If your practice handles Protected Health Information (PHI), meaning anything that identifies a patient and relates to their health, HIPAA requires a written agreement between you (the covered entity) and FrontDesk (the business associate) before FrontDesk handles that data for you.
How it's accepted
You accept the BAA when you create your FrontDesk account. The sign-up form's checkbox reads "I agree to the BAA, the Terms of Service, and the Privacy Policy", with a link to each. FrontDesk records the version accepted (currently 2.0), who accepted it, their email, the date and the IP address.
There's nothing separate to sign or request, and the BAA is included on every plan at no extra cost.
See the record
- Open Settings → Account and click the Organization tab.
- Find Business Associate Agreement. It shows Signed with the name of the person who accepted it and the date.
- Click View for the receipt, which confirms the agreement was accepted when the account was created and links to View the full Business Associate Agreement.
When the BAA is updated
When we change the BAA, we publish the new version at frontdesk.care/baa and contact the account owner directly about the change. There is nothing to do in the app, and your service is not paused.
The most recent update was version 2.0 on October 4, 2026, which changed the liability section (Section 6). Version 1.0 is kept at frontdesk.care/baa/v1.
The row only appears when your organization's industry is a healthcare type. If you don't see it, your industry isn't marked as healthcare. You can check the Industry field on the same tab.
What the BAA covers
The full text is at frontdesk.care/baa. Among other things, FrontDesk agrees to:
- Use and disclose PHI only to provide the service to you and as the law allows
- Follow HIPAA's "minimum necessary" standard
- Report a breach or other reportable event without unreasonable delay, and no later than 60 days after discovery
- Require any subcontractor that handles PHI to agree in writing to the same restrictions
- Help you respond to patients' requests for access, amendment and an accounting of disclosures
- Return or destroy PHI when the agreement ends, where feasible
- Keep PHI in the United States, on HIPAA-eligible Amazon Web Services infrastructure
What you're still responsible for
A BAA covers FrontDesk's obligations as your vendor. It doesn't make your practice HIPAA-compliant on its own. You still need:
- A notice of privacy practices for patients
- Your own security and access controls, such as a separate login for each team member
- Staff training
- BAAs with your other vendors that handle PHI