI for only as long as the documented basis continues, maintain this BAA's safeguards, and limit further use or disclosure to the purpose requiring retention or making return or destruction infeasible and to applicable legal obligations. The basis will be reviewed periodically and when relevant circumstances change. When it ends, Business Associate will promptly complete the lawful return or destruction process and record completion; a new indefinite retention period will not begin. Unaffected data follows the ordinary schedule. Routine backup retention alone does not extend the stated ninety (90) calendar day backup deadline.

11. HHS Audit Rights

Business Associate shall make its internal practices, books, and records relating to the use and disclosure of PHI available to the Secretary of the U.S. Department of Health and Human Services for purposes of determining compliance with HIPAA.

12. No Clinical Warranty

THE SERVICE IS A MEDICAL CODING REFERENCE TOOL. AI-GENERATED GUIDANCE IS INFORMATIONAL ONLY AND DOES NOT CONSTITUTE CLINICAL ADVICE, DIAGNOSIS, OR TREATMENT RECOMMENDATIONS. COVERED ENTITY AND ITS AUTHORIZED USERS REMAIN SOLELY RESPONSIBLE FOR ALL CLINICAL AND CODING DECISIONS.

13. Term & Termination

This BAA is effective as of the Effective Date and shall remain in effect for the duration of the Service agreement. This BAA shall survive termination or expiration of the Service for as long as Business Associate retains any PHI on behalf of Covered Entity.

Covered Entity may terminate this BAA if it determines that Business Associate has violated a material term. If Covered Entity reasonably determines that the violation can be cured without continuing an impermissible use or disclosure or a material risk to PHI, it may allow up to thirty (30) days after written notice to cure. If cure is not feasible or the permitted cure period expires without cure, Covered Entity may terminate immediately by written notice. Termination does not end the protections for PHI that remains in Business Associate's possession or control. Business Associate may terminate for Covered Entity's material breach after thirty (30) days' written notice and failure to cure, subject to continuing PHI protections and applicable law.

By signing below, you acknowledge that you have read, understood, and agree to be bound by the terms of this Business Associate Agreement.

BAA Version: 2026.1

Sample form 2: Downstream Business Associate Agreement (customers acting as a business associate or subcontractor business associate)

Version 2026.1-downstream · informational copy; not an executed agreement

1. Parties & Effective Date

This Downstream Business Associate Agreement ("BAA") is effective on the date of acceptance recorded in the acceptance record ("Effective Date").

This BAA is between the customer legal entity identified in the acceptance record ("Client"), acting as a business associate or subcontractor business associate for one or more covered entities, and Accurecord AI LLC ("Accurecord AI"), acting as Client's subcontractor business associate for the eligible services identified in that record. "Upstream Covered Entity" means the covered entity on whose behalf the relevant PHI is processed. Client represents that it is authorized to engage Accurecord AI for the stated processing.

2. Definitions

In this BAA, "Business Associate" and "BA" mean Accurecord AI LLC, acting as Client's subcontractor business associate. References to "Covered Entity" or "CE" as the recipient of instructions, notices, cooperation, return or delivery mean Client. References to a covered entity's HIPAA status, legal duties or individual-rights decisions mean the applicable Upstream Covered Entity. This mapping does not change HIPAA's regulatory definitions.

3. HIPAA-Compliant AI Infrastructure

Business Associate operates AI-powered coding assistance features on HIPAA-eligible cloud infrastructure. The following safeguards apply:

