In plain English. If you are a HIPAA covered entity (or a business associate of one) and you want to handle patient conversations in Pazau, this agreement is required. It limits how we can use protected health information: only to provide the Services to you. It requires us to safeguard PHI under the HIPAA Security Rule, to flow the same obligations down to our subcontractors, and to help you meet patients' rights to access, amend and get an accounting of disclosures. HIPAA allows up to 60 days to report a breach. We commit to no later than 72 hours after discovery. PHI must stay in a HIPAA-enabled workspace configured as described below. This agreement is available on Business and Enterprise plans. This summary is for convenience only. The text below governs.
This Business Associate Agreement (the "BAA") is entered into between Customer and Pazau and forms part of the Pazau Subscription Agreement or other written agreement between them governing Customer's use of the Services (the "Agreement"), available at Subscription Agreement. "Pazau" means Pazau, Inc., a Delaware corporation, 350 Brannan Street, Suite 400, San Francisco, CA 94107, or such other Pazau entity identified on the Order Form.
This BAA becomes effective on the latest of (a) the date both parties sign it or an Order Form that references it; (b) the date HIPAA-enabled workspaces are provisioned for Customer; and (c) the effective date of the Agreement (the "BAA Effective Date"). This BAA is available only to Customers on Business or Enterprise plans that are Covered Entities or Business Associates under HIPAA. Customers on other plans may not submit PHI to the Services.
1. Definitions
1.1 Capitalized terms used but not defined in this BAA have the meanings given in HIPAA, or, if not defined in HIPAA, in the Agreement. In this BAA:
- "Breach" has the meaning given in 45 C.F.R. § 164.402.
- "Covered Entity" has the meaning given in 45 C.F.R. § 160.103. Where Customer is itself a Business Associate of a Covered Entity, references to Customer's obligations as a Covered Entity shall be read as Customer's obligations as a Business Associate, and Pazau acts as Customer's subcontractor Business Associate.
- "Discovery" means the first day on which a Breach of Unsecured PHI is known to Pazau or, by exercising reasonable diligence, would have been known to Pazau, determined in accordance with 45 C.F.R. § 164.410(a)(2).
- "HIPAA" means the Health Insurance Portability and Accountability Act of 1996, the Health Information Technology for Economic and Clinical Health Act enacted as part of the American Recovery and Reinvestment Act of 2009 ("HITECH"), and their implementing regulations at 45 C.F.R. Parts 160 and 164 (the Privacy Rule, the Security Rule and the Breach Notification Rule), each as amended.
- "HIPAA-Enabled Workspace" means a Pazau workspace that Pazau has designated as HIPAA-enabled at Customer's request and that is configured in accordance with Section 4.
- "PHI" means Protected Health Information, as defined in 45 C.F.R. § 160.103, that Pazau creates, receives, maintains or transmits on behalf of Customer through the Services. PHI includes Electronic PHI.
- "Secretary" means the Secretary of the U.S. Department of Health and Human Services or their designee.
- "Security Incident" has the meaning given in 45 C.F.R. § 164.304.
- "Unsecured PHI" has the meaning given in 45 C.F.R. § 164.402.
2. Permitted uses and disclosures
2.1 Services. Pazau may use and disclose PHI only as necessary to perform the Services for Customer under the Agreement, including to route, store and display conversations; to generate AI responses and resolve conversations under Customer's Procedures; to execute Actions configured by Customer against Customer's systems; to transcribe and analyze calls and messages; to produce Traces and Insights; and to provide support, in each case as permitted by this BAA and in a manner that would not violate the Privacy Rule if done by Customer.
2.2 Management and administration. Pazau may use PHI for its proper management and administration and to carry out its legal responsibilities. Pazau may disclose PHI for those purposes only if (a) the disclosure is required by law; or (b) Pazau obtains reasonable written assurances from the recipient that the PHI will be held confidentially, used or further disclosed only as required by law or for the purpose for which it was disclosed, and that the recipient will notify Pazau of any instance in which the confidentiality of the PHI has been breached.
2.3 Required by law. Pazau may use or disclose PHI as required by law, subject to Section 3.9.
2.4 Minimum necessary. Pazau shall request, use and disclose only the minimum necessary PHI to accomplish the intended purpose, in accordance with 45 C.F.R. § 164.502(b) and any guidance issued by the Secretary. Customer is responsible for configuring Procedures, Actions and integrations so that only the minimum necessary PHI is retrieved from or written to Customer's systems.
