Business Associate Agreement
This Business Associate Agreement ("BAA") is between Divinity, LLC ("Divinity") and the facility whose authorized representative accepts it at sign-up ("Customer"). It takes effect when accepted. It supplements the Terms of Service and governs every resident record that Customer places in Divinity Behavior Tracker. Customer is a Covered Entity, or a Business Associate of the Covered Entities it serves; a contractual label does not establish HIPAA status.
1. Definitions and role
HIPAA means the Health Insurance Portability and Accountability Act, as amended by HITECH, and 45 CFR Parts 160 and 164. Capitalized terms, including Breach, Individual, PHI, Designated Record Set, Required by Law, Security Incident and Unsecured PHI, have their regulatory meanings. PHI is information Divinity creates, receives, maintains or transmits for Customer in the authorized Services. Divinity is Customer's Business Associate or, when Customer is a Business Associate, its downstream Business Associate.
2. Permitted activity
Divinity may use and disclose PHI only to provide the functions listed in Schedule A, follow Customer's lawful instructions, fulfill this BAA, or comply with law. Divinity will apply the minimum-necessary standard where applicable and will not act in a way that would violate the Privacy Rule if done by the Covered Entity, except for the expressly permitted management uses below.
Necessary internal management and legal-responsibility uses are permitted to the extent lawful and within Customer's upstream authority. Related external disclosures are permitted only if Required by Law or after reasonable written assurances that the recipient will protect confidentiality, limit use and redisclosure to the stated purpose or as legally required, and report confidentiality breaches. These assurances do not replace a required subcontractor BAA.
No sale of PHI, advertising, unrelated marketing, independent research, public demonstrations, general AI-model training, cross-customer secondary analytics or other independent reuse is authorized. De-identification and reuse require a separate written agreement specifying a lawful method under 45 CFR 164.514 and an authorized purpose. Removing a name alone is not de-identification. External AI inference requires a separate written agreement naming the service; prompts, outputs, logs and support screenshots remain protected when identifiable.
3. Safeguards and personnel
Divinity will implement appropriate administrative, physical and technical safeguards, comply with 45 CFR Part 164 Subpart C for ePHI, maintain a documented risk analysis and risk-management program, designate a security official, train its workforce, apply appropriate sanctions and retain required compliance evidence. No untested certification is represented.
Access will use authorized individual identities and work-related permissions. Affiliate ownership, friendship, family relationship or employment by another company does not confer access. Divinity will prevent its personnel from impersonating a caregiver, signing for another person, concealing changes or backdating documentation. Support access will be limited, approved and logged. Ordinary development and demonstrations use synthetic data.
4. Incidents and breaches
Divinity will notify Customer without unreasonable delay and no later than 48 calendar hours after discovery of an actual or reasonably suspected impermissible use/disclosure, Breach of Unsecured PHI or Security Incident affecting Customer PHI or the Services. Discovery includes knowledge imputed under 45 CFR 164.410 and what reasonable diligence would reveal. Initial notice is not delayed for confirmation, completed investigation or a final breach determination. Shorter applicable legal or incorporated upstream deadlines control.
Routine unsuccessful scans, blocked malicious traffic and failed logins may be reported through a monthly aggregate summary made available to Customer only when they caused no compromise of confidentiality, integrity or availability and create no reasonable indication of compromise. Suspected account compromise, ransomware, lost PHI devices, wrong-recipient disclosures and material disruption are individually reportable.
Initial notice states available dates, affected systems/data, known or possible affected individuals, containment steps and response contact. Divinity will preserve evidence, investigate, mitigate harmful effects to the extent practicable and promptly supplement all information required by 45 CFR 164.410(c). Reports with PHI use approved secure channels. Customer or its underlying Covered Entity coordinates notices to individuals, HHS and media unless responsibility is lawfully delegated. Divinity will cooperate and meet any independent legal duty. No instruction may postpone a mandatory notice; law-enforcement delays must satisfy applicable law, including 45 CFR 164.412.
5. Subcontractors and upstream restrictions
Before any subcontractor creates, receives, maintains or transmits PHI, Divinity will obtain a written BAA imposing the same applicable restrictions, conditions, safeguards and Security Rule requirements. This includes encrypted no-view hosting, backups, integrations, support and any approved AI service. Divinity will maintain an accurate list of legal entities, exact services, processing/support countries and BAA status.
Current subcontractors are listed in Schedule A. Divinity will give Customer at least 15 calendar days' advance notice by email of a new PHI-handling subcontractor, except for a documented urgent security/continuity need, when notice is prompt. Reasonable privacy/security objections will be evaluated before affected processing where practicable. Divinity will take reasonable steps to cure a known pattern of subcontractor noncompliance or end the violation, and terminate if those efforts fail and termination is feasible. Divinity remains responsible for its own duties.
A Customer acting as a Business Associate will identify upstream restrictions before processing. Divinity will not exercise broader rights than Customer lawfully holds. Any additional flow-down terms must be agreed in writing before affected access.
6. Record rights, facility timelines and oversight
Divinity will make PHI in a Designated Record Set available for access under 45 CFR 164.524; make PHI available for amendment and incorporate directed amendments under 164.526; and maintain/provide necessary information for disclosure accountings under 164.528. Attribution and amendment history are preserved. Assistance is provided within five business days for routine requests, and within 72 hours for a request the facility marks urgent by email to the address in Schedule A. Customer can also export its own records from the app at any time without asking Divinity. Customer remains responsible for any shorter deadline that applies to it under state or federal law, and this assistance period does not replace that obligation.
