Legal

Business associate agreement

Before your center puts any client data into Confirmity, we sign a business associate agreement (BAA) with you. Here is what it covers and how to get one.

Last updated October 2, 2026Questions: hello@confirmity.app

What a BAA is

HIPAA requires a written agreement between a covered entity, like your center, and any company that handles PHI on its behalf. That company is a business associate. Confirmity is yours once you use it with real client data.

What our BAA covers

  • Permitted use. We use and disclose PHI only to provide Confirmity to you, or as the law requires.
  • Safeguards. We keep administrative, physical and technical safeguards for PHI, including access by seat and an append-only audit log.
  • Our vendors. Any vendor that handles your PHI must agree to the same restrictions in its own BAA. Today that is Vercel (hosting) and Neon (database).
  • Incidents. We report security incidents and breaches of unsecured PHI to you as the agreement requires.
  • Your clients' rights. We help you respond to requests for access, amendment and an accounting of disclosures.
  • Government access. We make our practices available to HHS when it asks.
  • End of service. We return or destroy PHI when the agreement ends, where feasible.

42 CFR Part 2 records

If your center is a Part 2 program, substance use disorder records get extra protection. Confirmity checks for the client's consent before a Part 2 record is shared, and stops the share if consent is missing. We will review Part 2 terms with you as part of the agreement.

Before it is signed

Until a BAA is signed, use Confirmity with sample data only. Every demo and walkthrough already does.

How to request it

Email hello@confirmity.app with the subject "BAA request". Tell us your center's legal name and who will sign. We will send our BAA, our subprocessor list and our security policies to your compliance lead. If your center uses its own BAA form, send it and we will review it.

How it goesSample center

  1. 1You email usSubject "BAA request", your center's legal name and who will signDone
  2. 2We send the papersOur BAA, our subprocessor list and our security policies, to your compliance leadDone
  3. 3Both sides signOr we review your center's own BAA formSigned
  4. 4Real client dataUntil then, Confirmity runs on sample data onlyNext

Ask about our BAA →

Contact

Email hello@confirmity.app. A person reads every message.