Business Associate Agreement

This agreement governs our handling of protected health information created or received on your behalf, as required by the HIPAA Privacy and Security Rules and the HITECH Act.

It is executed before you connect a practice management system or route live calls to us.

We may use protected health information solely to provide the services described in our Terms of Service — answering calls, scheduling appointments, sending messages you have configured, and presenting records of those activities to your authorized staff.

We may use it for our own proper management and administration, and to carry out our legal responsibilities. We may not use it for any other purpose, including marketing or the training of general-purpose models.

We implement administrative, physical and technical safeguards that reasonably and appropriately protect the confidentiality, integrity and availability of protected health information, including encryption in transit and at rest, role-based access control, and audit logging of access.

We ensure that any subcontractor that creates, receives, maintains or transmits protected health information on our behalf agrees to restrictions and conditions at least as strict as those that apply to us.

We report to you any use or disclosure not permitted by this agreement, and any security incident or breach of unsecured protected health information, without unreasonable delay and in no case later than 30 calendar days after discovery.

Our notice identifies the individuals affected, the nature of the information involved, and the steps we are taking, to the extent known at the time.

On termination, we return or destroy all protected health information we maintain on your behalf, at your election, and retain no copies where feasible.

Where return or destruction is not feasible, we extend the protections of this agreement to that information and limit further uses and disclosures for as long as we retain it.