What is a BAA, and do I need one?
A Business Associate Agreement (BAA) is required under HIPAA whenever a vendor creates, receives, maintains, or transmits Protected Health Information (PHI) on behalf of a covered entity. If you are a clinician, group practice, or organization handling patient data and you store provider or patient-related information in Tachova, you should have a BAA in place with us.
How to request a BAA
Email compliance@tachova.com from your account email with the practice name and authorized signer. We countersign within two business days. BAAs are included at no additional cost on all Basic and Professional plans.
Scope of our role
Tachova acts as a business associate when handling PHI on your behalf inside the platform. We do not access, sell, or share PHI for our own purposes, and we do not use PHI to train models.
Subprocessors
We use a small set of vetted subprocessors for cloud hosting, payments, identity, and email delivery. Where any subprocessor may touch PHI, a BAA or equivalent safeguard is in place. A current list is available on request.
Security practices
Encryption in transit and at rest, role-based access controls, row-level security, audit logging, principle of least privilege for staff, secrets management, regular dependency review, and an incident response process. See the Security page for details.
Breach notification
In the event of a confirmed breach of unsecured PHI, we will notify affected customers without unreasonable delay and within the timeframes required by HIPAA.
Your responsibilities
You are responsible for: who you invite to your workspace, the accuracy of data you submit, configuring access for staff, and using strong unique passwords with multi-factor authentication where available.