Business associate agreements

HealthyRides' position as a business associate, and how agreements are signed.

HealthyRides as a business associate

HealthyRides is a business associate of each facility organization it serves. A provider organization receives PHI from facilities through HealthyRides, and the business associate agreement binds it to the same limits on use and the same safeguards: it uses PHI only to carry out and bill the rides it is awarded (platform/packages/domain/src/agreements/texts/baa-v2.ts; docs/prd/healthyrides-mvp-prd.md).

Signing in the app

An organization's admin signs the business associate agreement and the terms of service in the app, at their first sign-in, for facility and provider organizations alike. Until they do, the organization cannot use HealthyRides, and its other members see a page asking them to wait (docs/decisions/0043-platform-admin-onboards-facilities-and-approves-facility-provider-requests.md).

Only an organization's admin, a facility admin or a provider admin, may sign, because signing binds the organization (platform/packages/auth/src/roles.ts).

A signature records the signer, their name and title, the version of the text they read, the time and the network address it came from (platform/packages/domain/src/agreements/entities.ts).

A published version of the text is never edited. New text is a new version, and an organization is active only while it has signed every current agreement at its current version (platform/packages/domain/src/agreements/entities.ts).

HealthyRides' own organization and demonstration organizations, which hold invented data only, sign nothing (platform/packages/domain/src/agreements/entities.ts; docs/decisions/0040-demo-organizations-are-a-flag-and-a-partition.md).

Version 2 of both agreements is in force (platform/packages/domain/src/agreements/documents.ts).

With HealthyRides' own sub-processors

Every sub-processor that receives PHI must sign a business associate agreement with HealthyRides before it receives any (platform/packages/domain/src/agreements/texts/baa-v2.ts; docs/prd/healthyrides-mvp-prd.md). Today those are Google Cloud and Amazon SES, taken from the services the production configuration switches on (infrastructure/environments/prod/main.tf). See Sub-processors.

Email is sent through Amazon SES in part because Amazon offers a business associate agreement covering it (docs/decisions/0006-aws-ses-transactional-email.md), and Twilio was chosen for text messages in part because it signs one on its eligible plans (docs/decisions/0022-twilio-for-sms.md). See Sub-processors.

Other assurances

HealthyRides holds no third-party certification and no third-party audit report. Its commitments are the business associate agreement's: a breach of unsecured PHI is reported to the facility without unreasonable delay, and within 10 business days of discovery; and within 90 days of the agreement ending, HealthyRides returns or destroys the PHI it holds. Copies that cannot be destroyed sooner, the retention-locked audit archive and database backups up to 30 days old, stay under the agreement's protections until they expire (platform/packages/domain/src/agreements/texts/baa-v2.ts).