Trust Center → Legal

HIPAA Business Associate Agreement.

For senior living, assisted-care, memory-care, and any operator handling Protected Health Information (PHI). Propty is BAA-ready today.

Request BAA to execute →

When you need a BAA

If your operation, such as an assisted living facility, memory care community, or senior-care RV park with medical scheduling, creates, receives, maintains, or transmits PHI (health-related personal information that's individually identifiable), you're a Covered Entity under HIPAA. Propty becomes your Business Associate.

BAA highlights

Permitted uses

Only for services described in the MSA. No secondary use. No marketing without authorization.

Safeguards

HIPAA Security Rule compliance: administrative, physical, technical. AES-256 encryption, MFA-required staff access, audit logging, annual risk assessment.

Subcontractors

All Propty sub-processors that may touch PHI have BAAs in place. Listed at /sub-processors.

Reporting

Security incidents reported within 24 hours. Breaches affecting PHI: notification per § 164.410 with breach assessment, mitigation, and notification assistance.

Access + amendments

Designated record set access provided within 30 days of request. Amendments processed per § 164.526.

Accounting of disclosures

Propty maintains the records required by § 164.528 and provides them within 60 days of request.

Termination

PHI returned or destroyed per § 164.504(e)(2)(ii)(J). Self-service data export via /api/data-export, then 30-day deletion.

Not legal advice. This page summarizes the BAA. The executed BAA controls. Have your counsel review before signing. Questions: hello@getpropty.ai.