Business Associate Agreement (BAA) Notice

Version 2026.06.09 · Effective June 9, 2026

Under HIPAA, a Covered Entity (a healthcare provider, health plan, or healthcare clearinghouse) must have a written Business Associate Agreement in place before sharing Protected Health Information ("PHI") with a vendor. Epithel offers a standard BAA to every Customer facility before any PHI is processed.

1. When a BAA is required

A signed BAA is required before any of the following occurs in your Epithel workspace:

• Creating a resident record containing identifiable information.
• Uploading a wound photograph of an identifiable person.
• Recording an assessment, care plan, or order tied to an identifiable resident.

2. Summary of the standard BAA

• Epithel will use and disclose PHI only as permitted by the BAA, the Privacy Rule, and the Customer's instructions.
• Epithel will implement administrative, physical, and technical safeguards required by the HIPAA Security Rule (45 CFR Part 164 Subpart C).
• Epithel will report security incidents and breaches of unsecured PHI to the Customer per 45 CFR §164.410.
• Epithel will ensure that sub-contractors handling PHI agree to the same restrictions through written agreements.
• On termination, Epithel will return or destroy PHI per the Customer's instructions, or, where return/destruction is infeasible, extend protections for as long as PHI is retained.
• Epithel will make its books, records, and practices available to the Secretary of HHS for compliance review.
• Epithel will assist the Customer in responding to patient access, amendment, and accounting requests within HIPAA timeframes.

3. How to execute the BAA

In-app (recommended): A platform administrator can sign the BAA on behalf of the facility from /legal/baa/sign. The executed agreement is timestamped, the signer's IP and browser are recorded for audit, and the facility is immediately marked "BAA on file" in the Admin panel.

By email: Email baa@epithelcare.life from a facility administrator address with your facility name and signatory contact. We return a countersigned BAA PDF within 2 business days.

Need to redline the standard BAA? Send tracked changes to the same address. Material changes are routed to counsel.

4. Sub-processor list

Epithel maintains BAAs with sub-processors that handle PHI. The current list and copies of those agreements are available on request.

5. Related documents

• HIPAA Notice of Privacy Practices
• Privacy Policy
• Terms of Service

6. Contact

BAA requests: baa@epithelcare.life · Privacy Officer: privacy@epithelcare.life