What a BAA is
A Business Associate Agreement is a contract required by HIPAA whenever a covered entity, like a practice or pharmacy, lets a vendor create, receive, store, or transmit protected health information on its behalf. The BAA binds the vendor to HIPAA's safeguard, use, and breach-notification rules.
For AI tools this is the deciding line. An AI voice agent or web-chat widget that touches patient data is a business associate, so it needs a signed BAA. Without one, running real patient data through the tool is a compliance violation, no matter how capable the model is.
Vendors often gate the BAA behind a paid or enterprise plan. Rivvi includes the signed BAA on its free trial, e-signed inside the signup flow before any patient data moves, so a practice is compliant on day one rather than after an upgrade.
BAAs, answered
A covered entity (a healthcare provider, health plan, or clearinghouse) and any business associate that handles protected health information on its behalf both sign the BAA. That includes software vendors, so an AI patient-communication tool must sign one with each practice it serves.
Usually no. Most vendors gate the BAA to paid or enterprise plans, or offer no self-serve signup, so their free tier cannot legally touch patient data. Rivvi is an exception: the signed BAA is included on its free trial, e-signed during signup.
During signup, before any patient data moves. The BAA is e-signed inside the flow as part of creating the account, so the free trial is usable on real patient data immediately, not just for demos on fake data.
See it work on your own patients, free
Rivvi's free 7-day trial includes 5 seats, 10,000 conversation credits, a signed HIPAA BAA, and a branded number in your area code. A card starts the trial; cancel anytime before it ends.
- 7-day free trial
- HIPAA BAA included
- Cancel anytime