Parapho

Business Associate Agreement

Version 2026-10-30

This Business Associate Agreement ("BAA") is between Megurp Inc ("Parapho" or "Business Associate") and the customer named in the execution record ("Customer"). Customer is a covered entity, or a business associate of one, under HIPAA. If Customer is a business associate, Parapho is its subcontractor, and references to "Covered Entity" below mean Customer in that capacity.

This BAA supplements the Terms of Service. It applies only to Protected Health Information in a HIPAA Workspace: a Parapho workspace on an eligible plan for which an owner has accepted this BAA in the application and HIPAA mode is on.

How this BAA is signed. A workspace owner opens Settings & API → HIPAA & BAA on the Team plan, enters the Covered Entity's legal name and their title, confirms their authority, and re-verifies with their authenticator app. Parapho records who accepted, when, from which IP address and device, and which version, and turns HIPAA mode on immediately. Owners and admins can view and print the executed copy at any time.

1. Definitions

  1. Capitalized terms used but not defined here (including Breach, Data Aggregation, Designated Record Set, Disclosure, Health Care Operations, Individual, Minimum Necessary, Required by Law, Secretary, Security Incident, Subcontractor, Unsecured Protected Health Information and Use) have the meanings given in the HIPAA Rules.
  2. HIPAA Rules: the Privacy, Security, Breach Notification and Enforcement Rules at 45 C.F.R. Parts 160 and 164, as amended, including by the HITECH Act.
  3. Protected Health Information or PHI: protected health information, as defined at 45 C.F.R. § 160.103, that Parapho creates, receives, maintains or transmits on behalf of Customer in a HIPAA Workspace. It includes electronic PHI.
  4. Services: the Parapho service as described in the Terms of Service.

2. Permitted uses and disclosures

  1. Parapho may use and disclose PHI only to provide the Services to Customer, as permitted by this BAA, or as Required by Law.
  2. Parapho will make reasonable efforts to limit its use and disclosure of, and its requests for, PHI to the Minimum Necessary to accomplish the intended purpose.
  3. Parapho will not use or disclose PHI in a way that would violate Subpart E of 45 C.F.R. Part 164 if done by Customer, except as allowed by section 2.4.
  4. Parapho may use PHI for its proper management and administration or to carry out its legal responsibilities. It may disclose PHI for those purposes only if the disclosure is Required by Law, or if Parapho obtains reasonable assurances from the recipient that the PHI will be held confidentially, used or further disclosed only as Required by Law or for the purpose for which it was disclosed, and that the recipient will tell Parapho of any breach of its confidentiality.
  5. Parapho will not sell PHI, use it for marketing, perform Data Aggregation services, de-identify it for its own purposes, or use it to train machine-learning models.

3. Obligations of Parapho

  1. Safeguards. Parapho will use appropriate administrative, physical and technical safeguards, and comply with Subpart C of 45 C.F.R. Part 164 for electronic PHI, to prevent use or disclosure of PHI other than as this BAA provides. These include the measures in our Security overview and in Schedule 1.
  2. Reporting. Parapho will report to Customer any use or disclosure of PHI not provided for by this BAA, any Security Incident, and any Breach of Unsecured PHI, as required by 45 C.F.R. § 164.410, without unreasonable delay and in no case later than ten (10) business days after discovery. Breach reports will include, to the extent available, the identity of each Individual affected and the other information Customer needs to meet its obligations under 45 C.F.R. § 164.404. Parapho will supplement the report as more information becomes available.
  3. Unsuccessful Security Incidents. The parties agree that this section is notice, and no further notice is required, of the ongoing existence of unsuccessful Security Incidents, such as pings and other broadcast attacks on firewalls, port scans, unsuccessful sign-in attempts, denial-of-service attempts, and any combination of these, as long as none results in unauthorized access to, or use or disclosure of, PHI.
  4. Subcontractors. In line with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2), Parapho will ensure that any Subcontractor that creates, receives, maintains or transmits PHI on its behalf agrees in writing to the same restrictions, conditions and requirements that apply to Parapho. Parapho's Subcontractor for PHI is Amazon Web Services, Inc. (hosting, database, document storage, key management, logging and email delivery through Amazon SES), under the AWS Business Associate Addendum. Parapho's payment processor (Stripe) receives billing information only, never PHI. Parapho does not send email for HIPAA Workspaces through providers that have not signed a business associate agreement.
  5. Access. Owners and admins of a HIPAA Workspace can download any document, sealed copy and attachment in it at any time. If Customer needs Parapho's help to provide an Individual with access under 45 C.F.R. § 164.524, Parapho will make the PHI available to Customer within fifteen (15) business days of Customer's written request.
  6. Amendment. Sealed documents are tamper-evident records and are not edited after completion. Within fifteen (15) business days of Customer's written request, Parapho will help Customer make amendments under 45 C.F.R. § 164.526, for example by Customer sending a new or corrected document.
  7. Accounting of disclosures. Parapho will document disclosures of PHI, and provide the information Customer needs to respond to a request for an accounting under 45 C.F.R. § 164.528 within fifteen (15) business days of Customer's written request. The HIPAA Workspace's access log records each time a workspace member, API key or signer opens, downloads or deletes a document.
  8. Customer's obligations. To the extent Parapho carries out any of Customer's obligations under Subpart E of 45 C.F.R. Part 164, Parapho will comply with the requirements of Subpart E that apply to Customer in performing them.
  9. Books and records. Parapho will make its internal practices, books and records relating to PHI available to the Secretary to determine compliance with the HIPAA Rules.
  10. Mitigation. Parapho will mitigate, to the extent practicable, any harmful effect known to it of a use or disclosure of PHI in violation of this BAA.
  11. Workforce. Parapho's workforce receives security training, is bound by confidentiality, and does not access PHI except as needed to provide or support the Services or as Required by Law. Parapho's operator console does not display document contents, field values, signatures, recipients, or the titles of envelopes and templates in HIPAA Workspaces.