Direct Individual requests are routed to Customer the same day when practicable and no later than one business day; requests presenting a shorter legal deadline are escalated immediately. Divinity will not independently deny requests unless lawfully delegated. If Divinity carries out a Covered Entity's Privacy Rule duty, it will meet that duty's applicable requirements. Customer remains responsible for undelegated duties.
Divinity will make relevant internal practices, books and records available to the Secretary of HHS as required and provide reasonable compliance evidence and proportionate audit cooperation to Customer without exposing unrelated customer information. Legitimate trade-secret interests will not obstruct regulatory access or lawful patient-record access.
7. Customer responsibilities and special records
Customer will provide only lawfully disclosable information, obtain permissions actually required, communicate relevant privacy-notice limitations, agreed restrictions and revoked/changed permissions, and issue lawful instructions. Customer controls its user identity verification, facility permissions, local devices, authorized sharing and review of documentation. Divinity retains responsibility for its own platform and BAA duties.
Each party will comply with applicable Washington confidentiality requirements, including chapter 70.02 RCW, and 42 CFR Part 2 when applicable. Separately maintained psychotherapy notes, separately maintained SUD counseling notes and Part 2 records are excluded from the Services until a specific written addendum and any necessary consent or QSO agreement are in place. This BAA is not patient consent and does not automatically constitute a QSO agreement. Unexpected receipt remains protected; Divinity will restrict access and determine lawful disposition.
8. Termination and disposition
This BAA starts when accepted and continues while the Services involve PHI or Divinity retains it. Customer may terminate for a material violation by Divinity. A curable violation not requiring immediate action may receive up to 15 calendar days to cure after written notice. Incurable violations, serious continuing risk or failed cure permit immediate termination. Either party may suspend affected processing to the minimum extent necessary to stop unlawful conduct or protect PHI, while arranging safe access and continuity.
Within 30 calendar days after termination, Divinity will securely return affected PHI, including available source responses, notes, attachments, signatures, attribution and relevant audit/amendment information, in the formats in Schedule A; or destroy it at Customer's lawful written direction. Divinity will not delete until Customer's approved retention/preservation and verified transfer plan permits it, will arrange corresponding subcontractor disposition, and will not withhold records or necessary recovery access for payment leverage.
If return/destruction is infeasible, Divinity will document and notify Customer of the specific retained information, necessity, safeguards and disposition date. A lawful hold or technically nonseparable backup may qualify; business convenience does not. Backups cycle out within 60 calendar days unless a longer lawful period is expressly justified and agreed. All protections survive, use/disclosure is limited to the purpose making disposition infeasible, and final disposition occurs when that reason ends. Divinity provides written confirmation on request.
9. General terms
This BAA controls over conflicting commercial PHI terms; law controls all documents. Washington law governs except where federal law preempts it. Amendments require written agreement, including necessary compliance changes; Divinity identifies each version by date and version number and obtains renewed acceptance when a change requires it. Electronic acceptance is binding. Severability applies only if the remainder can operate lawfully. No third-party contractual beneficiary is created and no statutory right is waived. Liability, indemnity, insurance, IP and fees are addressed by the Terms of Service; none excuses a mandatory BAA duty.
Schedule A
Customer and role. The facility named at sign-up, as a Covered Entity or as a Business Associate of the Covered Entities it serves. The facility's authorized representative identifies the facility and accepts this BAA on its behalf.
Permitted functions. Staff check-ins and shift documentation; incident records; client records and profiles; the questions and prompts the app presents for a client; generated notes, signatures and their revision history; reports and exports; facility and user administration; and the support needed to provide those functions. No delegated Privacy Rule duties.
Data categories. Resident identifiers and demographics, care-plan context, observations, staff assistance, outcomes, dates and times, source selections, authored notes and edit history. The records a facility enters in the app are part of its Designated Record Set. Psychotherapy notes, separately maintained SUD counseling notes and 42 CFR Part 2 records are excluded.
PHI-handling subcontractors. Google Cloud (Google LLC): application hosting, database, backups and secret storage, in the United States. Google Identity Platform (Google LLC), under Google's business associate agreement: sign-in. IntakeQ: only where Customer connects its own IntakeQ account, and then only as the source Divinity reads from. Stripe processes billing information only and receives no PHI.
Export formats and retention. Notes export as PDF from the app. A full export of a facility's records is provided on request in a usable electronic format (CSV or JSON). Records are retained for the life of the subscription and for 30 days after it ends, then handled under section 8. Database backups are retained for no more than 60 days.
Divinity contacts. Privacy, incidents and access requests: support@mydivinity.net. Put URGENT in the subject line of an urgent request. Do not attach resident records to email; Divinity provides a secure channel when records must be exchanged.
Customer contacts. The facility owner's email address on the account. Divinity sends incident notices and other notices under this BAA to that address.
Acceptance
Customer accepts this BAA when its authorized representative checks the agreement box at sign-up. Divinity records the document version, the time, the representative's name and role, the facility name, and the address and browser used, and keeps that record for the life of the relationship and as long as the law requires. The representative confirms that they are authorized to bind the facility. Either party can obtain a copy of this version at any time at this address, and Customer can request its acceptance record from support@mydivinity.net.