BAA overview

Why there is a BAA

Your clinic is a covered entity under HIPAA. When Anatomia handles your patients' information, we are your business associate. HIPAA requires a written business associate agreement between us.

We sign one with every clinic before its first real patient. Until it is signed, no patient information goes into Anatomia.

This page summarizes what our agreement covers. The agreement itself sets the full terms.

How we may use patient information

We use and disclose protected health information only:

• to provide Anatomia to your clinic, as your agreement describes;
• as you instruct us in writing;
• for our own proper management and administration, as HIPAA allows;
• when the law requires it.

We use the minimum necessary for each purpose. We never sell patient information or use it for marketing, and we never use it to train AI models.

Safeguards

The agreement commits us to the administrative, physical and technical safeguards of the HIPAA Security Rule. The product is built with:

• encryption in transit and at rest;
• a second factor for every staff sign-in, and sign-out after idle time;
• roles that limit what each person sees;
• an append-only audit log of every read, change and export of patient information;
• records kept apart for each clinic.

The full list is on our Security & HIPAA page.

Subcontractors

A subcontractor handles your patients' information only once it has signed a business associate agreement with us, with terms at least as strict as ours. The ones we use are Amazon Web Services, which hosts the product, and Sentry, which receives error reports. The list, and what each does, is on our subprocessors page.

Reporting breaches and incidents

We report to you any use or disclosure of patient information that the agreement does not allow, and any security incident we become aware of.

If there is a breach of unsecured patient information, we tell you without unreasonable delay and no later than 60 days after we discover it. Your agreement may set a shorter time. We give you what we know about who was affected and what happened, so you can notify patients as HIPAA requires.

Supporting patients' rights

We help you meet your duties to patients:

• Access. You can release a copy of a patient's record from Anatomia when a verified patient asks for it.
• Amendment. We make the amendments to records that you direct.
• Accounting of disclosures. The audit log shows who opened each record, when and why, and we give you what you need for an accounting.

If a patient asks us directly, we pass the request to you.

Access for HHS

We make our internal practices, books and records about your patients' information available to the Secretary of Health and Human Services, when asked, to show HIPAA compliance.

When the agreement ends

The BAA lasts as long as we handle your patients' information. You may end it if we materially breach it and don't cure the breach.

Anatomia never deletes clinical records on its own. When the agreement ends, we return or destroy your patients' information on your instructions, where that is feasible. Anything we cannot return or destroy stays protected under the agreement for as long as we hold it.

Getting a copy

To review our business associate agreement, write to demo@anatomia.health or hello@anatomia.health. We send it with your order, and we sign it before your first real patient.