Trust Center

HIPAA and the Business Associate Agreement

FrontDeskClinic acts as a Business Associate under HIPAA. A Business Associate Agreement (BAA) is included with every plan at no extra charge — clinics do not need to upgrade or negotiate separately to get one. The BAA governs how we handle protected health information (PHI) and is incorporated into the Terms of Service.

The agreement is presented during signup and takes effect on the date the clinic confirms it. If you would like to read it before creating an account, ask us and we will send it over.

Under that agreement we use, disclose and request only the minimum necessary PHI to perform the service. We do not sell PHI, and we do not use or disclose it for marketing or fundraising except as HIPAA permits and the clinic separately authorizes in writing.

If we become aware of a breach of unsecured PHI, we notify the affected clinic without unreasonable delay and no later than 60 calendar days after discovery, with the information the clinic needs to meet its own notification obligations. Routine unsuccessful security incidents — a port scan, a blocked login attempt — are reported as the agreement requires and do not trigger individual notice.

Subprocessors

We require every subcontractor that creates, receives, maintains or transmits PHI on our behalf to agree in writing to restrictions and conditions at least as protective as those that apply to us under the BAA.

The current list — the services each subprocessor performs, the categories of PHI it handles, and the written protections that apply — is published in the HIPAA Subprocessor Register (register version 2026-08-17.1). A subprocessor is added to that register only after its executed BAA is on file.

How patient data is handled

• We use, disclose and request only the minimum necessary PHI to perform the service, and we do not sell PHI or use it for marketing or fundraising.
• AI features that process PHI run through model providers named in the subprocessor register, each with a Business Associate Agreement on file.
• Card details are entered into Stripe-hosted payment fields. FrontDeskClinic does not receive or store full card numbers.
• We retain information while the account is active or as needed to provide the service. On termination we return or destroy PHI and keep no copies, except where return or destruction is infeasible — in which case the protections of the BAA stay in force for as long as the data is retained.

The Privacy Policy describes the information we collect and the rights individuals can exercise. Where another law requires a longer retention period, we retain only what is required and keep the BAA protections in force.

The security program

Our BAA commits us to administrative, physical and technical safeguards, including encryption of electronic PHI in transit and at rest, access controls that limit PHI to personnel with a need to know, audit logging of PHI access, and workforce training on handling PHI.

The technical realization of those controls — encryption, tenant isolation, audit logging, infrastructure and security headers — is described on the Security page.