HIPAA-compliant faxing.
One simple form.

TIDYFAX BUSINESS ASSOCIATE AGREEMENT OUTBOUND HIPAA FAX SUBMISSIONS 1. Parties, scope and effective date This Business Associate Agreement (Agreement) is between Tidy SaaS, LLC, operating TidyFax (TidyFax), and the organization identified in the electronic acceptance record (Customer). Customer acts as a HIPAA covered entity or as a business associate engaging TidyFax as its subcontractor. The representative's name, title, verified email, organization, agreement version and acceptance time form part of this Agreement. When TidyFax makes this approved Agreement available for electronic acceptance, it offers to be bound by it. Customer accepts through its authorized representative. The Agreement takes effect at the recorded UTC acceptance time, before Customer uploads protected health information (PHI) through the designated HIPAA fax workflow. A draft preview, ordinary fax purchase or unaccepted agreement does not establish this Agreement. This Agreement covers the particular outbound HIPAA fax submission associated with that acceptance record and the related processing, delivery, support and retained information. A later submission requires its own acceptance record. Expiration of an upload session does not end obligations concerning information already received. This is a sending-only service. The shared fax number used to send a document is not a customer receiving number or a return-fax inbox. A faxed reply, acknowledgment, or returned document sent to that outbound number will not be made available to Customer through TidyFax and is disregarded by TidyFax's receiving workflow. If Customer expects PHI by return fax, Customer must separately obtain the approved protected receiving service and agree to its applicable receiving terms before providing a receiving number to third parties. Standard fax number rentals are not approved for PHI. These sending-only limitations do not establish that telecommunications providers never process or temporarily retain incoming fax information. 2. Definitions HIPAA Rules means the applicable Privacy, Security, Breach Notification and Enforcement Rules in 45 CFR Parts 160 and 164, as amended. PHI, electronic PHI, breach, unsecured PHI, security incident, designated record set, subcontractor and other defined HIPAA terms have their meanings under those rules. PHI here is limited to information TidyFax handles on Customer's behalf under this Agreement. 3. Permitted processing TidyFax may handle PHI only as needed to perform Customer's authorized fax submission, document conversion, delivery attempts, status reporting, receipt generation, security, support and deletion, or as required by law. Uses, disclosures and requests will follow applicable minimum-necessary requirements and Customer's communicated restrictions consistent with the service. TidyFax will not use Customer PHI for advertising, sale, model training or unrelated product development. This Agreement does not authorize data aggregation or reuse of de-identified Customer data. Customer directs delivery to the fax number it supplies and is responsible for checking the recipient and its authority to receive the information. TidyFax will not knowingly process a direction that would violate applicable HIPAA requirements. A successful transmission does not establish who read it or how the recipient subsequently handles it. 4. Safeguards and personnel TidyFax will maintain administrative, physical and technical safeguards appropriate to the PHI and comply with the HIPAA Security Rule for electronic PHI. It will restrict access to authorized personnel with a service-related need, maintain workforce confidentiality and training, and maintain procedures for risk management, incident response and continuity. No provision promises that conventional fax network transmission is end-to-end encrypted or that security incidents are impossible. 5. Subcontractors Before allowing a subcontractor to create, receive, maintain or transmit PHI on its behalf, TidyFax will establish the written assurances required by HIPAA, imposing applicable safeguards and restrictions no less protective than those required here. TidyFax will address known material violations and end the relationship when required and feasible. A vendor's marketing description alone is not a substitute for these obligations. 6. Incident and breach reporting TidyFax will report to Customer an unauthorized use or disclosure, security incident, or breach of unsecured PHI of which it becomes aware, without unreasonable delay. Breach notification will satisfy 45 CFR 164.410 and occur no later than 60 calendar days after discovery, subject only to a delay permitted by applicable law. This maximum is not permission to postpone an earlier practicable notification. TidyFax will provide available details about affected individuals, the information involved, discovery and incident dates, mitigation and corrective actions, and a response contact. It will supplement the report as additional information becomes available and cooperate with Customer's investigation and notification duties. Customer retains responsibility for notices to individuals, regulators and others unless the parties separately agree otherwise in writing. TidyFax will mitigate harmful effects of violations to the extent practicable. 7. Individual rights and regulatory cooperation To the extent TidyFax maintains relevant information, it will assist Customer with access, amendment and accounting obligations under 45 CFR 164.524, 164.526 and 164.528, incorporate required amendments, and provide the information in time for Customer to meet applicable deadlines. Direct individual requests will be referred to Customer unless law requires another response. TidyFax will not deny a request solely because Customer is a business associate rather than a covered entity. If TidyFax undertakes a Privacy Rule obligation for Customer, it will comply with the requirements applicable to that function. TidyFax will make relevant practices, books and records available to the U.S. Department of Health and Human Services as required to assess HIPAA compliance. Service deletion does not excuse required retention of accounting or compliance records. 8. Customer responsibilities and notices Customer will use only the designated HIPAA workflow for PHI, provide a representative authorized to bind its organization, submit only information it is entitled to disclose, and keep the acceptance email available for service and security notices. Customer will promptly inform TidyFax of relevant privacy restrictions, changes in permissions and known misdirected submissions. Customer must not represent the outbound sender number as a number where Customer can receive medical records or other protected replies. Customer will retain its own authoritative medical records; TidyFax is a transmission service, not a medical-record archive. Agreement requests, privacy restrictions, termination notices and security concerns may be directed to privacy@tidyfax.com. Identify the organization and agreement or tracking ID; do not attach PHI to ordinary email. The parties will arrange an appropriate protected channel when sensitive information is necessary. Customer designates the verified acceptance email for initial notices and must communicate contact changes through that channel or another verified process. 9. Retention, termination and surviving protection The service initiates removal of active source documents after confirmed delivery or at the disclosed 24-hour upload deadline, and removes delivery receipts at that deadline. Failed deletions are retried and unresolved provider processing is reconciled. These service targets do not represent a guarantee of instantaneous erasure from every provider system or backup. TidyFax remains responsible for protecting retained PHI and for ensuring its retention and disposal arrangements satisfy this Agreement. Customer may terminate this Agreement for a material violation by TidyFax. Either party may end further service by written notice, without extinguishing existing obligations. On termination, TidyFax will return or destroy remaining PHI, including subcontractor-held PHI, where feasible, retaining no copies except as required by law. If return or destruction is infeasible, TidyFax will explain the basis to Customer, continue these protections, and limit processing to the reasons preventing return or destruction. It will remove the information when that basis ends. These obligations survive termination for as long as PHI is retained. 10. Relationship to other terms and electronic acceptance This Agreement controls over conflicting service terms concerning PHI. It does not permit either party to avoid its own legal duties or require Customer to waive HIPAA rights. The parties will cooperate on amendments needed to comply with applicable law; publishing new text does not rewrite an already accepted record. An invalid provision will be limited or severed to the extent permitted while preserving the remaining protections. This Agreement creates no contractual rights for unrelated third parties. The representative confirms authority to bind Customer, consents to this electronic record and signature, and accepts this revised sending-only Agreement by entering their name and selecting the acceptance controls. TidyFax will preserve the exact accepted text and associated acceptance record and make a downloadable copy available to the verified sender. Customer should retain that copy with its compliance records.