BAA-2026-0001
HIPAA BAA Addendum Path
This path applies only when an organisation is a HIPAA covered entity or business associate and Mindful Message or FoxTech creates, receives, maintains, or transmits PHI/ePHI on that organisation's behalf.
Effective 2026-05-29. Review by 2026-08-29.
When It Applies
The addendum is used for HIPAA-required organisations. It is not used for non-covered customers merely because the platform applies HIPAA-style safeguards.
Required Terms
The BAA path covers permitted PHI uses and disclosures, safeguards for ePHI, incident and breach reporting, equivalent subcontractor restrictions, access, amendment, disclosure accounting, HHS access, termination for cause, and return or destruction at termination where feasible.
Organisation Role Schedule
Each US organisation has a recorded HIPAA role where HIPAA applies: covered entity, business associate, subcontractor business associate, or not applicable. The schedule also records the AMM, FoxTech, Google Cloud, WorkOS, Resend, notice, rights, and breach notice positions for that organisation.