BAA included
Business Associate Agreement
FormRx includes a HIPAA Business Associate Agreement with every subscription — at no extra cost. No enterprise tier required.
Included with Every Plan
Review and electronically sign the Business Associate Agreement during account setup before uploading patient records. There is no additional charge for the agreement.
What Our BAA Covers
- Document Processing: All clinical documents uploaded to FormRx (clinic notes, imaging reports, lab results, forms) are covered under the BAA.
- Storage: PHI is encrypted at rest (AES-256) on AWS infrastructure covered by the AWS BAA.
- Transmission: Clinical document fax transmission uses Documo. Review the recipient and delivery status for each outbound fax.
- AI Processing: Clinical documents are processed through AWS Bedrock. FormRx does not use your clinical data to train models.
- Data Retention: Our retention policy is 30 days for uploaded source PDFs, with structured clinical data retained during an active subscription. Contact us to request export or deletion; the BAA governs return or destruction of PHI.
Our Infrastructure
- Primary application storage is configured in AWS US West (Oregon). AI processing can use a US cross-region Bedrock inference profile.
- AWS infrastructure and Bedrock for clinical document processing
- Encryption at rest (AES-256) and in transit (TLS 1.2+)
- Audit events for document access and changes
- 15-minute session timeout
- Role-based access control
Download BAA Template
Review our standard Business Associate Agreement. This BAA is electronically signed during account setup.
For questions or to discuss specific compliance requirements, contact us:
Aether Practice Solutions Inc.