Privacy responsibilities Vendors
Working with vendors: the agreements you need
When a vendor handles patient information for you, you are still responsible for it. A written agreement is how you hold the vendor to your standard. In the United States it is a business associate agreement. In Canada it is an agent or service-provider agreement, and Québec’s health information act lists terms the contract must include.
What you must do
Know which agreement you need.
The law names the agreement, and the vendor should know it too.
US: a business associate agreement with any vendor that creates, receives, keeps or sends PHI for you. HHS, Business Associates Ontario: your vendors act as your agents under PHIPA, and you remain responsible. PHIPA Under PIPEDA, you stay accountable for information you send a provider for processing. PIPEDA principles
Limit the purpose.
The vendor should use your patients’ information for your work and nothing else.
The agreement names what the vendor may do with the information, and forbids everything else, including training AI.
Require safeguards.
The vendor’s security becomes your security.
Encryption, access controls, sign-in, logging, and where the information is stored. HHS, Sample BAA provisions
Require breach notice to you.
You cannot meet your deadlines if the vendor sits on the news.
The vendor tells you promptly, with the facts you need to notify patients and regulators.
Cover subcontractors.
Information often travels further than the first vendor.
Every subcontractor that touches the information agrees to the same terms.
Plan the end.
Information should not outlive the relationship.
At the end, the vendor returns or destroys the information, and confirms it in writing.
Questions to ask any vendor
Will you sign our agreement before any information moves?
Where exactly is our information stored and processed?
Will you ever use our information to train AI, yours or anyone else’s?
Who at your company can see our patients’ information?
How fast will you tell us about a breach?
Which subcontractors touch our information?
What happens to our information when we leave?
Our answers are on the Trust Center and in our security package.
Why it matters
Vendors now handle much of the information a clinic holds. A good agreement answers in advance the questions you would otherwise ask in a crisis.
Common mistakes
- Clicking through a vendor’s standard terms without reading the privacy sections.
- Signing a BAA with the software company and forgetting the transcription or billing service.
- No exit clause, so information stays with a vendor you no longer use.
How PulseAI helps
- A privacy agreement with every clinic before any data is shared: a BAA for US clinics, a PHIPA or Québec agreement for Canadian ones.
- We use it only to do the work your clinic asks for. We never sell it, share it, or use it for anything else.
- Patient data is never training data, for any model, ours or anyone else’s.
See how we protect your data on the Trust Center.
Questions, answered
What is a business associate agreement?
A contract HIPAA requires between a covered entity and a vendor that handles protected health information for it. It limits how the vendor uses the information and requires safeguards and breach notice.
Do Canadian clinics need a BAA?
BAA is a US term. Canadian clinics need an agent or service-provider agreement that does the same job, and Québec’s health information act lists terms the contract must include.
Where do I find PulseAI's answers to these questions?
On our Trust Center, and in our security package, which we send to your privacy officer on request.
Your next step
Give every patient a clear privacy statement, and keep their acknowledgement on file.
Comparing vendors? Request our security package.
This page explains common obligations in plain language. It isn’t legal advice. Check with your privacy officer or lawyer for your situation.
Official sources
Your privacy responsibilities: the other pages
- OntarioDuties of a health information custodian.
- QuébecLaw 25 and the health information act.
- Rest of CanadaPIPEDA and provincial health acts.
- United StatesDuties of a covered entity.
- Using AI with patient dataFive plain rules.
- If something goes wrongBreach basics, and who to tell.
- Patient privacy templatesFree statements and acknowledgements.
How we protect your patients’ information is on our Trust Center.