Version 2026-10-13. Included with the subscription. Not a certification, and not a substitute for legal review.

DentalSlip Business Associate Agreement
Version 2026-10-13

This Business Associate Agreement ("BAA") is between the subscribing dental office ("Covered Entity") and the operator of DentalSlip ("Business Associate"). It is the agreement offered with the product. Obtain qualified legal review before relying on it in production.

1. Scope. Business Associate may create, receive, maintain, or transmit protected health information on behalf of Covered Entity solely to provide referral forms, storage, notification, printing, and related support.

2. Permitted use. Business Associate will not use or disclose protected health information except to provide the service, as required by law, or as this BAA allows. Business Associate will not sell protected health information.

3. Safeguards. Business Associate will use administrative, physical, and technical safeguards appropriate to the service, including access control, encryption in transit and at rest, audit logging, and workforce limits. These safeguards do not constitute a certification.

4. Subcontractors. Business Associate will require subcontractors that handle protected health information to agree to restrictions substantially similar to this BAA. A current subprocessor list is provided on request.

5. Breach notification. Business Associate will report to Covered Entity, without unreasonable delay, a breach of unsecured protected health information of which it becomes aware, consistent with 45 CFR 164.410 and any shorter period stated in an order form. Not every security event is a reportable breach.

6. Individual rights. Business Associate will make information available so Covered Entity can respond to access, amendment, and accounting requests. Amendments in the product are recorded separately from the original submission.

7. Access by HHS. Business Associate will make its internal practices available to the Secretary of Health and Human Services as required to determine compliance.

8. Return or destruction. When the relationship ends, Business Associate will return or destroy protected health information where feasible, after a transition period for export, except where retention is required by law. The proposed transition is 90 days unless the parties agree otherwise.

9. Minimum necessary. Business Associate will limit requests for, use of, and disclosure of protected health information to what the service needs.

10. Term. This BAA starts when the owner accepts it in the product and continues while Business Associate holds the office’s protected health information.