Business Associate Agreement

Who this is for

Healthcare practices and other HIPAA covered entities whose website Arclo builds and runs: therapy, psychiatry, primary care, urgent care, dermatology, dental, pediatric therapy and similar practices.

If your business is not a covered entity, you do not need a BAA, and nothing on this page changes your plan.

Included on Run and Grow, at no extra charge

The BAA comes with both plans. There is no add-on, upgrade or fee for it.

We sign it with your practice before your site goes live, so there is never a day when patient inquiries reach Arclo without an agreement in place.

What Arclo handles

Arclo builds and runs your practice website, including the new-patient request form. When someone fills it in, we send the request to the phone number and email you choose and keep it in your Arclo lead inbox so you can follow up and see where new patients came from.

Those requests are the only protected health information Arclo expects to handle, and the form is kept to name, phone, email and preferred time.

What Arclo does not handle

Arclo does not access your EHR, practice-management software, scheduling system, clinical notes or patient records, and never asks for a login to them. Online booking happens in the scheduler you already use, under that vendor's agreement with you.

How we protect it

Every page is served over HTTPS, and form submissions are encrypted in transit. Stored records sit in access-controlled systems, and only the people who need them to run your site can see them.

No advertising pixels go on appointment or contact pages, form contents are never sent to analytics tools, and inquiries are never sold, shared with advertisers or used to train anything.

If something goes wrong

If we discover that protected health information we handle for you was accessed or disclosed in a way the BAA does not allow, we will tell you without unreasonable delay, and within the time HIPAA requires. We will share what happened, what information was involved and what we are doing about it, so you can meet your own notice duties.

The core terms, summarized

• Arclo uses and discloses protected health information only to provide the services in your plan, or as the law requires.
• Arclo keeps reasonable administrative, physical and technical safeguards in place, in line with the HIPAA Security Rule.
• Arclo reports any use or disclosure not allowed by the agreement, including breaches of unsecured information and security incidents.
• Any vendor that handles your protected health information for Arclo must agree to the same restrictions in writing.
• Arclo helps you respond when a patient asks to see, correct or get a record of disclosures of information we hold.
• Arclo makes its practices available to the Department of Health and Human Services if asked, to confirm compliance.
• When your plan ends, Arclo returns or deletes the protected health information it holds for you, or keeps protecting it if returning or deleting it is not possible.
• Either side may end the agreement if the other materially breaks it and does not fix the problem.