Security & Compliance
Business Associate Agreement
ArkCloud creates, receives and stores protected health information on your behalf, so it is your business associate and a Business Associate Agreement must be signed before any PHI is processed. This page explains what the agreement covers and what to check in ArkCloud's template.
Written for: Compliance officers · Privacy officers · Procurement
What a BAA is
A Business Associate Agreement is the contract HIPAA requires between a covered entity and a vendor that handles its PHI. It limits how the vendor may use and disclose the PHI, requires safeguards, requires the vendor to report breaches and flow the same terms down to its own subcontractors, and covers the return or destruction of PHI at the end of the relationship.
| Field or control | What it means |
|---|---|
| Permitted uses and disclosures | Only to provide the services, for the vendor's own management where allowed, and as required by law. |
| Safeguards | Comply with the Security Rule for electronic PHI. |
| Reporting | Report uses or disclosures not permitted by the agreement, including breaches of unsecured PHI. |
| Subcontractors | Obtain the same commitments from any subcontractor that handles the PHI. |
| Individual rights | Support access, amendment and accounting of disclosures. |
| Books and records | Make them available to HHS. |
| Termination | Return or destroy PHI, or extend the protections where that is infeasible. |
ArkCloud's template
ArkCloud has a BAA template. On 1 October 2026 its description of safeguards was corrected to match the system as it runs. Several of its contractual terms were written before ArkCloud had procedures to meet them, and are being reviewed with counsel.
The security pages in this section describe each safeguard as it is today. Use them, not the template alone, to decide whether the terms are ones ArkCloud can meet for you.
Requesting a BAA
- Email [email protected] for the current template, or send your organisation's own BAA for review.
- Agree any changes, in particular the terms listed above.
- Sign before any PHI is loaded into ArkCloud.
BAA and service agreement
The BAA covers PHI. Scope, pricing, support and liability sit in the service agreement. ArkCloud does not offer an uptime or availability commitment; availability terms, if any, are agreed per contract.