Business Associate Agreement

Pharity is a HIPAA Business Associate to every clinic on the platform. The BAA between Pharity and a clinic (the Covered Entity) governs how Protected Health Information (PHI) is created, received, maintained, or transmitted on the clinic's behalf.

Pharmacies sign their own BAA with Pharity. A pharmacy receives PHI to fill the prescriptions routed to it, on its own account, and that agreement binds it to protect the PHI on terms at least as restrictive as those Pharity owes the clinic.

• Pharity uses PHI only as permitted by HIPAA and the executed agreement, to operate the platform on your behalf, not for any other purpose
• Pharity implements administrative, physical, and technical safeguards per HIPAA Security Rule §164.308–.312
• PHI is encrypted at rest by the database host's storage encryption (Google Cloud SQL) and in transit over TLS, including email
• Append-only audit log via Postgres trigger, UPDATE and DELETE on audit_logs are rejected at the database level
• Audit records retained six years under the executed BAA, matching the documentation-retention period of 45 CFR §164.316(b)(2)(i) — HIPAA sets no retention period for the audit log itself, so this is Pharity's commitment rather than a regulatory floor
• Pharity notifies a clinic of any breach of unsecured PHI without unreasonable delay and within 60 days of discovery (HIPAA §164.410), and a pharmacy within 30 days
• Pharity will not subcontract PHI handling to any vendor without a written BAA in place (subprocessors listed below)
• On termination, Pharity returns or destroys PHI where feasible. Records that cannot be, such as the append-only audit log, stay protected under the BAA for as long as Pharity keeps them

Pharity discloses PHI to a subprocessor only under a signed BAA. Each subprocessor below is under one.

• Google Cloud: application hosting (Cloud Run) and database (Cloud SQL). BAA accepted September 26, 2026
• Amazon Web Services: email delivery (SES) and the audit-log archive (S3). BAA in effect since August 31, 2026
• BoldSign: e-signature for onboarding agreements. BAA signed September 23, 2026

A telehealth video provider will be added, under a signed BAA, before telehealth launches.

• Sell, monetize, or aggregate PHI for any purpose
• Share PHI with any party that hasn't signed a BAA
• Use PHI for product analytics or marketing
• Store PHI in payment-processor metadata (Stripe; payment-processing exemption applies)

Once activated, your executed BAA lives in your admin panel under Settings → Compliance (coming with C4). Before that ships, request a copy from admin@pharity.com.