Business Associate Agreement
A plain-language overview of the BAA we will sign with a customer before any protected health information is processed. Today Margent runs on sample data only.
Effective October 1, 2026 · Draft 0.9
Template — pending counsel review. This page is a working draft and is not yet a binding agreement. Signed customer agreements control.
The short version
- A BAA is available on every plan, including solo private practices, and is signed before any PHI is processed. Until then, trials and pilots use sample data only.
- We use PHI only to provide the service you've asked for. Never for advertising, never sold, never used to train AI models.
- We report security incidents involving your PHI within 5 business days of discovery — faster than HIPAA's 60-day outer limit.
- Before PHI flows, each subprocessor that will touch it signs a BAA with us that is at least as strict. Their status is on our subprocessors page.
- For 42 CFR Part 2 programs, we also sign a Qualified Service Organization Agreement.
Why a BAA exists
Under HIPAA, a covered entity (a provider, health plan or clearinghouse) may share PHI with a vendor that performs a function on its behalf — a business associate — only if the vendor agrees in writing to protect it. That written agreement is the BAA (45 CFR 164.504(e)). Margent is your business associate when your clinicians use it to document care.
What we commit to
- Permitted uses
- We use and disclose PHI only to provide the services in our agreement, for our proper management and administration as HIPAA permits, or as required by law.
- Safeguards
- Administrative, physical and technical safeguards under the HIPAA Security Rule, including encryption in transit and at rest, access control, audit logging and workforce training.
- Minimum necessary
- Before any PHI: staff access through Margent's tools requires your permission, names one engineer, expires automatically, and is recorded in your audit log. The one exception is returning your data, at your written request or when the agreement ends; that export is recorded in your audit log too.
- Incident reporting
- We report security incidents and breaches of unsecured PHI to you within 5 business days of discovery, with the information you need for notifications.
- Subcontractors
- Every subprocessor that will create, receive, maintain or transmit PHI signs a BAA with us before it does. Our list, with each BAA's status, is public.
- Individual rights
- We help you respond to requests for access, amendment and accounting of disclosures within the timeframes HIPAA requires.
- Return or destruction
- At the end of our agreement, we return or destroy PHI within 30 days and certify destruction on request.
- No AI training
- We do not use PHI to train, fine-tune or evaluate general-purpose AI models, and our model providers process it only under a BAA.
- HHS access
- We make our practices available to HHS to determine your compliance, as HIPAA requires.
Part 2 programs
If you operate a program covered by 42 CFR Part 2, we act as a qualified service organization and sign a QSOA in which we agree to be bound by Part 2, to protect SUD records accordingly, and to resist efforts in judicial proceedings to obtain them except as Part 2 permits. Product controls supporting this are described in our Part 2 explainer.
How to get it
- Before go-live: tell us when you are ready to use Margent with real client data. We execute the BAA (and a QSOA for Part 2 programs) before any PHI is processed.
- Organizations: we include our BAA with the order form. If you prefer your own paper, send it to legal@getmargent.com and we'll review it.
Questions about this document? Email legal@getmargent.com or contact our security team.