2.5 Prohibited uses. Pazau shall not (a) sell PHI or receive direct or indirect remuneration in exchange for PHI; (b) use or disclose PHI for marketing or fundraising; (c) de-identify PHI for its own purposes; (d) aggregate PHI with data of other customers, except to provide data aggregation services relating to Customer's health care operations if expressly requested by Customer in writing; or (e) use PHI to train, retrain or fine-tune any foundation or general-purpose model, whether operated by Pazau or a Model Provider. Any optional per-customer model improvement described in the AI Addendum is not available in HIPAA-Enabled Workspaces unless the parties agree otherwise in a signed writing.
2.6 Customer obligations under the Privacy Rule. To the extent Pazau carries out any of Customer's obligations under the Privacy Rule, Pazau shall comply with the requirements of the Privacy Rule that apply to Customer in the performance of those obligations.
3. Obligations of Pazau
3.1 Safeguards. Pazau shall use appropriate administrative, physical and technical safeguards, and comply with Subpart C of 45 C.F.R. Part 164 with respect to Electronic PHI, to prevent use or disclosure of PHI other than as provided by this BAA. Those safeguards include the measures in the Security Addendum: AES-256 encryption at rest, TLS 1.2 or higher in transit, MFA and phishing-resistant FIDO2 keys for production access, just-in-time and logged access, audit logs retained for at least 6 years for HIPAA-Enabled Workspaces, an annual HIPAA security risk analysis, and annual HIPAA training for personnel supporting HIPAA-Enabled Workspaces.
3.2 Reporting of Breaches of Unsecured PHI. Pazau shall notify Customer of any Breach of Unsecured PHI without unreasonable delay and in no case later than 72 hours after Discovery. HIPAA permits a business associate up to 60 calendar days after discovery to notify a covered entity. Pazau's shorter 72-hour commitment is its standard for all HIPAA customers.
3.3 Content of Breach notice. Pazau's notice shall include, to the extent known at the time and supplemented as information becomes available: (a) the identification of each individual whose Unsecured PHI has been, or is reasonably believed by Pazau to have been, accessed, acquired, used or disclosed; (b) a description of what happened, including the date of the Breach and the date of Discovery; (c) the types of Unsecured PHI involved; (d) steps individuals should take to protect themselves from potential harm; (e) a description of what Pazau is doing to investigate the Breach, mitigate harm and protect against further Breaches; and (f) any other information Customer reasonably requires to meet its notification obligations under 45 C.F.R. §§ 164.404 through 164.408.
3.4 Reporting of other impermissible uses and disclosures. Pazau shall report to Customer any use or disclosure of PHI not provided for by this BAA of which it becomes aware, including a Breach of Unsecured PHI, within the time set out in Section 3.2.
3.5 Reporting of Security Incidents. Pazau shall report to Customer any successful Security Incident involving Electronic PHI of which it becomes aware without unreasonable delay and in no case later than 72 hours after becoming aware of it. The parties acknowledge that unsuccessful attempts at unauthorized access, use, disclosure, modification or destruction of information, or interference with system operations, occur routinely. These include pings and other broadcast attacks on firewalls, port scans, unsuccessful log-on attempts, denial-of-service attacks, and malware that is detected and neutralized, in each case so long as none results in unauthorized access, use or disclosure of PHI. This Section 3.5 constitutes notice by Pazau to Customer of the ongoing existence of such unsuccessful Security Incidents, and no further notice of them is required.
3.6 Mitigation. Pazau shall mitigate, to the extent practicable, any harmful effect known to Pazau of a use or disclosure of PHI by Pazau or its subcontractors in violation of this BAA.
3.7 Breach notification costs. Where a Breach of Unsecured PHI results from Pazau's breach of this BAA, Pazau shall reimburse Customer for the reasonable, documented costs of notifying affected individuals, regulators and the media as required by the Breach Notification Rule, and of providing twelve months of credit monitoring or identity protection services to affected individuals where appropriate. These costs are subject to Section 8.
3.8 Subcontractors. In accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2), Pazau shall ensure that any subcontractor that creates, receives, maintains or transmits PHI on behalf of Pazau agrees in writing to restrictions, conditions and requirements at least as stringent as those that apply to Pazau under this BAA, including compliance with the Security Rule. Pazau's subcontractors that may Process PHI, including hosting and Model Providers, are identified as HIPAA-eligible on the Sub-processors page. Pazau routes AI inference for HIPAA-Enabled Workspaces only to Model Providers that have signed a business associate agreement with Pazau and have committed to zero data retention.
