Skip to content

Legal

Business Associate Agreement (BAA) Information

Last updated:

Every Vagus customer can sign a Business Associate Agreement before any protected health information enters the platform. Here's what that means and how it works.

What is a BAA?

Under HIPAA, a dental practice or laboratory that is a covered entity must have a Business Associate Agreement with any vendor that creates, receives, maintains or transmits protected health information (PHI) on its behalf. The BAA is the vendor's written promise to safeguard that PHI, use it only as permitted and report problems. Using a vendor that handles PHI without a BAA is itself a HIPAA violation.

Vagus's BAA coverage

Vagus acts as a business associate to our customers. We have signed Business Associate Agreements with these vendors:

  • Amazon Web Services — hosting, encryption key management (AWS KMS), AI document processing (Amazon Textract, Claude on Amazon Bedrock), and speech transcription (Amazon Transcribe, Amazon Translate)
  • Paubox — encrypted email
  • Twilio — SMS notifications
  • Google Workspace — company email and documents

The Business Associate Agreement with Supabase, our PostgreSQL database and authentication provider (US East), is not yet signed. It is signed at pilot onboarding, and production case intake stays closed until it is: no patient data enters Vagus before then.

What our BAA covers

  • Permitted uses and disclosures of PHI — only to provide the platform and as required by law
  • Administrative, physical and technical safeguards required by the HIPAA Security Rule
  • Reporting of security incidents and breach notification for unsecured PHI
  • Flow-down obligations: our subcontractors that handle PHI agree to the same restrictions
  • Support for individuals' rights to access and amend their information, and an accounting of disclosures
  • Return or destruction of PHI when the agreement ends
  • Availability of our practices and records to the U.S. Department of Health and Human Services

How to request a BAA

  1. Send us a BAA request using the contact form below.
  2. We'll send our standard BAA for review, or review your organization's BAA template.
  3. Once both parties sign, it takes effect alongside your service agreement — before any PHI is entered.
Request a BAA