Docs / Security & compliance

Your BAA with AffirmDME

Under HIPAA, your organization (a covered entity or fellow business associate) needs a Business Associate Agreement with any vendor that touches PHI on its behalf — including AffirmDME.

How it’s executed

During onboarding, an org admin reviews and e-signs the BAA in-app via DocuSign; one signature covers the whole organization, and the executed copy is retained on your org record. The standing terms are published at affirmdme.com/baa.

What it covers

The standard HIPAA business-associate commitments: permitted uses and disclosures limited to providing the service, safeguards (the technical measures in how we handle PHI), breach notification duties, subcontractor flow-down (see subprocessors), and return/destruction of PHI at termination.

Before it’s signed

Until the BAA is signed, your organization is in the trial workspace: the full product on synthetic sample cases, with no way to bring in real patient records (sandbox mode explains what’s there). Nothing in the trial is billed. When you’re ready for real cases, an org admin presses Go live in the banner and completes the practice profile, the BAA, and a plan; the workspace switches to production the moment the BAA is signed.