Business Associate Agreement

Draft — not yet reviewed by an attorney. This document describes an actual technical mechanism (recovery-key escrow) that a lawyer familiar with HIPAA should verify is described accurately before any real clinic signs this.

1. Purpose

Covered Entity uses InsightNotes to prepare psychological evaluation reports. This Agreement sets out how InsightNotes protects Protected Health Information ("PHI"), consistent with HIPAA's requirements for a business associate.

2. What InsightNotes does and does not receive

Client records stay on your own computers, encrypted. AI drafting sends only the specific section being drafted — not a client's name, not the rest of the record. Recovery (Section 5) is the one exception.

3–4. Permitted uses and safeguards

InsightNotes uses PHI only to perform AI drafting on Covered Entity's behalf and to maintain the service, with administrative, physical, and technical safeguards including encryption, per-computer revocable credentials, and access controls.

5. Recovery-key escrow — read this section carefully

If every computer belonging to a practice were lost at once, its encrypted records would otherwise be unrecoverable. InsightNotes holds, for every practice, a sealed copy of that practice's encryption key: sealed to a key pair whose private half is held only by InsightNotes' owner, opened only when a practice's own administrator requests recovery and that request is confirmed directly with the practice by phone, and sent only to the computer that asked, sealed to that computer's own key. This exists solely to restore a practice's own access to its own data, never for ordinary access. Covered Entity acknowledges this mechanism as part of accepting this Agreement.

6–9. Subcontractors, breach notification, obligations, and term

InsightNotes requires equivalent protections from any subcontractor that could handle PHI, will notify Covered Entity of a breach without unreasonable delay, and — because client records live on Covered Entity's own computers rather than InsightNotes' — termination does not require returning a copy InsightNotes never held; only the sealed recovery-key copy, deleted on request.

10. Governing law

This Agreement is governed by the laws of the State of Georgia. Any dispute will be brought exclusively in the state or federal courts located in Georgia.

The full document is at docs/legal/baa.md in the InsightNotes repository.