How Business Associate Agreements apply to Accurecord AI services.
PHI workflows are available only for eligible organization services that Accurecord AI has enabled for the identified customer under the applicable executed BAA. An account's plan label, this information page or signature alone does not activate a workflow. Individual accounts and Free or reference-only tiers cannot submit PHI. Non-PHI reference features remain subject to their stated input restrictions.
A covered entity uses the direct BAA. A customer acting for a covered entity as a business associate or subcontractor uses the downstream form for that capacity. The agreement must identify the actual services and parties; different product names within the same company do not create separate legal entities.
The Health Insurance Portability and Accountability Act (HIPAA) is a U.S. federal law that sets national standards for protecting the privacy and security of individuals' medical records and personal health information ("Protected Health Information" or "PHI").
HIPAA sets requirements for what a business associate contract must include. When a covered entity (like a healthcare provider) works with a business associate (like a software vendor) that will handle PHI, HIPAA requires a written agreement that specifies how the business associate will protect the PHI and limits how it can be used or disclosed.
We only use or disclose PHI for the purpose of providing services to you as specified in our service agreement, or as required by law. We do not use PHI for our own purposes, marketing, or to benefit any third party.
We implement appropriate administrative, physical, and technical safeguards to protect electronic PHI (ePHI) in accordance with the HIPAA Security Rule. This includes encryption, access controls, audit logging, and security monitoring.
We will notify you of a discovered breach of unsecured PHI without unreasonable delay and no later than 72 hours after actual or constructive discovery. This is our contractual commitment — stricter than HIPAA’s outer limit of 60 days — and we may give an initial notice and supplement it as facts become available.
Any subcontractors or agents that process PHI on our behalf are required to agree to the same restrictions and conditions that apply to us under the BAA. We maintain a public list of subprocessors and provide advance notice of changes.
For saved ICD-10 Coding Pro organization cases under the standard schedule, the organization can export during the applicable service and for thirty (30) calendar days after that service ends. Live-system deletion follows at the end of the export window; protected disaster-recovery copies expire within ninety (90) calendar days after live deletion, subject to documented lawful exceptions. Agreed service-specific instructions govern other PHI. Applicable safeguards, record-return and individual-rights support continue for retained PHI. A temporary suspension or administrative BAA revocation does not independently start a different deletion clock.
We support your obligations to provide individuals with access to their PHI, to amend PHI, and to provide an accounting of disclosures as required by HIPAA.
We make our internal practices, books, and records relating to PHI available to the Secretary of the Department of Health and Human Services (HHS) for compliance determinations.
Legal reference: HIPAA's business associate contract requirements come from 45 CFR 164.504(e). HHS also provides a model BAA that organizations can reference.
Request a BAA or contact our compliance team with any questions.