HIPAA · INCLUDED ON EVERY PLAN

Business Associate Agreement

HealthXfer executes a BAA with every customer facility before any PHI is handled. This page summarizes our standard terms — the full agreement is provided for signature during onboarding, countersigned and returned within one business day.

What we commit to

• Use and disclose PHI only to provide the record-exchange service, as permitted by the agreement and HIPAA.
• Apply appropriate safeguards: AES-256-GCM encryption for identifiers at rest in a short-lived vault, TLS 1.2+ in transit, and automatic purge after successful transfer.
• Report any security incident or breach of unsecured PHI without unreasonable delay.
• Ensure subcontractors that handle PHI agree to the same restrictions.
• Make PHI available for access, amendment, and accounting of disclosures as required — the disclosure record itself is written to your EHR, under the patient.
• Return or destroy PHI at termination; our vault design means there is effectively nothing to return.

What we do not do

• We do not store patient identifiers in our database — only an opaque vault reference.
• We do not hold images or documents at rest — they stream from source PACS to destination.
• We do not sell, mine, or use PHI for any secondary purpose.

Getting your BAA

Email sales@healthxfer.com or book a demo — we'll send the agreement along with our W-9 and certificate of insurance for vendor onboarding.