> ## Documentation Index
> Fetch the complete documentation index at: https://trust.denialbase.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Business Associate Agreements (BAA)

> How to request a BAA with Denialbase, and the status of BAAs we hold with our subprocessors.

<Info>
  Under HIPAA, any vendor that creates, receives, maintains, or transmits PHI on behalf of a covered entity must sign a Business Associate Agreement (BAA). Denialbase executes BAAs with covered-entity customers and requires them from our own subprocessors.
</Info>

## Request a BAA with Denialbase

Any healthcare customer (covered entity) that will send PHI through Denialbase can request a BAA before go-live.

<Steps>
  <Step title="Request">
    Email [legal@denialbase.com](mailto:legal@denialbase.com) with your organization name, primary contact, and anticipated go-live date.
  </Step>

  <Step title="Review">
    We'll send our standard BAA (based on HHS model language) within 2 business days. We can accept minor redlines; major redlines may route to outside counsel and extend the timeline.
  </Step>

  <Step title="Sign">
    Both parties sign electronically via DocuSeal. Fully executed PDF stored in our compliance vault and provided to you.
  </Step>

  <Step title="Go live">
    Your PHI handling is now covered. Any subsequent subprocessor change will be notified to you per the BAA's notice clause.
  </Step>
</Steps>

## Our subprocessor BAA status

<Warning>
  **Honest status as of April 2026**: we are actively executing BAAs with the subprocessors below. Until each is signed, we rely on the vendor's default data-handling terms plus our own technical controls (column-level encryption, PHI scrubbing before it leaves our systems, private networking).
</Warning>

| Subprocessor          | Service                                                | BAA status                                                               | Target  |
| --------------------- | ------------------------------------------------------ | ------------------------------------------------------------------------ | ------- |
| Google Cloud Platform | Cloud SQL, Cloud Run, GCS, Memorystore, Secret Manager | **Not yet signed** (in progress)                                         | Q3 2026 |
| Anthropic             | LLM inference for denial detection and appeal drafting | **Not yet signed** (in progress)                                         | Q3 2026 |
| Sentry                | Error monitoring (PHI-scrubbed)                        | **Not yet signed** (in progress)                                         | Q3 2026 |
| Amazon SES            | Transactional email (no PHI in bodies)                 | **Not yet signed** (in progress)                                         | Q3 2026 |
| DocuSeal              | E-signature for appeal submissions                     | Not required — customer-executed, PHI handled in-browser                 | —       |
| Kaiser Permanente     | Direct payer integration                               | Not required — Kaiser is the destination of the data, not a subprocessor | —       |

See [Subprocessors](/trust/subprocessors) for the full data-flow description and residency details.

## Technical safeguards while BAAs are in progress

We don't wait for legal execution to enforce technical PHI minimization. All of the following are live today:

* **Column-level encryption** for PHI fields on User, InsuranceMember, InsuranceProfile, and OverturnableDenial models, using Active Record Encryption with customer-managed keys.
* **PHI scrubbing** before sending to LLM providers: names, DOBs, MRNs, and IDs are replaced with token placeholders that are reversed only server-side.
* **PII scrubbing rules in Sentry** configured to redact known PHI field names from error payloads.
* **No PHI in email bodies** — SES sends transactional and notification emails only; PHI stays behind authenticated pages.
* **Audit logging** of every read/write/export of PHI via the `hipaa_audit_logs` pipeline.

## FAQs

<AccordionGroup>
  <Accordion title="Can I send PHI today even though your subprocessor BAAs aren't fully executed?">
    We strongly recommend reviewing the risk with your own compliance team. Many covered entities proceed based on our technical controls and the "in-progress" status of the subprocessor BAAs; others wait. We can provide a detailed control summary on request.
  </Accordion>

  <Accordion title="Will you notify me when a subprocessor BAA is executed, or when a new subprocessor is added?">
    Yes — our BAA includes a 30-day advance notice clause for new subprocessors. We'll also post subprocessor changes to this page and to our changelog.
  </Accordion>

  <Accordion title="Do you accept my organization's BAA template instead of yours?">
    We can. Our standard BAA is usually the faster path, but we're happy to review yours. Send it to [legal@denialbase.com](mailto:legal@denialbase.com).
  </Accordion>

  <Accordion title="How long do you retain executed BAAs?">
    BAAs and the underlying service agreement are retained for the later of (a) the term of the service agreement plus 6 years, or (b) as required by law.
  </Accordion>
</AccordionGroup>