AI retention and saved cases: Inference prompts and completions submitted through the AI features of the Service to the Microsoft-hosted Azure OpenAI and direct OpenAI inference endpoints are processed using configurations under which the provider does not use them to train models and does not retain them after completing the request, as verified for each provider before use. Business Associate stores case content, including a clarification draft or AI-assisted proposal, only when an authorized user affirmatively saves or accepts that content as part of a coding case. Stored customer files or retrieval indexes, if offered, are separately identified and governed by their stated retention and deletion terms.
Case storage: PHI that Covered Entity's users save in a coding case is created and maintained by Business Associate on Covered Entity's behalf, for the purpose of the coding services, under Sections 5 and 10.
Uploaded Documents: Project guideline uploads are a separate reference feature limited to non-PHI coding reference material. Client must not include patient details, clinical charts, notes or other PHI in those uploads. Permitted reference files and their retrieval indexes are stored in the separately disclosed customer and provider stores and follow their stated export and deletion terms. This restriction does not reduce any safeguard, incident-response, return or destruction duty that applies if PHI is nevertheless received; it does not authorize transmission of PHI to a service outside its applicable BAA coverage.
Zero Training: No PHI is used to train, fine-tune, or improve any AI model, whether operated by Business Associate or any sub-processor.
Encrypted Channels: All AI inference requests are transmitted over encrypted channels (TLS 1.2 or higher) and processed within HIPAA-eligible cloud infrastructure.
Sub-processor BAAs: Business Associate has executed Business Associate Agreements with all AI sub-processors that may receive PHI in the course of providing the Service.

4. Permitted Uses & Disclosures

Business Associate may use and disclose PHI solely to:

Provide the Service as described in the Corporate Client Agreement, or the other applicable service agreement identified by the parties, and its documentation, including AI-assisted medical coding guidance, ICD-10-CM code search, and project guideline analysis.
Perform data aggregation services relating to Covered Entity's healthcare operations, if applicable.
Carry out Business Associate's legal responsibilities as required by law.

Accurecord AI may use or disclose PHI only as permitted by this BAA and lawful documented instructions from Client, and may not use or disclose it in a manner that would violate HIPAA if done by Client or the applicable Upstream Covered Entity. Client will identify before submission any additional upstream restriction, shorter deadline or retention duty that affects the services. Any additional obligation to be performed by Accurecord AI must be specifically identified and agreed in writing; an undisclosed upstream agreement is not incorporated wholesale. Unsupported or conflicting requirements must be resolved before the affected PHI is submitted. Nothing in this paragraph limits a mandatory legal duty.

An additional upstream obligation is accepted by Accurecord AI only through a written agreement made by its CEO or a representative with specific written authority to accept that obligation. The agreement must identify Client, the affected services and PHI, the precise obligation and deadline trigger, its effective date, and the controlling BAA and addendum versions. A request, support acknowledgment or entry of an upstream requirement does not itself accept the additional obligation. Accurecord AI will confirm acceptance to Client before the affected PHI processing is enabled.

5. Safeguards

Authentication controls, including supported federated sign-in and email/password authentication, role-based access controls, authenticated sessions using access and refresh tokens, and mandatory multi-factor authentication enrollment and a verified multi-factor session for user access to saved coding cases, including reads, exports and case actions.
Tenant-isolated data storage.
Encryption of PHI at rest and in transit.
Audit logging of administrative actions (user, organization, administrative membership, single sign-on and project changes); of the execution and revocation of this Agreement, and of acceptances of versioned legal agreements, made through the in-product signing and consent flows; of uploads and downloads of project guideline documents; and of AI feature usage metadata (provider, model, token counts and timing, never message content).
Field-level encryption of PHI saved in coding cases, in addition to encryption at rest and in transit.
Row-level isolation of case data by organization in the database, in addition to application access checks.
An append-only access ledger recording every read of case PHI.
Support access to case PHI only through a documented break-glass procedure, recorded with a reason.
Regular security assessments and vulnerability monitoring.

6. Subcontractors

7. Minimum Necessary

Business Associate shall use or disclose only the minimum PHI necessary to accomplish the intended purpose of each use or disclosure.

8. Individual Rights

Accurecord AI will make relevant PHI and accounting information available to Client, and incorporate or link directed amendments, as necessary for Client to assist the applicable Upstream Covered Entity with HIPAA access, amendment and accounting duties. It will respond within ten (10) business days or a shorter reasonable period requested to meet a legal deadline. Direct individual requests will be promptly routed to Client, with disclosure or a merits decision made only as lawfully directed or required by law. Client is responsible for transmitting necessary information to the Upstream Covered Entity.

