Request a Business Associate Agreement

Why the BAA comes first

To find what you are owed, we read remits, EOBs and claim lines. Those are protected health information (PHI). Under HIPAA, a provider may share PHI with a vendor that works on its behalf only after a written contract gives satisfactory assurances that the vendor will protect it. That contract is the BAA, and its required contents are set out in 45 CFR 164.504(e).

So the order never changes: BAA signed, then a secure upload link, then data. That holds for the free audit as much as for a full engagement. We do not accept claim files before the BAA is in place. If something is sent to us by mistake before then, we delete it and tell you.

Request the BAA

The form asks who you are, which organization the BAA is for and who will sign it. Name the legal entity that bills for the services. If you bill under several legal entities or tax IDs, list them in the message and we will tell you whether one BAA can cover them or each needs its own.

This form asks only for contact details. Do not include patient information.

What happens next

When	What happens
Day 0	You send the form below. It asks for contact details only.
Same business day, and no later than the next (target)	We send our standard BAA for e-signature to the signer you named, with a copy to you.
When you sign	We countersign and send you the executed copy. For the free audit, the secure upload link goes out with it.
If your counsel has comments	We answer a redline within [3] business days (target, to be confirmed). Most comments are settled in one round.

A person reads every request. If we need something before we can send the BAA, such as the correct legal name of the entity, we ask by reply.

Who signs

A practice, group or facility

If you are the provider (the covered entity under HIPAA), you sign with us directly and we are your business associate. The signer should be someone who can bind the organization: an owner, an officer, the practice administrator or the compliance officer, as your own rules allow.

A billing company, RCM firm or MSO

If you are already a business associate of the provider and you bring us in, we sign a subcontractor BAA with you. HIPAA treats us as your subcontractor and requires the same written assurances one level down (45 CFR 164.502(e)(1)(ii)). Your BAA with each provider stays in place, and you keep the client relationship. Before you send us a client’s data, check that your BAA with that client allows you to use subcontractors.

What our standard BAA covers

Each row below is a key term of our standard BAA and the HIPAA provision it answers. The citations are to Title 45 of the Code of Federal Regulations. HHS publishes sample business associate agreement provisions built on the same elements.

Term	What our BAA says	HIPAA source
Permitted uses and disclosures	We use PHI only to perform the services: eligibility assessment, open negotiation, independent dispute resolution and award collection. We disclose to payers, certified IDR entities and the federal IDR portal only what a notice, offer or brief requires. No sale of PHI and no marketing use.	164.504(e)(2)(i), (e)(2)(ii)(A)
Our own administration	Limited use for our management and administration and to meet our legal duties, as HIPAA allows, with the same protections attached.	164.504(e)(2)(i)(A), (e)(4)
Minimum necessary	We ask for and use the least PHI each task needs. Patient identifiers are hashed in working tables and appear in full only where a document requires them.	164.502(b), 164.514(d)
Safeguards	Administrative, physical and technical safeguards under the HIPAA Security Rule: encryption at rest and in transit, isolation per organization, an audit log of every PHI read, US-only hosting.	164.504(e)(2)(ii)(B), Part 164 Subpart C
Reporting	We report any use or disclosure the BAA does not allow, any security incident and any breach of unsecured PHI. Timing is in the next section.	164.504(e)(2)(ii)(C), 164.314(a)(2)(i)(C), 164.410
Subcontractors	Every vendor that creates, receives, keeps or sends PHI for us signs a BAA with us first, with the same restrictions and conditions.	164.504(e)(2)(ii)(D), 164.502(e)(1)(ii)
Individual rights	If a patient asks you for access, an amendment or an accounting of disclosures, we give you what we hold so you can answer within your deadline.	164.504(e)(2)(ii)(E) to (G); 164.524, 164.526, 164.528
Your Privacy Rule duties	If you ask us to carry out one of your own Privacy Rule duties, we follow the rule that applies to you when we do it.	164.504(e)(2)(ii)(H)
Books and records	We make our internal practices, books and records on PHI available to HHS to check your compliance.	164.504(e)(2)(ii)(I)
Return or destruction	At the end of the engagement we return or destroy your PHI. Where that is not feasible, the BAA keeps protecting what remains and limits its use to the reason it was kept.	164.504(e)(2)(ii)(J)
Term and termination	The BAA runs while we hold your PHI. You may end it if we violate a material term and do not cure the violation.	164.504(e)(2)(iii), (e)(1)(ii)

Two things our BAA does not allow, because our service never needs them: contacting or billing your patients, and holding your funds. Payer payments go to you.