3.9 Access. Within 10 business days after a request by Customer, Pazau shall make PHI maintained in a Designated Record Set available to Customer so that Customer can meet its obligations under 45 C.F.R. § 164.524, including in electronic form. Customer can export conversation data and Traces for an individual through the Services at any time. If an individual requests access directly from Pazau, Pazau shall forward the request to Customer within 5 business days.
3.10 Amendment. Within 15 business days after a request by Customer, Pazau shall make PHI maintained in a Designated Record Set available for amendment and incorporate any amendments as directed by Customer in accordance with 45 C.F.R. § 164.526. If an individual requests amendment directly from Pazau, Pazau shall forward the request to Customer within 5 business days.
3.11 Accounting of disclosures. Pazau shall document disclosures of PHI and information related to them as would be required for Customer to respond to a request for an accounting of disclosures under 45 C.F.R. § 164.528. Within 15 business days after a request by Customer, Pazau shall provide that information to Customer. If an individual requests an accounting directly from Pazau, Pazau shall forward the request to Customer within 5 business days.
3.12 Books and records. Pazau shall make its internal practices, books and records relating to the use and disclosure of PHI available to the Secretary for purposes of determining Customer's compliance with HIPAA, subject to attorney-client and other applicable privileges. Unless prohibited by law, Pazau shall promptly notify Customer of any such request.
3.13 Compliance evidence. On Customer's written request, no more than once in any 12-month period, Pazau shall provide its most recent SOC 2 Type II report (which includes HIPAA Security Rule mapping), ISO/IEC 27001 and 27701 certificates, and a summary of its most recent HIPAA security risk analysis. Customer's additional audit rights are as set out in Section 9 of the Data Processing Addendum, which apply to this BAA with necessary changes.
3.14 Offshore access. Pazau shall not store PHI outside the United States. Pazau personnel located outside the United States shall not access PHI except with Customer's prior written consent or where strictly necessary to respond to a Security Incident affecting the Services, in which case access is logged and limited to the minimum necessary.
4. HIPAA-Enabled Workspaces and Customer configuration
4.1 Where PHI may be processed. Customer shall submit, and permit its End Users and Authorized Users to submit, PHI only within a HIPAA-Enabled Workspace hosted in Pazau's US region. Pazau is not responsible for PHI submitted outside a HIPAA-Enabled Workspace, and such PHI is not subject to this BAA, except that Pazau shall notify Customer and take reasonable steps to delete it on becoming aware of it.
4.2 Required configuration. A HIPAA-Enabled Workspace must be configured as described in the HIPAA configuration guide in the Documentation at docs.pazau.com, including:
- (a) Pazau Guard enabled with the PHI detection and redaction policy applied to AI Features, Insights exports, and data shared with integrations not covered by a business associate agreement;
- (b) SSO with enforced MFA for all Authorized Users, and role-based access controls restricting PHI to Authorized Users with a need to know;
- (c) only HIPAA-eligible channels and features enabled. HIPAA-eligible channels are email, web and in-app chat, SMS, and Pazau Voice. Social media channels (including Facebook Messenger, Instagram and X) and any beta, preview or labs features are not HIPAA-eligible and are disabled in HIPAA-Enabled Workspaces. WhatsApp is eligible only where Customer has its own agreement with Meta governing PHI;
- (d) Actions and integrations connected only to Customer systems or third-party systems for which Customer has a business associate agreement or other lawful basis for disclosure; and
- (e) retention settings for conversations, recordings and Traces set in accordance with Customer's record-retention obligations.
4.3 Customer responsibility for third-party integrations. Disclosures of PHI that Customer instructs Pazau to make, including through Actions and integrations Customer configures to transmit PHI to Customer's systems or to third parties, are disclosures by Customer. Pazau is not responsible for the security or compliance of those recipients.
4.4 Model Providers. AI Features in HIPAA-Enabled Workspaces use only the Model Providers designated as HIPAA-eligible on the Sub-processors page. Pazau's model change notice obligations in the AI Addendum apply.
5. Obligations of Customer
5.1 Notice of privacy practices. Customer shall notify Pazau of any limitation in its notice of privacy practices under 45 C.F.R. § 164.520, to the extent that the limitation may affect Pazau's use or disclosure of PHI.
5.2 Changes in permission. Customer shall notify Pazau of any change in, or revocation of, an individual's permission to use or disclose PHI, to the extent that the change may affect Pazau's use or disclosure of PHI.
