HIPAA & Business Associate Agreement
CareVieo operates as a Business Associate when processing Protected Health Information (PHI) on behalf of covered entities and other business associates.
What you get
- Signed BAA included with every paid plan that processes PHI.
- HIPAA-aligned administrative, physical, and technical safeguards.
- Subprocessor BAAs with every vendor that touches PHI (hosting, email, SMS).
- Audit log of PHI access available to agency owners on request.
- Breach notification within the timelines required by the BAA and applicable law.
How to sign a BAA
Your BAA is signed inside CareVieo — no email or paperwork needed. Sign in as an agency owner or admin and go to Agency Settings → Security, where the click-through BAA opens in a dialog. Review the agreement, enter your name, title, and email, confirm you’re authorised to sign, and it’s recorded instantly with a timestamped audit entry and a stored copy of the exact document you accepted.
New agencies see a reminder banner until the BAA is signed, and we’ll prompt you again if we publish a newer version. Enterprise customers who need custom terms can still reach us at trust@carevieo.com.
Sign in to sign your BAA · Create an agency account
Customer responsibilities
HIPAA compliance is a shared responsibility. Customers are responsible for workforce training, minimum-necessary access decisions, patient authorizations, and configuring user roles inside CareVieo. Our Security page describes the controls we provide.
Questions
Contact trust@carevieo.com for our trust packet, subprocessor list, or to walk through a specific control.