Last Updated: 1 October 2026
This Business Associate Agreement ("BAA") is entered into between BookedFlow ("Business Associate") and the healthcare provider, medical practice, medical spa, clinic, healthcare organisation, or other covered entity or business associate using applicable BookedFlow services ("Customer").
This BAA is intended to establish the parties' respective obligations concerning Protected Health Information ("PHI") and Electronic Protected Health Information ("ePHI") under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), the Health Information Technology for Economic and Clinical Health Act ("HITECH Act"), and applicable implementing regulations.
Terms including Business Associate, Covered Entity, Protected Health Information (PHI), Electronic Protected Health Information (ePHI), Security Incident, Breach, and Unsecured Protected Health Information have the meanings assigned to them under HIPAA and its implementing regulations.
Customer means the entity using BookedFlow services that is a Covered Entity or Business Associate and requires BookedFlow to process PHI on its behalf.
Services means the BookedFlow services covered by the applicable service agreement between BookedFlow and Customer.
This BAA applies only to the extent that BookedFlow creates, receives, maintains, or transmits PHI on behalf of Customer and is acting as a Business Associate under HIPAA.
This BAA does not apply to BookedFlow services or configurations that are not intended or authorised for processing PHI.
Customer must not transmit PHI through any BookedFlow feature, integration, or third-party service that has not been approved for such use.
BookedFlow may use or disclose PHI only:
As necessary to provide the Services to Customer;
As permitted or required by this BAA;
As permitted by Customer's documented instructions;
As required by applicable law; or
As otherwise permitted under HIPAA for a Business Associate.
BookedFlow will not use or disclose PHI in a manner that would violate HIPAA if performed by Customer, except where HIPAA expressly permits such use or disclosure by a Business Associate.
BookedFlow will implement reasonable and appropriate administrative, physical, and technical safeguards designed to protect the confidentiality, integrity, and availability of ePHI processed under this BAA, as required by applicable provisions of the HIPAA Security Rule.
BookedFlow will take reasonable measures designed to protect PHI against unauthorised use or disclosure.
BookedFlow will report to Customer any use or disclosure of PHI not permitted by this BAA of which BookedFlow becomes aware, as required by applicable law.
BookedFlow will also report applicable Breaches of Unsecured PHI and Security Incidents in accordance with HIPAA and the terms of this BAA.
Following discovery of a Breach of Unsecured PHI for which notification is required under HIPAA, BookedFlow will notify Customer without unreasonable delay and within the timeframe required by applicable law.
To the extent reasonably available, notification will include information necessary for Customer to meet its applicable breach-notification obligations.
BookedFlow will require subcontractors that create, receive, maintain, or transmit PHI on behalf of BookedFlow to agree to appropriate restrictions, conditions, and requirements concerning PHI as required by HIPAA.
Where a subcontractor handles ePHI, BookedFlow will require the subcontractor to implement applicable safeguards as required by law.
Where applicable, BookedFlow will make reasonable efforts to limit its use, disclosure, and requests for PHI to the minimum necessary to accomplish the intended purpose, consistent with HIPAA requirements.
Where BookedFlow maintains PHI in a Designated Record Set on behalf of Customer, BookedFlow will provide reasonable assistance to Customer in responding to requests for access to PHI in accordance with applicable HIPAA requirements.
Where applicable, BookedFlow will provide reasonable assistance to Customer to enable amendment of PHI maintained in a Designated Record Set as required by HIPAA.
BookedFlow will maintain information regarding disclosures of PHI to the extent required for Customer to fulfil applicable obligations relating to an accounting of disclosures under HIPAA.
BookedFlow will provide such information to Customer where legally required.
BookedFlow will make its internal practices, books, and records relating to the use and disclosure of PHI available to the Secretary of the U.S. Department of Health and Human Services where required for purposes of determining compliance with HIPAA.
Customer is responsible for:
Using BookedFlow only in configurations approved for processing PHI;
Ensuring its use of the Services complies with HIPAA and other applicable laws;
Maintaining appropriate privacy notices, policies, authorisations, and consents;
Limiting PHI entered into the Services to information reasonably necessary for the intended purpose;
Maintaining appropriate user permissions and access controls;
Protecting account credentials;
Promptly notifying BookedFlow of suspected unauthorised access or security incidents;
Ensuring Customer's employees and authorised users use the Services appropriately; and
Not using non-approved integrations or communication channels to transmit PHI.
Customer acknowledges that email, SMS, telephone, appointment scheduling, CRM, automation, and other communication features may involve different security and privacy considerations.
PHI may only be transmitted using features and configurations that have been approved for such processing.
Customer is responsible for ensuring that its communications with patients comply with applicable HIPAA requirements and other applicable laws.
BookedFlow may use third-party technology providers in delivering the Services.
Where a third-party provider creates, receives, maintains, or transmits PHI on behalf of BookedFlow and qualifies as a Business Associate or subcontractor Business Associate under HIPAA, BookedFlow will maintain appropriate contractual arrangements as required by applicable law.
To the extent practicable, BookedFlow will take reasonable steps to mitigate harmful effects known to BookedFlow resulting from a use or disclosure of PHI by BookedFlow that violates this BAA.
This BAA becomes effective when the parties enter into an applicable service relationship involving BookedFlow's processing of PHI on behalf of Customer.
The BAA remains effective for as long as BookedFlow maintains PHI subject to this Agreement.
Customer may terminate the applicable agreement where Customer determines that BookedFlow has materially breached this BAA and BookedFlow fails to cure the breach within a reasonable period where cure is possible.
Upon termination of the applicable Services, BookedFlow will return or destroy PHI received from Customer or created, received, or maintained on Customer's behalf where feasible and where required by HIPAA.
Where return or destruction is infeasible or retention is required by law, BookedFlow will continue to apply appropriate protections to retained PHI and limit further uses and disclosures to purposes that make return or destruction infeasible or as required by law.
The parties intend this BAA to comply with applicable HIPAA and HITECH requirements.
If applicable law changes in a manner requiring modification of this BAA, the parties will cooperate as reasonably necessary to amend the BAA to maintain compliance.
This BAA supplements the applicable service agreement, Terms of Service, Data Processing Agreement, or other agreement between BookedFlow and Customer.
If there is a conflict concerning the handling of PHI between this BAA and another agreement between the parties, this BAA will control with respect to PHI to the extent required by applicable law.
Nothing in this BAA is intended to create rights in any person or entity other than BookedFlow and Customer, except where otherwise required by law.
Any ambiguity in this BAA will be interpreted in a manner that permits the parties to comply with applicable HIPAA requirements.
Questions concerning this Business Associate Agreement may be directed to:
BookedFlow
Email: [email protected]
Website: https://bookedflowapp.com/
Business/Legal Entity: Patrick Willie
Where HIPAA requires a Business Associate Agreement between BookedFlow and Customer, the parties will execute or otherwise enter into this BAA as part of their applicable contractual relationship.
The effective date for a particular Customer will be the date specified in the executed agreement or, where legally sufficient, the date on which the applicable contractual arrangement becomes effective.
END OF BUSINESS ASSOCIATE AGREEMENT