5.3 Restrictions. Customer shall notify Pazau of any restriction on the use or disclosure of PHI that Customer has agreed to or is required to abide by under 45 C.F.R. § 164.522, to the extent that the restriction may affect Pazau's use or disclosure of PHI.
5.4 Permissible requests. Customer shall not request that Pazau use or disclose PHI in any manner that would not be permissible under the Privacy Rule if done by Customer, except as permitted by Sections 2.2 and 2.3.
5.5 Minimum necessary and configuration. Customer shall disclose to Pazau only the minimum necessary PHI, shall configure the Services as required by Section 4, and shall obtain any authorizations or consents required to disclose PHI to Pazau and to have End Users interact with AI Features.
6. Substance use disorder records
6.1 Pazau does not process records subject to 42 C.F.R. Part 2 unless the parties expressly agree in a signed Order Form or amendment to this BAA, which shall include the qualified service organization terms required by 42 C.F.R. Part 2. Absent such agreement, Customer shall not submit Part 2 records to the Services.
7. Term and termination
7.1 Term. This BAA begins on the BAA Effective Date and continues until the Agreement expires or terminates, unless earlier terminated under Section 7.2, subject to Section 7.4.
7.2 Termination for material breach. If either party determines that the other has violated a material term of this BAA, the non-breaching party shall give written notice describing the violation. If the breaching party does not cure the violation within 30 days after receiving notice, the non-breaching party may terminate this BAA and the affected portions of the Agreement. If cure is not possible, the non-breaching party may terminate immediately on written notice. Where Customer terminates under this Section 7.2 for Pazau's breach, Pazau shall refund any prepaid fees for the terminated Services covering the remainder of the Subscription Term.
7.3 Effect of termination on HIPAA-Enabled Workspaces. Termination of this BAA without termination of the Agreement ends Customer's right to Process PHI in the Services. Customer shall promptly cease submitting PHI, and Pazau shall disable HIPAA designation of the affected workspaces after the return and destruction process in Section 7.4.
7.4 Return or destruction of PHI. On termination of this BAA, Pazau shall, at Customer's election, return PHI to Customer by making it available for export for 30 days, and then destroy all PHI that Pazau and its subcontractors maintain in any form, retaining no copies. Destruction, including from backups, shall be completed within 90 days after termination. Pazau shall certify destruction in writing on request. Where return or destruction is infeasible, Pazau shall notify Customer of the conditions that make it infeasible, extend the protections of this BAA to the retained PHI, and limit further uses and disclosures to those purposes that make return or destruction infeasible, for so long as Pazau maintains the PHI.
7.5 Survival. Sections 7.4, 8 and 9 and Pazau's obligations with respect to any retained PHI survive termination of this BAA.
8. Liability
8.1 Each party's liability arising out of or relating to this BAA is subject to Section 15 of the Agreement, including the Data Protection Cap in Section 15.3, which applies to breaches of this BAA and to Breaches of Unsecured PHI. This BAA does not create any separate or additional limitation of or exception to liability.
9. General
9.1 Order of precedence. This BAA supplements the Agreement. In the event of any conflict between this BAA and the Agreement, the Data Processing Addendum, the Security Addendum or any Order Form, this BAA prevails with respect to PHI.
9.2 Amendment. The parties shall take such action as is necessary to amend this BAA to the extent required for either party to comply with changes to HIPAA. Any other amendment must be in writing and signed by both parties.
9.3 Interpretation. Any ambiguity in this BAA shall be resolved to permit compliance with HIPAA. A reference to a section of HIPAA means the section as in effect or as amended.
9.4 No third-party beneficiaries. Nothing in this BAA confers any rights, remedies or obligations on any person other than the parties and their permitted successors and assigns.
9.5 Independent contractors. Pazau is an independent contractor and not an agent of Customer for purposes of HIPAA or federal common law of agency.
9.6 Notices. Notices under this BAA shall be given as set out in Section 21 of the Agreement. Breach and Security Incident notices shall also be sent to the security and privacy contacts designated by Customer in the Services. Notices to Pazau shall be sent to legal@pazau.com, with a copy to privacy@pazau.com and, for Security Incidents, security@pazau.com.
9.7 Governing law. This BAA is governed by the law specified in Section 18 of the Agreement, except to the extent HIPAA or other U.S. federal law applies.
9.8 Entire agreement. This BAA, together with the Agreement, constitutes the entire agreement between the parties with respect to its subject matter and supersedes any prior business associate agreement between them relating to the Services.