Business Associate Agreement

Every pharmacy accepts our Business Associate Agreement (“BAA”) when it signs up, on every plan. This page summarizes it; the full text will be published here once it has been reviewed by our attorney.

What we agree to

• Use and disclose protected health information (PHI) only to provide BubbleTrack to your pharmacy, as the BAA allows, or as the law requires.
• Protect PHI with administrative, physical and technical safeguards that meet the HIPAA Security Rule.
• Report to you any use or disclosure not allowed by the BAA, including breaches of unsecured PHI, without unreasonable delay.
• Make sure our subprocessors that handle PHI agree to the same restrictions.
• Help you respond to patients’ requests to access or amend their information, and make our records available to the U.S. Department of Health and Human Services when required.
• When the agreement ends, return or delete PHI, or keep protecting anything we must retain.

Subprocessors that handle PHI

Amazon Web Services hosts BubbleTrack and processes PHI under its own Business Associate Addendum with us. See the subprocessors page.