When a covered entity, such as a clinic or an independent clinician, uses Terra to document care, Terra creates, receives, stores and transmits protected health information (PHI) on its behalf. HIPAA requires a Business Associate Agreement (BAA) for that relationship. Terra signs a BAA with every customer on a paid plan, at no extra cost.
Roles
- You are the covered entity (or, if you are a billing company or another vendor, a business associate yourself, and the agreement is a subcontractor BAA).
- Terra is your business associate. We use and disclose PHI only to provide the Service to you, as the agreement permits, or as required by law.
- Our subprocessors that handle PHI are bound by their own business associate agreements with Terra, with restrictions at least as strict as ours. The current list is on the Compliance center.
What the agreement covers
The summary below describes the standard terms. The signed agreement controls.
Permitted uses
Terra may use PHI to provide transcription, drafting, chart context, record chat, coding suggestions, evidence research and the other functions of the Service; for our proper management and administration; and to meet legal obligations. We do not sell PHI, use it for marketing, or use it to train AI models.
Safeguards
Terra maintains administrative, physical and technical safeguards that meet the HIPAA Security Rule, including encryption in transit and at rest, unique user accounts, role- and patient-level access controls, audit history and workforce training. See security practices.
Minimum necessary
Each AI or speech request carries only what its task needs. Drafts use the sources shown to the clinician before confirming, with an encounter header that omits the patient's name, MRN and date of birth. Evidence research sends only de-identified queries the clinician approves.
Reporting
Terra reports to you any use or disclosure not permitted by the agreement, any security incident affecting your PHI, and any breach of unsecured PHI without unreasonable delay and no later than {{BREACH_NOTICE_DAYS}} calendar days after discovery, with the information you need for your own notifications.
Individual rights
When you receive a request from a patient to access, amend or receive an accounting of disclosures of their PHI, Terra helps you respond. Clinicians can export signed notes, and amendments are recorded as dated, attributed additions that preserve the original signed text.
Access by HHS
Terra makes its internal practices, books and records relating to PHI available to the Secretary of Health and Human Services to determine compliance with HIPAA.
Term and return of PHI
The agreement lasts as long as you use Terra. When it ends, you can export your records for {{EXPORT_WINDOW}}. Terra then returns or destroys PHI, including in backups as they expire. Where return or destruction is not feasible, Terra extends the agreement's protections to the remaining PHI and limits further use.
Your responsibilities
- Sign the BAA before entering real PHI. The free trial is for synthetic data only.
- Give each person their own account with the right role, and remove access when people leave.
- Obtain any patient consent to record that your state law and policies require.
- Configure retention settings, such as raw audio retention, to match your record-keeping policy.
- Tell us if a restriction you have agreed with a patient affects how Terra may use their PHI.
Questions
Write to security@useterra.si for the BAA, a copy of our SOC 2 report under NDA, or a security questionnaire.