Business Associate Agreement

HavenOPS will execute a BAA with any Customer that is a HIPAA covered entity or business associate and that processes Protected Health Information (PHI) in the platform. The BAA is in addition to — not in place of — the DPA and MSA.

HavenOPS uses and discloses PHI only as permitted by the BAA, the MSA, and applicable law — primarily to perform the services and as required by law.

• Administrative, physical, and technical safeguards aligned with the HIPAA Security Rule.
• Tenant-isolated row-level security and append-only audit trails covering all PHI access.
• Workforce training, access reviews, and least-privilege controls.
• Encryption of PHI in transit and at rest.

HavenOPS will ensure that subcontractors that create, receive, maintain, or transmit PHI on its behalf agree in writing to materially equivalent protections.

HavenOPS will notify Customer of a Breach of Unsecured PHI without unreasonable delay and consistent with HIPAA-required timelines, providing sufficient information for Customer to meet its own notification obligations.

HavenOPS will support Customer's obligations regarding access, amendment, accounting of disclosures, and other individual rights under HIPAA.

The BAA remains in effect for the term of the subscription and any wind-down period. Upon termination, PHI is returned or destroyed where feasible; otherwise, protections survive for as long as the PHI is retained.

BAA requests and HIPAA inquiries: legal@havenops.io.