We sign a BAA with every practice before any patient data is shared. No exceptions.
A Business Associate Agreement (BAA) is a legally required contract under HIPAA between your practice (the Covered Entity) and any company that handles Protected Health Information on your behalf (the Business Associate).
Because ChiroDesk AI processes patient names, phone numbers, appointment details, and health information from conversations, we are a Business Associate. HIPAA requires a signed BAA before any PHI is shared between us.
Our AI scheduling system handles PHI in several ways:
All of this is Protected Health Information under HIPAA, and a BAA must be in place before any of it is processed.
Specifically defines what we are and are not allowed to do with your patient data. We use PHI only for scheduling, communication, and service delivery as directed by your practice.
We implement appropriate administrative, physical, and technical safeguards to prevent unauthorized use or disclosure of PHI. This includes encryption, access controls, audit logging, and more. See our HIPAA Compliance page for details.
If any unauthorized access or disclosure of PHI occurs, we notify your practice within 24 hours of discovery, well within the HIPAA maximum of 60 days. We provide all information needed for you to fulfill your notification obligations.
Any subcontractor that accesses PHI on our behalf (cloud hosting, telephony, EHR integration partners) is bound by the same restrictions and must have a BAA in place with us.
We support your obligations to provide patients with access to their records, process amendment requests, and provide an accounting of disclosures.
When the agreement ends, we return or securely destroy all PHI per your instructions. If complete destruction is not feasible, BAA protections extend to any retained data.
Our BAA is signed electronically during the onboarding process, before your account is activated and before any patient data enters our system. Every practice receives and signs a BAA as part of setup. It is not optional.
If you would like to review the BAA before beginning onboarding, contact us at legal@chirodesk.ai and we will send you a copy.
We recommend it. While our BAA follows standard HIPAA provisions, your practice should have legal counsel review any agreement that involves patient data.
No. The BAA is included with every account at no additional cost.
We notify your practice within 24 hours of discovering any breach. We identify affected individuals and provide all information needed for you to comply with HIPAA’s breach notification requirements.
Yes. Every subcontractor that creates, receives, maintains, or transmits PHI on our behalf has a BAA in place with us. We evaluate subcontractors for HIPAA compliance before engagement.
You will have a 60-day window to export your data. After that, all PHI is securely destroyed, and we provide written certification of destruction.
To request a copy of our BAA or ask questions:
Email: legal@chirodesk.ai