We sign a BAA with every customer. Read it before you talk to us.
Why we publish our BAA
Most vendors treat the BAA as something you discover late in procurement, after the demo and the pricing call, when momentum makes it awkward to object to the terms. We think that is backwards. If SuperHIPAA touches ePHI on your behalf, the BAA is the single most important document between us — so it is available up front, before you have spoken to anyone. Read it, redline it, or send us yours.
Our standard BAA is available through the trust package form at /trust/request/ — it arrives without a sales call attached. What follows is a plain-language summary; the agreement itself is the authoritative text.
What our BAA covers
The agreement does the things HIPAA requires a BAA to do, without burying them:
- Permitted uses and disclosures — we use ePHI only to provide the service and as the agreement allows, nothing else. No secondary use, no de-identified resale.
- Safeguards — we commit to the administrative, physical, and technical safeguards the Security Rule requires of a business associate.
- Breach notification — we notify you of a breach of unsecured PHI without unreasonable delay, and in no case later than 10 business days after discovery, with enough detail for you to meet your own notification obligations.
- Subcontractors — every subcontractor that touches ePHI signs downstream terms at least as protective as ours. The full list is on the subprocessors page.
- Access, amendment, and accounting — we support your obligations to individuals under the Privacy Rule where our systems are involved.
- Return or destruction — at termination, your data is returned or destroyed per the agreement, and we certify what happened to it.
Yours or ours — how paper gets signed
We would rather sign a reasonable BAA than argue about whose template wins:
- Our paper. Fastest path. Countersigned as part of standard onboarding, typically same-day.
- Your paper. Usually fine. Send it over; we redline rather than refuse. Most redlines concern notification timelines that assume we are a covered entity rather than a business associate, or audit rights broader than the data we actually hold.
- Negotiated hybrid. For enterprise agreements, BAA terms can be folded into the master agreement. Legal review turnaround is typically 5–10 business days.
What we commit to
- Our standard BAA is available to every paying customer and countersigned during onboarding — before any ePHI flows.
- Every subprocessor that touches ePHI signs downstream terms at least as protective as our BAA with you.
- At termination, customer data is returned or destroyed per the agreement, and destruction is certified in writing.
What a BAA does not do
A signed BAA is necessary, not sufficient, and we would rather you hear that from us. It does not make either party “HIPAA certified” — no such certification exists, from HHS or anyone else. It does not transfer your compliance obligations to us: you remain responsible for your own risk analysis, policies, training, and safeguards. And it does not protect you if the vendor behind it cannot actually perform the commitments in it — which is why this Trust Center exists, and why our audit reports are available under NDA to back the paper with evidence.
Timing
We sign the BAA before ePHI flows, not after. If your evaluation includes a trial or pilot that involves real data, the BAA is executed first — a trial with live ePHI and no BAA in place is a compliance incident waiting for a date. If you want to trial without a BAA, use synthetic data; we can provide a realistic sample set for exactly this purpose.
Documentation available on request
- SOC 2 Type II report (under NDA)
- Penetration test summary
- Business Associate Agreement
- Architecture and data flow diagram
- Completed CAIQ / SIG Lite
If your counsel wants the BAA reviewed alongside the security evidence — which is the sensible order — request the full package and both arrive together.
Questions
Security questions go to security@superhipaa.com and get a human answer within one business day. Contract and BAA questions can go to the same address; we route them to the right person rather than making you guess a second email address.