Business Associate Agreement (BAA)

Note: This page explains our Business Associate Agreements and HIPAA commitments. It is not the BAA itself. The BAA is a separate agreement signed between Divergent Dental Resources, LLC and each covered entity or business associate.

1. What a BAA Is

A Business Associate Agreement is a contract HIPAA requires between a covered entity, such as a dental practice, and a business associate, a service provider that handles protected health information (PHI) on the practice’s behalf. It sets out how the business associate may use PHI, requires appropriate safeguards, and defines each party’s responsibilities.

2. Why It Matters

When your practice uses the Divergent Dental Hub with data that includes or relates to PHI, HIPAA requires a BAA. The BAA:

• Defines how Divergent Dental may use and disclose PHI on your behalf
• Requires us to maintain HIPAA-compliant safeguards
• Sets breach notification obligations and timelines
• Helps your practice meet its own HIPAA obligations by working only with compliant vendors

3. What Our BAA Covers

3.1 Permitted uses and disclosures

We may use or disclose PHI only as needed to provide the Services, as required by law, or as the BAA otherwise permits, and we apply the minimum necessary standard.

3.2 Safeguards

We use administrative, physical, and technical safeguards consistent with the HIPAA Security Rule to prevent unauthorized use or disclosure of PHI.

3.3 Breach notification

We report security incidents and breaches of unsecured PHI to the practice without unreasonable delay, and within the time applicable law requires.

3.4 Subcontractors

Any subcontractor that may access PHI must agree to the same restrictions and conditions that apply to us.

3.5 Termination

When the BAA ends, we return or destroy PHI where feasible, as the BAA provides.

4. Key Security Measures

Encryption

• TLS 1.2 or higher for all data in transit
• AES-256 encryption for databases and file storage
• Individual encryption of PDF reports that contain patient information
• Encrypted database connections

Access controls

• Role-based access limiting data to authorized users
• Multi-factor authentication and trusted-device management
• Short-lived sessions that expire automatically
• A separate database for each practice

Audit logging

• Logging of data access and administrative actions
• Logging of sign-ins, failures, and multi-factor events
• Log retention of at least 6 years

Infrastructure

• Hosted on AWS, which maintains SOC 2, HIPAA, and HITRUST certifications
• Network isolation with private subnets and security groups
• Regular security updates and encrypted automated backups

5. How to Get a BAA

1. Email support@divergentdental.com to request a BAA.
2. We send the BAA to your practice to review and sign electronically.
3. Once signed, a copy is kept on file for both parties for the length of the relationship and the required retention period after it.

Please have a BAA in place before sending any data that may contain PHI to the Services.

6. Related Policies

• Privacy Policy: how we collect, use, and protect information
• Terms of Service: the terms for using the Services, including HIPAA obligations
• Cookie Policy: the cookies and similar technologies we use

7. Contact Us

Divergent Dental Resources, LLC
Email: support@divergentdental.com
Phone: 888-755-5728