HIPAA and the Business Associate Agreement

This page summarises, and does not replace, the published Business Associate Agreement, Terms of Service and privacy policy for practices in the United States. Practices in the EU work under the GDPR instead; see GDPR.

Who is responsible for what

The practice is the covered entity, or a business associate of one, and Salisan, Inc. is its business associate (BAA section 2.1). The BAA covers protected health information that Salisan creates, receives, maintains or transmits for the practice. Account, sign-in and billing details are not protected health information; the US privacy policy covers them (section 2.3).

Salisan uses and discloses protected health information only to provide, secure and support the service, for its own management and administration, and as the law requires. It does not sell it or use it for marketing (sections 3.1, 3.2 and 3.7).

The Business Associate Agreement

An owner accepts the BAA with the Terms in the app, before the practice enters patient data. Acceptance in the app is the practice's electronic signature. For a copy signed by both parties, send the signature form at the end of the BAA to legal@salisan.com. If acceptance of a required document is overdue, the practice can still read and export its data, but new patient work pauses until an owner accepts.

The BAA is version 2026-11-06. Delaware law governs it, except where the HIPAA Rules apply (section 16.6). See how versions work.

Where data is stored

Salisan stores protected health information in the United States (section 4.3), in AWS us-east-1, Northern Virginia, in an AWS account used only for the US service. Backups expire within 35 days. See Data location.

Subcontractors and AI

The subcontractor list names the two subcontractors that receive protected health information, each under a business associate agreement:

• Amazon Web Services, Inc.: hosting in us-east-1, including the database, file storage, email, translation, speech-to-text with Amazon Transcribe, web research that receives only de-identified questions, logging and backups.
• Fireworks.ai, Inc.: the AI models. Requests are processed with zero data retention and are not stored.

Salisan's AI providers do not use protected health information to train or improve their models (section 6.1). Owners get at least 15 days' notice before a new subcontractor receives protected health information, and the practice can terminate before it does (section 6.2). How the AI works lists what each feature sends.

Breach notice

Salisan notifies the practice's owners by email of a breach of unsecured protected health information without unreasonable delay, and within 30 calendar days of discovering it, with the information that 45 CFR 164.410(c) requires as far as it is known (section 5.2). The practice decides whether and how to notify patients, the Secretary and the media; Salisan helps contain and investigate (section 5.5).

Patients' rights

Patients ask their practice for access, amendment or an accounting of disclosures. If a patient writes to Salisan, Salisan forwards the request to the practice within 10 business days (section 7.3).

• Access and amendment. Export the patient's record, and correct or add to entries while their history stays visible. See Patient rights. If you cannot do something in the app, Salisan does it on your written request within 15 business days (section 7.1).
• Accounting of disclosures. Export the record with the access log. For a US practice the export also contains an accounting of disclosures for the last six years, which leaves out treatment, payment, health care operations and disclosures to the patient, as 45 CFR 164.528 allows. Salisan gives you its own accountable disclosures within 15 business days of a written request (section 7.2).

Your duties

The BAA leaves these to the practice (section 8):

• Tell Salisan about limits in your Notice of Privacy Practices and restrictions you agreed to, where they affect Salisan's use of the information.
• Get any authorization, consent or notice the law requires, including under state laws that protect mental health, HIV, reproductive health and substance use disorder records.
• Use roles, care-team access and AI exclusion to protect information that needs more protection, and tell Salisan in writing before you add records subject to 42 CFR Part 2.

Contact

Send questions about the BAA to legal@salisan.com, and privacy requests about your own account to privacy@salisan.com. Salisan replies to those within 45 days.