How it works
Sothcare provides a Business Associate Agreement for covered-entity customers before handling PHI. The template is available during onboarding or by request — you do not need to be a customer to read it first.
If your organization has its own BAA form, send it over. We would rather review your paper than make you adopt ours.
Security controls behind the agreement
Security controls include AWS BAA coverage, AES-256 encryption at rest, TLS 1.3 in transit, role-based access control, mandatory MFA on every account, and 7-year audit retention.
The full detail, including what we do not claim, is on our Security & HIPAA page.