Business associate agreements
Last updated
What a business associate agreement is
Under HIPAA, a covered entity (such as a health care provider that bills electronically, a health plan, or a health care clearinghouse) may share protected health information ("PHI") with a vendor that performs services for it only if the vendor signs a business associate agreement ("BAA"). A BAA is a contract in which the vendor agrees to protect PHI and use it only as the agreement allows.
Who needs one
Vayra Health & Wellness, Inc. ("Vayra") signs a BAA with partners that use the Vayra Platform, Vayra White Label, or Vayra Intelligence (the "Platform Services") to create, receive, maintain, or transmit PHI. In general, that includes:
- covered entities, such as medical practices and clinics, that use the Platform Services to serve their patients; and
- business associates of covered entities that use the Platform Services to perform services involving PHI, in which case Vayra acts as a subcontractor business associate.
Whether your organization is a covered entity or a business associate depends on your specific activities. Please consult your own legal counsel. Vayra cannot make that determination for you.
A BAA is not needed to browse vayraplatform.com or to request a demo, because this website does not collect PHI. Please do not include patient information in any form on this website.
What Vayra's BAA covers
In plain terms, Vayra's BAA commits Vayra to:
- use and disclose PHI only to provide the Platform Services and as the BAA and the law permit;
- maintain administrative, physical, and technical safeguards for electronic PHI as required by the HIPAA Security Rule;
- report to you any use or disclosure of PHI not permitted by the BAA, any security incident, and any breach of unsecured PHI, within the timeframe stated in the BAA, and in no case later than HIPAA requires (for a breach of unsecured PHI, no later than 60 calendar days after discovery);
- require any subcontractor that handles PHI on Vayra's behalf to agree to the same restrictions and conditions;
- help you respond to individuals' requests to access or amend their PHI and to receive an accounting of disclosures;
- make its internal practices and records relating to PHI available to the U.S. Department of Health and Human Services for purposes of determining compliance; and
- return or destroy PHI when the relationship ends, or protect any PHI that cannot feasibly be returned or destroyed.
The BAA sets out the complete terms. This summary does not change or replace them. Where your agreement with Vayra also includes our data processing addendum, the BAA controls with respect to PHI.
Vayra's own upstream BAAs
Vayra has business associate agreements in place with the subprocessors that handle PHI for the Platform Services, including:
- Anthropic, PBC, the AI model provider for Vayra Intelligence, under an enterprise BAA; and
- Microsoft Corporation, for Microsoft Azure cloud services, under Microsoft's standard HIPAA BAA.
Pharmacy fulfillment partners and the payment processor are addressed in each partner's agreement. The full list of subprocessors is on our subprocessors page.
Vayra Intelligence and PHI
Vayra Intelligence is an AI health assistant module within the Platform Services. It runs under Vayra's BAA with Anthropic. It does not diagnose, prescribe, or replace a clinician. Use of Vayra Intelligence is subject to our acceptable use policy.
A BAA is not a certification
Signing a BAA is a contractual commitment between two parties. It does not mean that either party has been certified by anyone. There is no government certification for HIPAA, and no agency or private organization can issue one on the government's behalf. Each organization remains responsible for its own compliance with HIPAA, including its own policies, risk analysis, workforce training, and use of the Platform Services.
Partners may not describe a BAA with Vayra, or use of the Platform Services, as a certification of HIPAA compliance of any kind. See our acceptable use policy.
How to request a BAA
Vayra provides its BAA during contracting for the Platform Services. To start that process, Request a BAA through our contact page, or email legal@vayraplatform.com. Please do not send any PHI with your request.
The BAA must be signed before any PHI is entered into the Platform Services.