> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lumisreach.com/llms.txt
> Use this file to discover all available pages before exploring further.

# HIPAA Business Associate Agreement

> Business Associate Agreement for healthcare organizations. Handle protected health information compliantly.

For healthcare organizations handling Protected Health Information (PHI), LumisReach offers a Business Associate Agreement to ensure HIPAA compliance.

***

## What it does

* **Legal coverage** - BAA establishes compliant data handling
* **PHI protection** - Appropriate safeguards for health information
* **Audit support** - Documentation for compliance audits
* **Peace of mind** - Clear responsibilities and protections

***

## Who needs this

A BAA is required if you:

* **Are a healthcare provider** - Doctors, dentists, therapists, clinics
* **Handle PHI** - Patient names, conditions, appointments
* **Transmit health info** - Via calls, texts, or emails
* **Are a business associate** - Handle PHI for covered entities

***

## What's covered

The BAA covers LumisReach's handling of:

| Data type             | Examples                        |
| --------------------- | ------------------------------- |
| Patient identifiers   | Names, phone numbers, addresses |
| Health information    | Conditions mentioned in calls   |
| Appointment data      | Medical appointments, providers |
| Communication records | Call transcripts, voicemails    |

***

## How to get a BAA

<Steps>
  <Step title="Email support">
    Email [support@lumisreach.com](mailto:support@lumisreach.com) with subject "HIPAA BAA Request". Include your legal entity name, the workspace that will handle PHI, and a primary compliance contact.
  </Step>

  <Step title="Verify eligibility">
    Confirm you're a covered entity or business associate
  </Step>

  <Step title="Review agreement">
    We send our standard BAA within 2 business days. Customers who can sign as-is get same-day activation; legal markup typically closes in 5–10 business days.
  </Step>

  <Step title="Execute agreement">
    Sign electronically and receive countersigned copy
  </Step>

  <Step title="Enable HIPAA mode">
    We record `baaSignedAt` on your workspace and flip `hipaa_enabled = true`. Runtime controls activate immediately.
  </Step>
</Steps>

***

## HIPAA mode features

When BAA is active, LumisReach enables:

* **Enhanced encryption** - Additional data protection
* **Restricted access** - Tighter access controls
* **Audit logging** - Detailed access logs
* **Data retention controls** - Configurable retention policies
* **Secure transmission** - PHI-appropriate communication channels

***

## Compliance responsibilities

### LumisReach responsibilities

* Secure data storage and transmission
* Access controls and authentication
* Breach notification
* Subcontractor agreements

### Your responsibilities

* Authorized use of LumisReach
* User access management
* Minimum necessary data sharing
* Patient authorization when required

***

## Pricing

HIPAA compliance and BAA provisioning are **included on the Outreach plan and above** at no extra cost. No add-on fee, no setup fee.

### Platform-wide HIPAA for channel partners

If you're a partner placing healthcare customers on LumisReach at consistent volume, we offer a **platform-wide HIPAA posture at \$5,000/month**. The per-workspace add-on is waived, every account becomes HIPAA-compatible by default, and we sign BAAs with your downstream customers individually as they need them.

Every account becomes HIPAA-compatible by default regardless of plan tier. Email [support@lumisreach.com](mailto:support@lumisreach.com) to scope it.

***

## Requirements

* Outreach LumisReach plan or higher
* Signed BAA before handling PHI
* HIPAA training for your staff
* Compliance policies in place

***

## FAQ

<AccordionGroup>
  <Accordion title="Do I need a BAA for non-healthcare use?">
    No. BAAs are only required when handling PHI. General business use doesn't require one.
  </Accordion>

  <Accordion title="Can I use LumisReach for patient reminders?">
    Yes, with an active BAA. LumisReach can send appointment reminders that include patient information.
  </Accordion>

  <Accordion title="What if there's a breach?">
    LumisReach will notify you within 24 hours of discovering any potential breach, as required by the BAA.
  </Accordion>

  <Accordion title="Does this cover telehealth?">
    The BAA covers call handling and scheduling. For video visits, ensure your telehealth platform is also compliant.
  </Accordion>
</AccordionGroup>

***

<Card title="Request BAA" icon="shield-halved" href="mailto:support@lumisreach.com?subject=HIPAA%20BAA%20Request">
  Email [support@lumisreach.com](mailto:support@lumisreach.com) to get started
</Card>