HIPAA & Business Associate Agreements — You're covered when it's signed - not before

This is the part that matters most. Requesting a BAA does not create cover, and neither does being on an annual plan. Do not put PHI in RowFold until your agreement is signed by both sides. The Compliance card shows exactly which state you're in - requested, sent for signature, or in place - and only the last one means you may store health data. We'd rather be blunt about this than have you discover it during an audit.