Business Associate Agreement (United States)
The short version
- For providers practising in the United States. You sign it in setup step 4, Agreements.
- Under HIPAA, you are the covered entity and Materia+ is your business associate.
- Your patients' health information is stored in AWS's Montreal region in Canada, and encrypted.
- Materia+ uses it only to provide the software. It's never used for analytics, marketing or AI training, and never sold.
- We tell you about any breach within 30 days of discovering it.
- When you leave, you can export everything for 90 days, and then it's destroyed.
1.Parties and purpose
You're the covered entity. Materia+ is your business associate.
This Business Associate Agreement ("BAA") is between you (the "Provider") and Homeopathic Healing Inc., operating as Materia+ ("Materia+"). It forms part of the Provider Terms.
The Provider is a covered entity, or a business associate of a covered entity, under the US Health Insurance Portability and Accountability Act of 1996 and its regulations ("HIPAA"). Materia+ acts as the Provider's business associate. This BAA binds Materia+ to protect electronic protected health information ("ePHI") that it creates, receives, keeps or sends for the Provider, as required by the HIPAA Privacy, Security and Breach Notification Rules.
2.Where ePHI is stored
In Canada, in AWS's Montreal region.
The Provider acknowledges and agrees that ePHI is stored and processed on Amazon Web Services infrastructure in its Canada (Central) region in Montreal, Quebec, Canada (ca-central-1). Materia+ has accepted the AWS Business Associate Addendum for this infrastructure.
3.Permitted uses
Only to provide the software.
Materia+ uses and discloses ePHI only:
- to host, maintain, support and provide the software to the Provider
- as the Provider directs through the Platform
- as required by law
Materia+ doesn't use the Provider's clinical notes, client records, formulas or other clinical data for data mining, analytics, marketing, artificial intelligence training or any other independent or commercial purpose, and never sells ePHI.
4.Safeguards
Encryption, access controls and backups.
Materia+ uses administrative, physical and technical safeguards that meet the HIPAA Security Rule for all ePHI, including charting files, client records and any intake forms the Provider stores. These include:
- multi-factor authentication for all staff access to servers and administrative tools, limited to people who need it and logged
- encryption in transit (TLS)
- encryption at rest (AES-256, managed with AWS Key Management Service) and an additional layer of encryption for the most sensitive fields
- a database that isn't reachable from the internet
- daily encrypted backups, kept for 14 days and tested for restore
- a written incident response plan
5.Subcontractors
The same rules apply to anyone who helps us.
Materia+ makes sure that any subcontractor that creates, receives, keeps or sends ePHI for Materia+ agrees in writing to the same restrictions, conditions and safeguards that apply to Materia+ under this BAA. Our current subcontractors are listed on "Companies that help us". They include Amazon Web Services, for hosting and for video visits through the Amazon Chime SDK, in its Montreal region. Both are covered by the AWS Business Associate Addendum.
6.Reporting and breaches
We tell you within 30 days.
Materia+ reports to the Provider, at the Provider's account email:
- any use or disclosure of ePHI not allowed by this BAA
- any security incident affecting ePHI
- any breach of unsecured ePHI
without unreasonable delay, and in no event later than 30 calendar days after discovering it. The report includes the information Materia+ has that the Provider needs to notify affected individuals and regulators. Materia+ cooperates with the Provider's response.
7.Individuals' rights
We help you answer patients' requests.
Materia+ makes ePHI available so the Provider can respond to individuals' requests to access, amend or receive an accounting of disclosures of their ePHI, as HIPAA requires. If an individual asks Materia+ directly, Materia+ passes the request to the Provider.
8.Government access
Materia+ makes its internal practices, books and records about the use and disclosure of ePHI available to the Secretary of the US Department of Health and Human Services when requested, to determine compliance with HIPAA.
9.Term and termination
When your plan ends, export your records, then they're destroyed.
This BAA lasts as long as Materia+ holds ePHI for the Provider. If either party materially breaches it and doesn't fix the breach within 30 days of written notice, the other party may end the Provider Terms and this BAA.
When the Provider's plan ends, Provider Terms section 15 applies: ePHI stays available read-only for 90 days so the Provider can export it (or longer on the archive plan). After that, Materia+ destroys it, and copies in backups are replaced within 14 days. Where returning or destroying ePHI isn't feasible, the protections of this BAA continue for as long as Materia+ holds it.
10.How you sign this agreement
In setup step 4, Agreements, with your typed legal name.
US providers sign this BAA in setup step 4 (Agreements) by ticking this box and typing their full legal name:
"By checking this box, I execute the Materia+ Business Associate Agreement. Materia+ agrees to safeguard all protected health information I enter in line with US HIPAA security standards, using AES-256 encryption at rest and TLS encryption in transit, on cloud infrastructure in AWS's Montreal region (ca-central-1)."
We record your name, the practice you're signing for, the version of this agreement, the date and time (UTC), and your browser and IP address.