Last updated: August 2026
This Business Associate Agreement ("BAA") is entered into between you ("Covered Entity") and Alfaaz, LLC d/b/a Alcove ("Business Associate"), effective as of the date you accept this agreement.
Terms used but not defined in this BAA have the same meaning as those terms in the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), the Health Information Technology for Economic and Clinical Health Act ("HITECH"), and their implementing regulations (collectively, "HIPAA Rules").
Business Associate agrees to: (a) not use or disclose Protected Health Information ("PHI") other than as permitted or required by this BAA or as required by law; (b) use appropriate safeguards to prevent use or disclosure of PHI other than as provided for by this BAA; (c) report to Covered Entity any use or disclosure of PHI not provided for by this BAA of which it becomes aware; (d) ensure that any subcontractors that create, receive, maintain, or transmit PHI on behalf of Business Associate agree to the same restrictions and conditions; (e) make available PHI in accordance with HIPAA Rights requirements; (f) make its internal practices, books, and records available to the Secretary of HHS for purposes of determining compliance with HIPAA Rules.
Business Associate may use or disclose PHI solely to perform services for Covered Entity as described in the Terms of Service, including: medical transcription, clinical note generation, and electronic health record integration.
Business Associate shall implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of electronic PHI. All PHI is encrypted at rest (AES-256) and in transit (TLS 1.2+). Audio recordings are stored in AWS S3 with server-side encryption. Access is controlled via role-based access control with multi-tenant isolation.
Business Associate shall report to Covered Entity any breach of unsecured PHI within 30 days of discovery. The notification will include the nature of the breach, the types of PHI involved, and steps taken to mitigate harm.
This BAA remains in effect for the duration of the service relationship. Upon termination, Business Associate shall return or destroy all PHI received from Covered Entity, or retained by Business Associate, within 30 days.
Alcove is operated by Alfaaz, LLC. For questions about this BAA, contact legal@alcove.health.