Last updated: September 2026
This Business Associate Agreement ("BAA") is entered into between you ("Covered Entity") and Alfaaz, LLC d/b/a Alcove ("Business Associate"), effective as of the date you accept this agreement (the "Effective Date"). Covered Entity and Business Associate are each a "Party" and together the "Parties." This BAA governs Business Associate's creation, receipt, maintenance, and transmission of Protected Health Information on Covered Entity's behalf in connection with the services Business Associate provides to Covered Entity (the "Services").
Capitalized terms used but not otherwise defined in this BAA have the same meaning as those terms in the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), the Health Information Technology for Economic and Clinical Health Act ("HITECH"), and their implementing regulations at 45 CFR Parts 160 and 164 (collectively, the "HIPAA Rules"). Without limiting the foregoing, the following terms have the meanings given to them in the HIPAA Rules: Breach, Covered Entity, Data Aggregation, Designated Record Set, Disclosure, Electronic Protected Health Information ("ePHI"), Health Care Operations, Individual, Minimum Necessary, Protected Health Information ("PHI"), Required by Law, Secretary (the Secretary of the U.S. Department of Health and Human Services or their designee), Security Incident, Subcontractor, Unsecured PHI, and Use. As used here, PHI and ePHI mean only the information Business Associate creates, receives, maintains, or transmits for or on behalf of Covered Entity.
2.1 Services. Business Associate may use or disclose PHI solely to perform the Services for Covered Entity as described in the applicable Terms of Service, which are: recording of patient-encounter audio, generation of clinical documentation (including SOAP notes and related summaries), and integration of that documentation into Covered Entity's electronic health record. Business Associate may not use or disclose PHI in a manner that would violate the HIPAA Rules if done by Covered Entity, except as provided in Section 2.3.
2.2 Required by Law. Business Associate may use or disclose PHI as Required by Law.
2.3 Management and administration. Business Associate may use PHI for its proper management and administration or to carry out its legal responsibilities. Business Associate may disclose PHI for those purposes only if the disclosure is Required by Law, or if Business Associate obtains reasonable written assurances from the person to whom the PHI is disclosed that it will be held confidentially and used or further disclosed only as Required by Law or for the purpose for which it was disclosed, and that the person will notify Business Associate of any breach of confidentiality, all in accordance with 45 CFR §164.504(e)(4).
2.4 Data Aggregation. Business Associate may use PHI to provide Data Aggregation services relating to the Health Care Operations of Covered Entity, as permitted by 45 CFR §164.504(e)(2)(i)(B).
2.5 De-Identification. Business Associate may use PHI to create de-identified information in accordance with 45 CFR §164.514(a)-(b). Information that has been de-identified in conformance with that standard is no longer PHI, and its use or disclosure is not restricted by this BAA or the HIPAA Rules.
This Section describes, in plain terms, how Business Associate handles PHI when it uses artificial intelligence to generate documentation, and how it treats data derived from PHI.
Business Associate agrees to:
Business Associate's current safeguards, which it may update from time to time provided they remain compliant with the standard above, include encryption of PHI at rest and in transit, storage of audio recordings in encrypted cloud storage, and role-based access controls with multi-tenant (per-practice) isolation.
5.1 Impermissible use or disclosure. Business Associate shall report to Covered Entity any use or disclosure of PHI not provided for by this BAA of which it becomes aware, without unreasonable delay.
5.2 Security Incidents. Business Associate shall report to Covered Entity any Security Incident of which it becomes aware, without unreasonable delay. The Parties acknowledge that routine, unsuccessful attempts (such as pings, port scans, and blocked login attempts) occur regularly and need not be reported individually; this Section 5.2 is deemed satisfied as to such unsuccessful attempts by this acknowledgment, and Business Associate will individually report Security Incidents that result in unauthorized access, use, disclosure, modification, or destruction of PHI, or interference with system operations.
