Business Associate Agreement Summary

When you need a BAA

Under the HIPAA Privacy, Security and Breach Notification Rules (45 CFR Parts 160 and 164), a vendor that creates, receives, maintains or transmits protected health information (PHI) on behalf of a covered entity, or on behalf of another business associate, is itself a business associate and must sign a business associate agreement that meets 45 CFR 164.504(e).

If your test cases, prompts, agent traces or annotations contain PHI, for example because you replay de-identified-in-name-only production transcripts or because your agent's tool calls return real member data in a staging environment, you must have a BAA with GONATURELLE before uploading. If you use only GONATURELLE golden datasets and Synthetic Cases, which are not real records, or data that has been de-identified under 45 CFR 164.514(b), a BAA is not strictly required, though many customers sign one anyway so that an accidental upload is covered.

Request the BAA from the Trust Center or by emailing legal@gonaturelle.si. It is available on the Developer, Scale and Enterprise plans at no additional cost, and our standard form is usually countersigned within two business days. We will review a customer's own BAA form on Enterprise plans.

Permitted uses and disclosures

GONATURELLE may use and disclose PHI only to perform the evaluation Services described in the customer agreement, as required by law, and for the proper management and administration of GONATURELLE as permitted by 45 CFR 164.504(e)(4). We apply the minimum necessary standard to our own uses and disclosures.

GONATURELLE will not use PHI to train or fine-tune any model, will not sell PHI, will not use PHI for marketing, and will not de-identify PHI for its own purposes. PHI is never included in product analytics or telemetry. When the Services call a third-party model provider to run your agent or a judge, they do so only under zero data retention terms and only where that provider has signed a BAA with GONATURELLE, or the call is routed to a model endpoint inside your own cloud account.

Safeguards

GONATURELLE implements administrative, physical and technical safeguards that comply with Subpart C of 45 CFR Part 164 (the Security Rule) to protect the confidentiality, integrity and availability of electronic PHI. These include:

• AES-256 encryption at rest and TLS 1.2 or higher in transit, with keys managed in the cloud provider's key management service and customer-managed keys available on Enterprise.
• Isolated, per-run sandboxes for agent execution, torn down after each run, with no shared filesystem between tenants.
• Role-based access control, SAML SSO and multi-factor authentication for all staff access, with production access granted just in time and logged.
• PHI and PII detectors on ingest that can redact or block fields before storage, configurable per suite.
• Annual risk analysis, workforce HIPAA training, and an annual SOC 2 Type II audit that includes the controls above.
• Customer-defined retention periods for test inputs, outputs and traces, with deletion verified at expiry.

Breach and incident reporting

GONATURELLE will report to the customer any use or disclosure of PHI not permitted by the BAA, any security incident of which it becomes aware, and any breach of unsecured PHI as required by 45 CFR 164.410. Breach notifications will be made without unreasonable delay and in no case later than 10 calendar days after discovery, which is shorter than the 60-day outer limit in the regulation, and will include, to the extent known, the individuals affected, a description of what happened, the PHI involved, and the mitigation steps taken.

Unsuccessful security incidents that are routine, such as blocked port scans or failed login attempts that do not result in unauthorised access, are reported in aggregate on request rather than individually.

Subcontractors

In accordance with 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2), GONATURELLE ensures that any subcontractor that creates, receives, maintains or transmits PHI on its behalf agrees in writing to the same restrictions and conditions that apply to GONATURELLE. Subcontractors that may handle PHI are identified on the Subprocessors page.

Individual rights and HHS access

Because GONATURELLE holds test data rather than a designated record set, requests for access, amendment or an accounting of disclosures are rare. Where they arise, GONATURELLE will make PHI available to the customer so the customer can meet its obligations under 45 CFR 164.524, 164.526 and 164.528, within 15 days of a written request.

GONATURELLE will make its internal practices, books and records relating to PHI available to the Secretary of Health and Human Services for purposes of determining compliance with HIPAA.

Term, termination and return of PHI

The BAA lasts as long as the customer agreement. If either party materially breaches the BAA and does not cure within 30 days, the other may terminate the BAA and the affected Services. On termination, GONATURELLE will return or destroy all PHI within 30 days, including copies held by subcontractors, and certify destruction in writing on request. Where return or destruction is infeasible, for example in encrypted backups that expire on a fixed cycle, the BAA's protections continue for as long as the PHI is retained.

This summary is provided for convenience and does not replace the signed BAA, which controls. It is not legal advice; your privacy officer or counsel should review the full agreement.