Incidents and breaches

HIPAA gives a business associate up to 60 calendar days after discovering a breach of unsecured PHI to notify the covered entity, and requires notice without unreasonable delay (45 CFR 164.410). Our standard BAA sets a shorter window: we notify you promptly, and no later than [number] days after discovery [to be confirmed by counsel].

The first notice may come before our investigation ends. We send what we know, then add to it as we learn more.
The notice identifies each affected individual, as far as we can, and gives you the facts you need for your own notices to patients, HHS and, where required, the media.
We report security incidents as the Security Rule requires (45 CFR 164.314(a)(2)(i)(C)). Routine unsuccessful attempts, such as blocked logins and port scans, are reported in summary under the BAA rather than one by one.
Reports go to the contact named in the BAA. Our side is security@revise-medical.com.

Our subcontractors

Every vendor of ours that touches PHI signs a BAA with us before it does, and those BAAs pass down the same restrictions as yours. The vendors that do not touch PHI, including the host of this website and its forms, are kept that way. The current list, with what each one does and whether it sees PHI, is in the trust center. We keep it up to date as vendors change.

Using your own BAA

Many health systems and larger groups have their own BAA form. We will review yours. Tell us in the form that you want to use it, and we reply with an address to send it to. Do not paste it into the form.

We check it covers the elements in the table above and fits how the service works, including disclosures to payers and IDR entities.
Our target is to return comments within [5] business days (to be confirmed). A form that tracks the HIPAA elements usually needs few changes.
A BAA embedded in a larger services agreement takes longer, because the commercial terms need review too.

Terms we review with counsel

Some terms go to our counsel before we agree to them. We do not reject them on sight. We tell you what we can accept and why.

Indemnities without a cap, and liability terms that override the services agreement.
Reporting windows we could not meet as written, such as a fixed number of hours for every suspected incident. We usually propose a fast first notice and a full report after.
Insurance requirements, including minimum cyber coverage [our coverage to be confirmed].
On-site audit rights. We offer our security packet and answer your questionnaire first, with a visit by agreement.
Who pays the cost of notifying patients after a breach.
Choice of law and venue.

One kind of term we cannot sign: any that would allow a use or disclosure of PHI that HIPAA would not allow you to make yourself.

After signing: sending data

Once the BAA is signed, we send a secure upload link. That is the only way claim data reaches us. Do not send remits, EOBs, claim files or patient details by email, fax or through any form on this site. This site collects no PHI and accepts no files.

For the free audit we ask for one month of out-of-network remits (835 files) or an EOB export, plus your payer list. Files are stored encrypted in the United States and used only for the services in the BAA. If you do not go ahead after the audit, we delete them on request and confirm in writing. Details are on the free audit page.

When the engagement ends

When the services end, the BAA directs what happens to your PHI. We return it in a standard export or destroy it, as you choose, and confirm in writing. Where something cannot be returned or destroyed, for example records we must keep by law, the BAA keeps protecting it for as long as we hold it.

Questions

Does the BAA cost anything?

No. The BAA is free, and so is the audit that runs under it. Our fee is 19% of cash collected, and it only applies once you sign a services agreement.

Do we need a services agreement before the free audit?

No. The audit runs under the BAA alone. If you go ahead after the audit, the services agreement comes next and the same BAA stays in place.

Can our counsel read it before we ask for a signature?

Yes. Say so in the form and we send a review copy. Nothing binds either side until both have signed.

Our billing company already has a BAA with us. Do we need another?

If your billing company engages us, it signs a subcontractor BAA with us and your BAA with them stays in place. Check that it allows subcontractors. If you engage us directly, you sign with us.

Is the BAA the same for every client?

The standard terms are the same. The services, the parties and any agreed changes are specific to you.

Other questions about the BAA or our handling of PHI go to privacy@revise-medical.com.

Sources

45 CFR 164.504(e): required elements of a business associate contract.
45 CFR 164.502(e): disclosures to business associates and subcontractors.
45 CFR 164.410: breach notification by a business associate.
45 CFR 164.314: Security Rule requirements for business associate contracts.
HHS: Sample business associate agreement provisions
HHS: Business associates guidance

Revise is not a law firm, and this page is not legal advice. It summarizes our standard BAA, and the signed BAA governs. This page is a draft prepared for review by healthcare regulatory counsel before launch, and the bracketed items will be filled in by that review.