Business Associate Agreement

Last updated April 19, 2026

What is a BAA?

Under HIPAA, a covered entity (such as a telehealth clinic) must have a written Business Associate Agreement (“BAA”) in place with any service provider that receives, creates, or transmits protected health information (“PHI”) on the covered entity’s behalf.

RxRouter as a Business Associate

RxRouter, Inc. operates as a Business Associate under HIPAA when processing PHI on behalf of covered-entity tenant clinics. A signed BAA is required before any PHI is transmitted through the Platform.

Scope of our BAA

The RxRouter BAA covers all services provided through the Platform, including patient intake storage and processing, clinical workflow tooling (chart review, provider queues), prescription routing to certified e-prescribing partners, data hosting and audit logging, and analytics on de-identified aggregates only.

What our BAA includes

Our standard BAA addresses the required HIPAA provisions including permitted and required uses and disclosures, safeguard obligations, breach-notification procedures, subcontractor flow-down, and termination provisions. Non-standard modifications are handled during enterprise onboarding.

How to execute a BAA

Self-serve tenants accept the BAA during onboarding — acceptance is recorded and is a prerequisite for activation, alongside an active subscription. Tenants who require a countersigned copy or non-standard terms should email compliance@rxrouter.ai; we return the executed copy, typically within two business days.

Production activation

BAA acceptance is a prerequisite for production tenant activation. Sandbox environments use synthetic test data and do not require a BAA.

Subprocessor transparency

A current list of subprocessors used by RxRouter is available on request. We notify tenant compliance contacts of material subprocessor changes at least 30 days before they take effect.

Contact

To request a BAA or ask about our HIPAA posture, email compliance@rxrouter.ai.