Legal

Business Associate Agreements

When a covered entity uses Support Scan in a way that involves protected health information, we execute a Business Associate Agreement as part of contracting. What to expect:

• Our BAA covers our obligations: safeguards (see the security overview), breach notification, subcontractor flow-down (including our infrastructure provider, with which we maintain the required agreements), and data return/destruction on termination.
• Optional features that route data outside BAA-covered infrastructure — such as SMS alerts, which traverse carrier networks — are off by default, documented in-product, and enabled only by your administrator's deliberate choice.
• A BAA is one piece of a compliance program, not the whole of it. Your policies, training, and risk analysis remain yours; we aim to be the easy part of that conversation.

To review the BAA with your privacy officer before a purchase decision: SUPPORT_EMAIL_PENDING.