HIPAA business associate agreement
Origin Pixel Solutions, Chennai, Tamil Nadu, India · Version 2026-11-03 · Last updated 3 November 2026
For US covered entities and business associates that want to use the Origin Platform with protected health information (PHI). A BAA is offered only after an eligibility review, because every service in the chain must also sign one.
Current status
HIPAA-eligible plans are not available yet. Until they are, US healthcare businesses (clinics, dental, physiotherapy, pharmacy, mental health) must not put PHI into the platform; sign-up for these industries asks for a "no PHI" attestation and switches off call recordings and transcripts [gate delivered by WP-KYC P0-K2].
A HIPAA plan needs: HIPAA-eligible hosting under a BAA (our current server host does not sign BAAs), the Supabase HIPAA add-on, BAAs with the AI, telephony, SMS and email providers used, and PHI access audit exports. [Hari: decide timing; see PLATFORM-APPROVALS.md.]
What the BAA covers
- Permitted uses and disclosures of PHI only to provide the services and as required by law (45 CFR 164.504(e)).
- Administrative, physical and technical safeguards under the Security Rule (45 CFR Part 164 Subpart C).
- Reporting of uses or disclosures not permitted, security incidents, and breaches of unsecured PHI without unreasonable delay and no later than [10] days after discovery (45 CFR 164.410 allows up to 60 days).
- Sub-contractor BAAs flowing down the same restrictions (45 CFR 164.502(e)(1)(ii)).
- Access, amendment and accounting of disclosures support (45 CFR 164.524, 164.526, 164.528).
- Availability of books and records to HHS; return or destruction of PHI at termination; termination for material breach.
How to request it
Signed-in main logins and admins can request an eligibility review under Legal agreements in the app. You can also write to hariprathish@originpixel.in. Once approved, the BAA template appears in the app to read and sign. See also the Data processing agreement.