Legal

Business Associate Agreement

Last updated: August 13, 2026

When ClinicZora creates, receives, maintains, or transmits Protected Health Information (PHI) on behalf of a covered entity or business associate customer, federal HIPAA rules require a Business Associate Agreement (“BAA”).

ClinicZora Solutions LLC offers a BAA on every paid plan at no additional fee. This page summarizes what that means. The signed BAA between ClinicZora and your organization is the controlling legal document.

Request a BAA

1. When a BAA is required

If you are a HIPAA covered entity (or a business associate) and will use ClinicZora to process PHI, a BAA must be in place before PHI is stored or transmitted in the Services. Marketing-site demo requests that do not include PHI do not require a BAA.

2. What our BAA typically addresses

Our standard BAA is designed to address HIPAA requirements, including:

Permitted and required uses and disclosures of PHI
Obligation to use appropriate safeguards for electronic PHI
Reporting of unauthorized uses, disclosures, and security incidents
Flow-down obligations to subcontractors that handle PHI
Support for access, amendment, and accounting of disclosures where applicable
Return or destruction of PHI upon termination, where feasible
Availability of relevant practices for HIPAA-related assessments

3. Shared responsibility

ClinicZora provides the platform, infrastructure safeguards, and contractual BAA commitments described in the signed agreement.
Your organization remains responsible for workforce training, minimum-necessary access, patient rights workflows, clinical decision-making, and configuring the product for your compliance program.

4. HIPAA-aligned, not certified

No organization is “HIPAA-certified.” ClinicZora designs HIPAA-aligned workflows and signs BAAs with eligible customers. See our Security page for a plain-language overview of controls.

5. How to request a BAA

During onboarding for a paid plan, or anytime by contacting us, we will provide our standard BAA for signature (or acknowledge the in-product BAA workflow where enabled). Custom BAA redlines may be available for enterprise agreements.

Contact: legal@cliniczora.com or book a compliance / BAA conversation.