HIPAA & Data Agreements

What every agency signs

Before an agency can work in ABARecords, it completes its profile and its authorized signer signs five agreements, in full, inside the platform: the HIPAA Business Associate Agreement, the Services and Subscription Agreement, the Platform Terms of Use, the Privacy Notice and Data Processing Terms and the PHI Access Attestation. ABARecords countersigns each one. Until all five are executed, the agency's workspace cannot change anything.

Every signature stores the exact text that was signed - with both parties' details and the signer's choices - and its SHA-256 fingerprint, so there is never a question about which words were agreed to. Either party can print the executed agreement at any time.

Every signed agreement is also sealed: the database refuses any change to it, and the seal is signed with ABARecords' server key. Every PDF carries a verification code and a QR code on each page; the code, with the document's security PIN, opens the sealed original to compare it with any copy.

Where the data lives, and who signs with the cloud provider

Each party hosts its systems in a cloud account it owns and signs its own business associate agreement with its cloud provider for that account. The agency's records stay in the agency's own database, in the agency's own account, under the agency's own agreement with that provider - for Amazon Web Services, the AWS Business Associate Addendum accepted in AWS Artifact. ABARecords' account runs the platform and the application servers that read and write the agency's database for the agency, under ABARecords' own AWS Business Associate Addendum. Exhibit A of every Business Associate Agreement states, on the day it is signed, whether ABARecords has accepted it.

Source code is kept on GitHub, and GitHub receives source code only: no PHI, no agency data, no keys, passwords or secrets, and no way to reach an agency's systems. Servers fetch released code; nothing in the repository reaches into a server.

Before production starts

Until ABARecords confirms in writing that production has started, no Protected Health Information enters the platform. None.No real client names, dates of birth, insurance identifiers, Social Security numbers, clinical notes, assessment results, or any information tied to a real individual. The Business Associate Agreement prohibits placing PHI in any cloud account before that account's own agreement with its provider covers it, and the Services and Subscription Agreement keeps PHI out until ABARecords confirms in writing that production has started.

This is enforced technically, not just contractually. The API does not start with PHI enabled unless ABARecords' AWS agreement and the required controls are in place. An agency's database is not used until its administrator records the agency's own cloud agreement. And submissions from an agency's website are not stored anywhere until they can be written to the agency's own database: before that, the agency's Business Associate Agreement has to be executed, its database connected and both cloud agreements in place. Until then the website keeps them.

What the Business Associate Agreement provides (summary)

PHI is used only to provide the services the agency selects; never sold, never used for marketing, never used to train or evaluate AI models, and never disclosed to another agency. ABARecords personnel have no standing access: they see agency data only under a time-limited access grant from the agency. Safeguards follow the HIPAA Security Rule, with encryption in transit and at rest, multi-factor authentication and audit logs. A breach of unsecured PHI is reported within 10 calendar days of discovery, any improper use or successful security incident within 3 business days, and ransomware or an outage within 24 hours. Subcontractors are bound in writing to the same terms. On termination, PHI is returned or destroyed, with up to 90 days of help to move to another provider. The agreement follows the HHS sample business associate agreement provisions (45 CFR 164.504(e)).

For your counsel

The full text of every agreement is shown to the agency's authorized signer before signing, and a paper copy is available on request. A signature in the platform is binding: if your counsel needs to review the agreements, do that before your authorized signer signs.