HIPAA and BAAs — How this works

We publish our standard BAA text because the people who evaluate one — counsel, privacy officers, compliance teams — should not need a sales call to read it. The process is deliberate, because a BAA is a contract we take on direct legal obligations under, and we are careful about who we sign with: 1. You request an agreement from Settings or by email, telling us the legal entity to be named as Covered Entity and where the paperwork should go. 2. We review the request and come back to you on scope and timing. We decline requests where we do not believe RowFold can lawfully or practically support the intended use. 3. The agreement is sent for signature and executed by authorized signatories of both parties, out of band — there is intentionally no in-app checkbox that "accepts" a BAA. 4. Only once both signatures are in place does the agreement operate. Your account's compliance card will show the request's status at each step, and it will never say "covered" before that point. The version your counsel receives for signature is the operative text; this page may be revised between requests. If the executed copy and this page ever differ, the executed copy governs.