4. Obligations of Customer

  1. Where PHI may go. Customer will put PHI only in documents, templates, envelopes, field values, attachments, recipient details and envelope metadata in a HIPAA Workspace. Customer will not put PHI in workspace names, email sender names, user names, API key names, webhook or embedding URLs, billing details, or support requests. Those appear in emails or are handled outside the safeguards in this BAA.
  2. Destinations Customer controls. Data that Customer directs Parapho to send to Customer's own systems, such as webhook endpoints, embedding applications or API clients, leaves Parapho's custody at Customer's direction. Customer is responsible for safeguarding it there.
  3. Recipients and access. Customer is responsible for sending documents to the correct recipients, using access codes where appropriate, managing who belongs to its workspace, and removing people who no longer need access. Every workspace member must use two-factor authentication.
  4. Notices and restrictions. Customer will tell Parapho of any limitation in its notice of privacy practices, any change in or revocation of an Individual's permission, and any restriction it has agreed to under 45 C.F.R. § 164.522, to the extent it may affect Parapho's use or disclosure of PHI.
  5. Permissible requests. Customer will not ask Parapho to use or disclose PHI in any way that would not be permitted under the HIPAA Rules if done by Customer.

5. Term and termination

  1. Term. This BAA takes effect when it is accepted in the application. It continues until the Terms of Service end, or until this BAA is terminated under this section.
  2. Termination for cause. If either party determines that the other has materially breached this BAA, it may terminate this BAA and the affected Services if the breach is not cured within thirty (30) days of written notice.
  3. Termination by Customer. Customer may terminate this BAA by written notice to privacy@parapho.com. Because HIPAA mode protects PHI already in the workspace, it cannot be turned off in the application. Parapho turns it off only after recording the termination, once the PHI has been returned or destroyed under section 5.4.
  4. Return or destruction. When this BAA ends, Customer may download its documents, sealed copies, attachments and access log. Parapho will then destroy all PHI it holds: from production systems within thirty (30) days of Customer's request or of the end of the Services, and from encrypted backups when they expire, within a further thirty-five (35) days. Parapho will keep no copies, except where return or destruction is infeasible, for example because the law requires retention. In that case Parapho will extend the protections of this BAA to that PHI, and limit further uses and disclosures to the purposes that make return or destruction infeasible, for as long as it keeps the PHI.
  5. Survival. Sections 5.4 and 6, and Parapho's obligations for any PHI it keeps, survive termination.

6. General

  1. Regulatory references. A reference to a section of the HIPAA Rules means that section as in effect or as amended.
  2. Amendment. The parties will amend this BAA as necessary to comply with changes in the HIPAA Rules. Parapho will publish updated versions here with at least thirty (30) days' notice to the owners of HIPAA Workspaces, unless a shorter period is required by law.
  3. Interpretation. Any ambiguity in this BAA will be resolved to permit compliance with the HIPAA Rules. If this BAA conflicts with the Terms of Service on the treatment of PHI, this BAA prevails.
  4. No third-party beneficiaries. Nothing in this BAA gives any rights or remedies to anyone other than the parties and their permitted successors.
  5. Liability. Each party's liability under this BAA is subject to the limitations and exclusions of liability in the Terms of Service, except where those limitations are prohibited by law.
  6. Governing law. This BAA is governed by the same law as the Terms of Service, except to the extent federal law, including HIPAA, applies.

Schedule 1: HIPAA mode safeguards

In addition to the controls that apply to every workspace (mandatory two-factor authentication, database row-level security between workspaces, AES-256 encryption at rest with AWS KMS and TLS in transit, hashed single-use signing links, and tamper-evident sealing), a HIPAA Workspace has these safeguards. They stay on even if the workspace changes plan.