9. Security Incidents & Breach Notification

Business Associate shall:

Report to Covered Entity any use or disclosure of PHI not provided for by this BAA of which Business Associate becomes aware, without unreasonable delay and no later than seventy-two (72) hours after becoming aware. If the event is a Breach of Unsecured PHI, the discovery standard and notice requirements below also apply.
Report to Covered Entity any Security Incident of which Business Associate becomes aware without unreasonable delay.
Business Associate will notify Covered Entity of a Breach of Unsecured PHI without unreasonable delay and no later than seventy-two (72) hours after discovery. Discovery occurs on the first day the Breach is known to Business Associate or, through reasonable diligence, would have been known to an employee, officer, or other agent, consistent with 45 CFR 164.410. Business Associate may provide an initial notice with the information then available and will supplement it promptly as additional information becomes available.
Cooperate with Covered Entity in any required breach notification to individuals, HHS, or the media.

Accurecord AI will give required incident and breach notices to Client under Section 9, using the same actual-or-constructive-discovery standard and seventy-two-hour outer breach period. Any shorter agreed upstream flow-down will be recorded before processing begins; Client's own notification clock is not restarted by receiving Accurecord AI's notice.

10. Return or Destruction of PHI

Client may export its saved coding cases during the applicable organization service and for thirty (30) calendar days after termination or expiration of that service. At the end of that export period, Accurecord AI will delete the affected PHI from live systems and instruct each applicable subcontractor to delete its copies. Subject only to the documented exceptions in the following paragraph, PHI remaining solely in disaster-recovery backups will remain protected, inaccessible for ordinary use, and expire no later than ninety (90) calendar days after live-system deletion. If a backup is restored during that period, Accurecord AI will reapply the deletion before resuming ordinary processing. Accurecord AI will retain non-content deletion evidence under its compliance-document retention schedule and provide a destruction certificate on request.

If applicable law requires retention of particular PHI, a legally applicable preservation duty prevents its deletion, or its return or destruction is infeasible within the meaning of this BAA, Accurecord AI will document the affected records or categories, the specific legal or factual basis, the limited purpose of retention, the responsible custodian and the date or condition for review and release. Accurecord AI will notify Client of the exception and its scope unless legally prohibited. It will retain only the affected PHI for only as long as the documented basis continues, maintain this BAA's safeguards, and limit further use or disclosure to the purpose requiring retention or making return or destruction infeasible and to applicable legal obligations. The basis will be reviewed periodically and when relevant circumstances change. When it ends, Accurecord AI will promptly complete the lawful return or destruction process and record completion; a new indefinite retention period will not begin. Unaffected data follows the ordinary schedule. Routine backup retention alone does not extend the stated ninety (90) calendar day backup deadline.

11. HHS Audit Rights

12. No Clinical Warranty

THE SERVICE IS A MEDICAL CODING REFERENCE TOOL. AI-GENERATED GUIDANCE IS INFORMATIONAL ONLY AND DOES NOT CONSTITUTE CLINICAL ADVICE, DIAGNOSIS, OR TREATMENT RECOMMENDATIONS. CLIENT AND ITS AUTHORIZED USERS REMAIN SOLELY RESPONSIBLE FOR ALL CLINICAL AND CODING DECISIONS.

13. Term & Termination

Client may terminate this BAA if it determines that Accurecord AI has violated a material term. If Client reasonably determines that the violation can be cured without continuing an impermissible use or disclosure or a material risk to PHI, it may allow up to thirty (30) days after written notice to cure. If cure is not feasible or the permitted cure period expires without cure, Client may terminate immediately by written notice. Termination does not end the protections for PHI that remains in Accurecord AI's possession or control. Accurecord AI may terminate for Client's material breach after thirty (30) days' written notice and failure to cure, subject to continuing PHI protections and applicable law.

By signing below, you acknowledge that you have read, understood, and agree to be bound by the terms of this Business Associate Agreement.

BAA Version: 2026.1-downstream