Business Associate Agreement

Under HIPAA, a business associate is a person or entity that creates, receives, maintains, or transmits PHI on behalf of a covered entity or another business associate. When Reinfora processes PHI for a customer, we act as a business associate and execute a BAA that defines permitted uses, safeguards, subcontractor requirements, breach notification, and termination handling.

• Before uploading real PHI to a production workspace;
• Before connecting live clinical, billing, or identity data;
• When your organization is a covered entity or business associate subject to HIPAA.

Demo and sandbox environments should use de-identified or synthetic data unless a BAA is executed for that environment.

Our standard BAA includes commitments to:

• Use and disclose PHI only as permitted by the agreement and HIPAA;
• Implement appropriate administrative, physical, and technical safeguards;
• Report breaches of unsecured PHI without unreasonable delay;
• Ensure subcontractors that handle PHI agree to comparable restrictions;
• Make PHI available for access, amendment, and accounting as directed;
• Return or destroy PHI at termination where feasible;
• Make internal practices, books, and records available to HHS for compliance determination.

Customers must:

• Provide legally adequate notice and authorization to individuals;
• Limit access to authorized workforce members;
• Not request uses or disclosures that would violate HIPAA;
• Notify Reinfora of changes in contact information for privacy and security matters;
• Maintain accurate account and organization information.

Contact celoeman@gmail.com or your account representative to request our standard BAA. Enterprise customers may request reasonable modifications subject to legal review.