Business Associate Agreement

Version 2026-10-09.2. This agreement is Exhibit A of the Terms of Service. The account owner accepts both electronically at sign-up, on behalf of the customer organization.

1. Parties, purpose and definitions

This Business Associate Agreement ("BAA") is between the customer organization that creates an account ("Customer") and DocuFax ("Provider"). It applies whenever Customer uses DocuFax (the "Service") to create, receive, maintain or transmit Protected Health Information ("PHI").

If Customer is a Covered Entity, Provider acts as its Business Associate. If Customer is itself a Business Associate of a Covered Entity, Provider acts as Customer's subcontractor Business Associate, and this BAA applies in the same way. "HIPAA" means the Health Insurance Portability and Accountability Act of 1996, the HITECH Act, and the Privacy, Security and Breach Notification Rules at 45 CFR Parts 160 and 164. Capitalized terms not defined here have the meanings given in HIPAA.

2. Permitted uses and disclosures

Provider may use and disclose PHI only:

• to provide the Service to Customer, including transmitting faxes to the numbers Customer's users enter and delivering received faxes to Customer's account;
• as Customer directs through the Service, for example by sending a document to a connected integration that Customer has switched on;
• for Provider's own proper management and administration and to carry out its legal responsibilities, as permitted by 45 CFR 164.504(e)(4); and
• as Required by Law.

Provider will not use or disclose PHI in any way that would violate Subpart E of 45 CFR Part 164 if done by Customer, will limit its uses and disclosures to the minimum necessary, and will not sell PHI, use it for marketing, or use it to build profiles of individuals. Provider does not de-identify PHI or aggregate it across customers.

3. Safeguards

Provider will use appropriate administrative, physical and technical safeguards, and will comply with Subpart C of 45 CFR Part 164 with respect to electronic PHI, to prevent any use or disclosure of PHI other than as this BAA allows. The safeguards in the Service include encryption of stored documents with a separate key for each customer organization, encryption in transit to and from the web application, unique user identification, two-step verification, automatic logoff, role-based access, an audit trail that cannot be edited, and automatic deletion of documents after the retention period Customer sets.

Fax transmission over the public telephone network is not encrypted. That is a property of fax itself and not something Provider can change.

4. Reporting incidents and breaches

Provider will report to Customer, without unreasonable delay and no later than 30 days after discovery:

• any use or disclosure of PHI that this BAA does not permit;
• any Security Incident that results in unauthorized access to, or use, disclosure, modification or destruction of, PHI; and
• any Breach of Unsecured PHI.

A report of a Breach will include, to the extent known, the information required by 45 CFR 164.410(c): the individuals affected, what happened and when, the types of PHI involved, and what Provider is doing in response. Provider will supplement the report as it learns more and will take reasonable steps to mitigate any harmful effect.

This section is itself notice that unsuccessful Security Incidents happen routinely, such as port scans, failed sign-in attempts and blocked requests. No further report of these will be made as long as no PHI was accessed, used or disclosed.

5. Subcontractors

Provider will ensure that every subcontractor that creates, receives, maintains or transmits PHI on Provider's behalf agrees in writing to restrictions and conditions at least as protective as those in this BAA. A third-party service that Customer chooses to connect to its account is not a subcontractor of Provider, and Customer is responsible for its own agreement with that service.

6. Individual rights

The Service does not hold a Designated Record Set for Customer; it holds copies of the faxes Customer sends and receives. Within 15 days of a written request, Provider will:

• make PHI it maintains available to Customer so that Customer can respond to a request for access under 45 CFR 164.524;
• make PHI available for amendment, and incorporate amendments Customer directs, under 45 CFR 164.526; and
• give Customer the information it needs to provide an accounting of disclosures under 45 CFR 164.528. The audit trail in the Service records each transmission, view, download and deletion.

If an individual contacts Provider directly about their PHI, Provider will refer the request to Customer and will not respond to the individual itself unless Required by Law.

7. Other obligations of Provider

To the extent Provider carries out any obligation of Customer under Subpart E of 45 CFR Part 164, Provider will comply with the requirements that apply to Customer in performing that obligation. Provider will make its internal practices, books and records relating to PHI available to the Secretary of Health and Human Services for the purpose of determining compliance with HIPAA.

8. Customer responsibilities

Customer is responsible for:

• the accuracy of the destination fax numbers its users enter, and for confirming that a recipient is entitled to receive what is sent;
• managing its users and their roles, removing users who leave, and safeguarding sign-in credentials, recovery codes and API keys;
• the retention period it sets, and for keeping its own copy of any document it must retain for longer;
• any document it downloads, exports or sends to a connected integration, once that document has left the Service;
• having any consent, authorization or notice required for the PHI it sends; and
• not asking Provider to use or disclose PHI in a way that would violate HIPAA if Customer did it.

Customer will tell Provider about any restriction, change in or revocation of an individual's permission, or limitation in its notice of privacy practices, to the extent it affects Provider's use or disclosure of PHI.

9. Term and termination

This BAA takes effect when Customer accepts it and stays in effect for as long as Customer has an account. If either party learns of a material breach of this BAA by the other, it may give written notice and, if the breach is not cured within 30 days, terminate the account. Either party may terminate immediately if cure is not possible.

When the account ends, Provider will return or destroy all PHI it maintains for Customer within 30 days and keep no copies, other than in backups that are overwritten on their normal cycle and in the audit trail, which records events and not document contents. Where return or destruction is not feasible, the protections of this BAA continue to apply to that PHI and Provider will limit any further use or disclosure to the purposes that make return or destruction infeasible.

10. General

If this BAA conflicts with the Terms of Service or any other agreement between the parties, this BAA controls with respect to PHI. Any ambiguity is resolved in favor of a meaning that permits both parties to comply with HIPAA. If HIPAA changes in a way that makes this BAA insufficient, the parties will amend it to conform, and Provider may do so by publishing an updated version and notifying Customer. Nothing in this BAA gives rights to anyone other than the parties. Sections 4 and 9 continue to apply after termination for as long as Provider holds any of Customer's PHI.