If your practice handles Protected Health Information (PHI) — names, phone numbers, appointment details, medical questions, anything that identifies a patient and relates to their health — HIPAA requires a written agreement between you (covered entity) and us (business associate) before we can lawfully process that data on your behalf.
FrontDesk's BAA is the standard template you'd see from any HIPAA-compliant vendor, with our specific commitments around breach notification, subprocessors, and audit rights.
Where to sign
Settings → Organization → HIPAA Compliance tab.
This tab only appears for organizations whose business type is flagged as healthcare in our database (dental, medical, mental health, optometry, dermatology, chiropractic, veterinary, etc.). If you don't see it, your business type is non-healthcare and a BAA isn't required — see the FAQ above.
How to sign
- Open Settings → Organization → HIPAA Compliance.
- Read the BAA (the current version is BAA v1.0). You can also download the PDF for offline review or legal sign-off.
- Scroll to the bottom and type your full legal name in the signature field.
- Check the box confirming you have authority to sign on behalf of your organization.
- Click Accept & Sign.
We record:
- The accepted version of the BAA
- Your name and email
- Your IP address
- The timestamp in UTC
Both sides retain a PDF copy. You can re-download anytime from the same page.
What the BAA covers
- We will only use PHI to provide the FrontDesk service to you
- We won't sell, share, or use PHI for our own marketing
- Breach notification within 30 days of discovery
- A current list of our subprocessors (Twilio for telephony, OpenAI/Anthropic for AI processing, AWS for infrastructure) — each has signed their own BAA with us
- Your right to request an accounting of PHI disclosures
- Return or destruction of PHI on contract termination
What you're still responsible for
A BAA covers FrontDesk's obligations as your vendor — it doesn't make your practice HIPAA-compliant by itself. You still need:
- A privacy notice to patients
- Internal security and access controls
- Employee training
- Your own BAAs with other vendors handling PHI