Business Associate Agreement
Last updated September 2026
What a BAA is
A Business Associate Agreement, or BAA, is the contract HIPAA requires between a healthcare practice and any vendor that handles patient information on its behalf. Symbal records visits and writes notes from them, so Symbal is your business associate, and we sign a BAA with every practice.
How Symbal's BAA works
Symbal's BAA is Schedule A of the Platform Terms of Use. It is accepted automatically when you create your account, so there is no separate paperwork step and no gap between signup and coverage.
What it commits Symbal to
- Using patient information only to provide the service to your practice.
- Encryption in transit (TLS 1.2 or higher) and at rest (AES-256), with hosting in the United States.
- Notifying you of any breach of unsecured PHI without unreasonable delay and no later than 10 days after discovery.
- Supporting your obligations when a patient asks to see or amend their records.
- Binding every subcontractor that touches PHI to its own BAA.
- Returning or destroying PHI when the agreement ends.
- Never using patient information to train AI models.
Vendors under BAA
| Vendor | What it does | Agreement |
|---|---|---|
| Amazon Web Services | Hosting and storage, U.S. Oregon region | BAA signed |
| Deepgram | Speech to text | BAA signed |
| OpenAI | Note generation | BAA signed |
Need a countersigned copy?
Many practices keep a signed copy on file. Email us with your practice name and we will send a countersigned PDF.
Questions
Email support@symbal.co and a person will answer.