5.3 Breach. Business Associate's obligations with respect to a Breach of Unsecured PHI are set out in Section 6.
Business Associate shall notify Covered Entity of any Breach of Unsecured PHI without unreasonable delay and in no event later than sixty (60) calendar days after discovery of the Breach, consistent with 45 CFR §164.410. Business Associate targets faster notification and will use reasonable efforts to notify Covered Entity promptly after discovery; the sixty (60) day period is a maximum, not a target. To the extent known at the time and as it becomes available thereafter, the notification shall include:
Business Associate shall supplement the notification with additional information as it becomes available. Notification is provided by the method described in Section 10.
In accordance with 45 CFR §§164.502(e)(1)(ii) and 164.314(a)(2)(iii), Business Associate shall ensure that any Subcontractor that creates, receives, maintains, or transmits PHI on behalf of Business Associate agrees in writing to restrictions and conditions on the PHI that are at least as protective as those that apply to Business Associate under this BAA, including the applicable requirements of the HIPAA Security Rule with respect to ePHI.
To the extent Business Associate maintains PHI in a Designated Record Set, Business Associate shall:
To the extent Business Associate has agreed to carry out any of Covered Entity's obligations under these sections, it shall carry them out in compliance with the applicable requirements that apply to Covered Entity.
Business Associate shall make its internal practices, books, and records relating to the use and disclosure of PHI available to the Secretary for purposes of determining Covered Entity's or Business Associate's compliance with the HIPAA Rules.
10.1 Term. This BAA is effective as of the Effective Date and remains in effect until all PHI is returned or destroyed as provided in Section 10.3, or until terminated as provided in Section 10.2.
10.2 Termination for cause. Covered Entity may terminate this BAA and the underlying Services if Business Associate materially breaches this BAA and fails to cure the breach within thirty (30) days after written notice of the breach, or immediately if cure is not possible.
10.3 Effect of termination. Upon termination of this BAA, Business Associate shall, if feasible, return or destroy all PHI it maintains in any form and retain no copies, within a reasonable period and no later than thirty (30) days. If return or destruction of any PHI is infeasible, Business Associate shall extend the protections of this BAA to that PHI, limit further use or disclosure of that PHI to those purposes that make return or destruction infeasible (for example, retention in secure encrypted backups or in immutable audit logs required by law), and make no further use or disclosure of that PHI except as required for those purposes, for so long as Business Associate retains it.
10.4 Survival. The obligations of Business Associate under this Section 10 and under Sections 4, 5, and 6 survive termination of this BAA with respect to any PHI that Business Associate retains.
11.1 Amendment to comply with law. The Parties agree to take such action as is necessary to amend this BAA from time to time as is necessary for the Parties to comply with the requirements of the HIPAA Rules. Any amendment to the HIPAA Rules that alters a Party's obligations is incorporated into this BAA as of the effective date of that regulatory change.
11.2 No third-party beneficiaries. Nothing in this BAA confers, or is intended to confer, any rights or remedies upon any person other than the Parties and their respective successors and permitted assigns.
11.3 Interpretation and order of precedence. Any ambiguity in this BAA shall be resolved to permit the Parties to comply with the HIPAA Rules. In the event of a conflict between this BAA and the Terms of Service or any other agreement between the Parties regarding the treatment of PHI, this BAA controls.
11.4 Governing law. This BAA is governed by the laws of the State of Virginia, without regard to its conflict-of-laws principles, except to the extent preempted by federal law.
11.5 Notices. Breach and Security Incident reports and other legal notices to Covered Entity will be sent to the email address associated with Covered Entity's account. Notices to Business Associate will be sent to legal@alcove.health.
11.6 Acceptance. By accepting this BAA, the individual accepting represents and warrants that he or she is authorized to enter into this BAA on behalf of Covered Entity and to bind Covered Entity to its terms. The Parties agree that acceptance by electronic means, together with Business Associate's record of the acceptance (including the accepting individual's email address, the version of the BAA accepted, and the date and time of acceptance), constitutes a valid and binding signature under the federal E-SIGN Act and applicable state law.
Alcove is operated by Alfaaz, LLC. For questions about this BAA, contact legal@alcove.health.