Business Associate Agreement
This Business Associate Agreement (“BAA”) is between the covered entity or practice that requests Call Doctor Service (“Covered Entity”) and the operator of Call Doctor Service (“Business Associate”). It is an operational agreement, not a substitute for counsel. Checking the BAA box on the request form is Covered Entity’s acceptance.
Services
Business Associate provides after-hours telephone answering, on-call notification, call bridging, and related records. Protected health information (“PHI”) may include caller audio, patient date of birth, and callback numbers.
Permitted use
Business Associate may use and disclose PHI only to perform the service, as required by law, or as Covered Entity directs in writing. Business Associate will not use PHI for marketing or sell PHI.
Safeguards
Business Associate will use reasonable administrative, physical, and technical safeguards appropriate to the service, including access controls and encrypted transport. Call audio is stored as audio and is not transcribed by this product.
Subcontractors
Business Associate uses subcontractors that may handle PHI to deliver the service, including Twilio (voice and SMS) and Supabase (database and functions). Business Associate is responsible for appropriate downstream agreements with those subcontractors.
Incidents
Business Associate will notify Covered Entity without unreasonable delay after discovering a breach of unsecured PHI of which it becomes aware, and will cooperate on required notices.
Access and termination
Upon Covered Entity’s written request, Business Associate will make PHI in the service available as reasonably feasible for access or amendment. Upon termination, Business Associate will retain or return PHI as required for legal and operational records, then delete or de-identify remaining PHI when retention ends. Cancellation stops live answering; it does not immediately delete historical cases.