Review Our Standard BAA
Fill in your organization details below and download our standard Business Associate Agreement, prefilled for your legal team's review.
Note: This BAA becomes binding only when signed by both parties. SiteGPT executes BAAs for customers on Enterprise plans as part of enterprise onboarding. Until a BAA is executed for your account, do not submit PHI through SiteGPT. Email bhanu@sitegpt.ai to start the process, or see /hipaa for the current program status.
What is a BAA?
A Business Associate Agreement (BAA) is a contract required by HIPAA between a covered entity (or upstream business associate) and a vendor that creates, receives, maintains, or transmits Protected Health Information (PHI) on its behalf. Without an executed BAA, a HIPAA-regulated organization cannot lawfully share PHI with a vendor.
What Our BAA Covers
- Permitted uses and disclosures of PHI, and minimum necessary
- Clear PHI scoping: PHI lives in end-user conversations, while chatbot training content stays PHI-free
- HIPAA Security Rule safeguards (encryption in transit and at rest, access controls)
- Breach reporting within five business days of discovery, plus security incident reporting
- Subcontractor flow-down: every vendor in the PHI chain operates under its own BAA (see our subprocessor list)
- A commitment that PHI is never used to train AI models
- Individual rights handling: prompt forwarding of access and amendment requests, and accounting of disclosures
- Return or destruction of PHI at termination
How Execution Works
BAAs are executed as part of Enterprise onboarding. The flow is: you request a BAA, we scope your deployment together, your legal team reviews this template, both parties sign, and we then enable HIPAA processing for your account. Only after that should PHI flow through your chatbot. The full status of our HIPAA program is published at /hipaa.
Questions?
Email bhanu@sitegpt.ai with a short note about your organization and use case.