Business Associate Agreement.

The full text of our standard Business Associate Agreement, including permitted uses, subcontractor provisions, breach-notification timelines, and audit rights, is published at /legal/baa/. Review it in advance of contract negotiation if you would like.

Active customers receive the BAA as part of standard onboarding documentation, executed before any PHI exchange. Prospects evaluating Medonix can request the BAA in advance for review by their privacy or compliance counsel.

To request a copy:

• Email [email protected] with the subject line "BAA request."
• Reference your organization name and the legal entity that will execute the agreement.
• Indicate whether you require a redline draft or are evaluating the standard form.

Most BAA requests are turned around within one business day. Customer-specific redlines (e.g., breach-notification window, reporting cadence, indemnification scope) are negotiated during onboarding and routed through our legal team.

Medonix maintains executed BAAs with every subcontractor that creates, receives, maintains, or transmits PHI on our behalf. The full subcontractor list is available to customers under NDA on request.

The BAA is the contractual layer of our HIPAA compliance program. Operational controls are documented at /security/hipaa/ and audited under our SOC 2 Type II and HITRUST CSF programs.