Business Associate Agreement

Who needs one

If you are a covered entity under HIPAA — a healthcare provider, health plan or clearinghouse — or a business associate of one, and you transmit protected health information through FaxProof, then FaxProof is your business associate and a written agreement is required.

In practice: if you fax patient records, referrals, prior authorizations, lab results or intake forms, you need one.

How to get one

It's included with the Business plan at no extra cost. Request it in the app at Settings → Request a BAA, or contact us with your organization name and the email of the person who will sign.

We countersign within two business days and send the executed PDF back. You can see the current status in Settings at any time.

What our BAA covers

• Permitted uses and disclosures of PHI, limited to providing the fax service
• Safeguards — encryption in transit and at rest, access controls, authentication
• Reporting of any security incident or breach, and the timeline for it
• Obligations of our subcontractors, who are bound by equivalent terms
• Your right to access, amend and account for disclosures of PHI
• Return or destruction of PHI when the agreement ends
• Retention of audit records for six years

Protected health information you transmit or store in FaxProof Business, our use of Telnyx as a subcontractor (Telnyx signs a BAA), encryption in transit (TLS 1.2+) and at rest (AES-256 on Supabase), audit logging, and the no-retention option.

What a BAA does not do

It doesn't make your organization HIPAA-compliant on its own, and it doesn't cover how your staff handle documents once they leave the app. It covers our part of the chain.

• CloudConvert. Business documents are never sent to CloudConvert. Office conversion for Business uses self-hosted LibreOffice. If that host is down, export a PDF.
• Apple, Google, or RevenueCat. They process purchase metadata, not fax page content.

Controls you should turn on

• Two-factor authentication — required for accounts under a BAA
• App lock — Face ID, Touch ID or a PIN
• A deliberate retention setting — match it to your own records policy, or use no-retention
• Audit trail — on by default; export it whenever you need to

Breach notice

We will notify the covered entity without unreasonable delay and no later than 60 days after discovery of a breach of unsecured PHI, consistent with 45 CFR § 164.410.

Questions about scope: get in touch.