Skip to content

Ask about a Business Associate Agreement (BAA)

A law firm must not submit protected health information or other specially regulated data to ClaireAI unless the parties have executed a separate written agreement expressly covering that data, such as a Business Associate Agreement (BAA) where applicable. Contact ClaireAI before enabling a workflow that may handle regulated data.

By Cal Stein, Engineering, ClaireAIUpdated 3 min

TL;DR

  • A separately executed agreement is required before a firm submits PHI or other specially regulated data where applicable.
  • Whether a BAA applies depends on the firm's intended workflow and the parties' written agreement.
  • A request, sales discussion, or Help Center article does not itself create a BAA or other regulated-data agreement.
  • Current security and product documentation can be reviewed during sales or implementation.
On this page

When a BAA may be needed

A BAA may be appropriate when a firm plans to submit protected health information and the parties determine that HIPAA applies to the intended service. ClaireAI does not make that determination for the firm. The firm should review its workflow and compliance requirements with qualified counsel before enabling regulated-data processing.

Ask about the applicable agreement

  1. Contact ClaireAI with the firm name, intended workflow, and the regulated-data question to be reviewed.
  2. Review the current product and security documentation as part of the sales or implementation process.
  3. If the parties agree a BAA or other agreement is appropriate, review and execute it before the relevant data is submitted to the Service.
  4. Keep the fully executed agreement with the firm's compliance records.

Author

Cal Stein

Engineering, ClaireAI

Cal works on ClaireAI's integration platform and security documentation.

Need a second pair of eyes?

If this article didn't fully answer your question, our team will. We reply within one business day to every ticket.