HIPAA & Business Associate Agreements

How to request a BAA so your team can store protected health information in RowFold, what the agreement covers, and why it is available on annual plans. What a BAA is, and what it isn't Under HIPAA, a vendor that handles protected health information (PHI) on a covered entity's behalf is a Business Associate, and that relationship is created by a signed contract - the Business Associate Agreement. It commits us to specific obligations: administrative, physical and technical safeguards, breach notification within defined timeframes, and equivalent agreements with any subprocessor that could touch your data. It is worth knowing that HIPAA has no certification. There is no auditor who inspects a product and declares it HIPAA compliant, so any vendor showing you a "HIPAA certificate" is describing something that does not exist. The agreement is the real artefact - which is why RowFold offers one rather than a badge. Requesting one Go to Settings → Compliance and fill in three things: the legal entity name to put on the agreement, the email the paperwork should go to (often legal or privacy rather than you), and optionally a line about what you intend to store so our first reply is useful rather than a questionnaire. We'll email you the agreement to review. Your request and its status stay on that card, so you can always see where it has got to. You're covered when it's signed - not before This is the part that matters most. Requesting a BAA does not create cover, and neither does being on an annual plan. Do not put PHI in RowFold until your agreement is signed by both sides. The Compliance card shows exactly which state you're in - requested, sent for signature, or in place - and only the last one means you may store health data. We'd rather be blunt about this than have you discover it during an audit. Why annual plans A BAA commits us to obligations that outlast a monthly billing cycle, and to a customer relationship we can plan around, so it is offered alongside an annual plan. You can switch from monthly to yearly at any time from Settings → Plan & billing using the Stripe portal, and the option to request a BAA appears as soon as the switch goes through. If the annual commitment is the only thing in the way, email support@rowfold.com and we'll talk it through. What a BAA doesn't change A BAA covers health data. It does not make RowFold suitable for US government data - we hold no FedRAMP authorization, which is granted after third-party assessment with an agency sponsor, and no BAA affects that. Card numbers should also never be stored in RowFold: payment details go to Stripe and never reach us. Our full position on every regime, including SOC 2, ISO 27001 and GDPR, is on the public Compliance page. Tips • Put your registered legal entity name on the request, not your product or workspace name - it's the name that appears on the agreement. • Send the paperwork to your legal or privacy address rather than your own inbox; it usually needs a signature you don't own. Good to know • A requested BAA is not a signed BAA. Storing PHI before the agreement is executed leaves you uncovered, whatever the request card says. • The BAA belongs to the paying account. If your access is covered by a colleague's plan, they have to raise the request from their own settings.