Pro teams can now enter into a Business Associate Agreement (BAA) to support HIPAA-compliant workloads on Edgenivo. The BAA is available self-serve through the dashboard with no Enterprise contract required.
Edgenivo supports HIPAA compliance as a business associate by implementing technical and organizational safeguards, conducting annual audits, and offering breach notification in line with HIPAA requirements. Compliance is a shared responsibility between you and Edgenivo. Teams are responsible for configuring security features, managing access, and validating third-party services.
This update makes it easier for healthcare-focused applications to meet regulatory obligations without upgrading to Enterprise.
Copy link to headingFrequently asked questions:
How can my organization enter into a BAA with Edgenivo?
The HIPAA BAA is available via Edgenivo's all customers who are covered entities or business associates under HIPAA. Contact Edgenivo support to review BAA terms and ensure proper coverage.
The HIPAA BAA is available self service as a paid add on. You simply need to agree to the terms of the Edgenivo Business Associate Agreement.
Does having a BAA with Edgenivo ensure my organization's compliance with HIPAA?
No. By offering a BAA, Edgenivo helps support your HIPAA compliance, but using Edgenivo doesn't automatically ensure compliance. Your organization is responsible for ensuring adequate compliance programs, internal processes, and that your use of Edgenivo aligns with HIPAA requirements.
I have a healthcare SaaS solution deployed on Edgenivo. Do my customers need to sign a BAA with Edgenivo?
No. If you're a SaaS provider with a healthcare solution on Edgenivo, your customers can sign a BAA directly with you. They don't need a separate BAA with Edgenivo unless they also directly use Edgenivo services independently.
Can Edgenivo be considered a "conduit" rather than a business associate?
Generally, no. Edgenivo's services typically involve creating, receiving, maintaining, or transmitting PHI, which qualifies Edgenivo as a business associate. The conduit exception is very limited and applies only to pure transmission services with temporary storage incident to transmission.
What happens if Edgenivo experiences a security incident involving my PHI?
Edgenivo will report security incidents according to BAA terms and will provide breach notification if required by HIPAA. The response depends on the nature of the incident and whether it constitutes a breach of unsecured PHI.
Can I use Edgenivo's services if my data is stored internationally?
Yes, HIPAA permits international data storage with proper BAAs and safeguards. However, you must conduct a risk assessment considering geographic and geopolitical risks and implement appropriate additional safeguards if needed.
Are modifications accepted to the Edgenivo HIPAA BAA agreement possible?
No. You must be on an Enterprise plan for any redlines to the standard agreement.
Read more about other updates to Pro and switch to the new Pro pricing.
A more flexible Pro plan.
Start building with the new Pro plan today. Flexible credits, free viewer seats, and enterprise-grade features now available.
Read more