Business associate agreement
We will sign a BAA. Ask, and we will send one for your review within one business day.
Why one applies here
Surgi-Sys records a chart or accession reference against the supplies used on a case. Tied to a date and a procedure, that is information about an identifiable patient. If you are a covered entity, that makes us a business associate, and HIPAA requires an agreement between us before we handle it.
What the agreement covers
The usual and necessary things: that we use protected health information only to provide the service and as the agreement permits; that we apply appropriate safeguards; that we report any breach to you without undue delay; that our subprocessors are bound by equivalent obligations; and that on termination we return or destroy the information at your direction.
We are happy to work from your own template. Most facilities have one their counsel has already approved, and using it is usually faster for everybody.
A note on “HIPAA certified”
You will see vendors describe themselves as HIPAA certified. There is no such certification — no government body or accreditation authority issues one. A vendor claiming it is either confused or hoping you are.
What can be true is that a vendor implements appropriate safeguards and will contractually commit to them. That is what we do: the security page sets out the measures, and the BAA is the commitment.
We do not currently hold a SOC 2 report. If your procurement process requires one, tell us during evaluation rather than after.
Your part of it
A BAA protects information you actually put into the system. The most effective thing you can do is put less of it in: Surgi-Sys needs one reference that ties a case back to your own patient record, and nothing more. Patient names, dates of birth and clinical detail have no field to go in, and should not be typed into the ones that exist.