Business Associate Agreement

Effective at launch

AffirmDME (a product of NF Labs LLC) acts as a business associate under HIPAA when it processes protected health information (PHI) on behalf of customer practices. Every customer that uses AffirmDME with PHI must have an executed Business Associate Agreement (BAA) with us — it's a built-in step of onboarding, signed electronically before the workspace can process patient data.

What our BAA commits us to

• Permitted use only: we use and disclose PHI only to provide the service to you, as permitted by the BAA and required by law — never for advertising, resale, or AI model training.
• Safeguards: administrative, physical, and technical safeguards per the HIPAA Security Rule — encryption in transit and at rest, role-based access control, and audit logging.
• Breach notification: we notify you of any breach of unsecured PHI as HIPAA requires, with the information you need for your own notification obligations.
• Subcontractor flow-down: vendors that touch PHI on our behalf (for example, AWS — including our document AI, which runs in Amazon Bedrock) are bound by their own BAAs with equivalent protections. A subprocessor list is available on request.
• Individual rights support: we support your obligations to provide patients access, amendment, and an accounting of disclosures for PHI we hold on your behalf.
• Return or destruction: when the relationship ends, we return or destroy PHI as the BAA provides, and retain none except where law requires.

How to execute a BAA

Sign up and the BAA is presented for electronic signature during onboarding — before any PHI can be processed in your workspace. Need a copy for your compliance files, want your counsel to review it first, or have questions? Email hello@affirmdme.com.

Related: Privacy Policy · Terms of Service