Business Associate Agreement
Last updated July 1, 2026
This Business Associate Agreement (“BAA”) is entered into between gototherapy.app (“Business Associate”) and the practice that accepts it (“Covered Entity”). It governs Protected Health Information (“PHI”) that the Covered Entity provides to, or that is created or received by, the Business Associate in connection with the service. Terms not defined here have the meaning given in HIPAA (45 CFR Parts 160 and 164).
1. Permitted uses and disclosures
Business Associate may use and disclose PHI only to perform the services for the Covered Entity, as permitted by this BAA, or as required by law. Business Associate will not use or disclose PHI in any manner that would violate HIPAA if done by the Covered Entity, and will not sell PHI or use it for marketing.
2. Safeguards
Business Associate will implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of PHI, including encryption of PHI in transit and at rest, role-based access controls, audit logging, and automatic session lock, consistent with the HIPAA Security Rule.
3. Subcontractors
Business Associate will ensure that any subcontractors that create, receive, maintain, or transmit PHI on its behalf agree in writing to the same restrictions and conditions that apply to Business Associate. Business Associate’s infrastructure runs on Amazon Web Services under a HIPAA business associate agreement.
4. Reporting
Business Associate will report to the Covered Entity any use or disclosure of PHI not permitted by this BAA, any security incident, and any breach of unsecured PHI, without unreasonable delay and consistent with 45 CFR 164.410.
5. Access, amendment, and accounting
Business Associate will make PHI available to the Covered Entity as needed to satisfy the Covered Entity’s obligations to provide individuals access to, and amendment of, their PHI, and to provide an accounting of disclosures, under 45 CFR 164.524, 164.526, and 164.528.
6. Return or destruction
On termination, Business Associate will, if feasible, return or destroy all PHI received from or created on behalf of the Covered Entity, or extend the protections of this BAA to any PHI it is not feasible to return or destroy and limit further use to those purposes.
7. Term and termination
This BAA is effective when accepted and continues until all PHI is returned or destroyed. The Covered Entity may terminate if Business Associate materially breaches this BAA and does not cure the breach within a reasonable period.
8. Contact
For a countersigned copy or questions about this BAA, email hello@gototherapy.app.