1. When a BAA is needed
If your organization is a covered entity or a business associate under the US Health Insurance Portability and Accountability Act of 1996, as amended by the HITECH Act, and its implementing regulations ("HIPAA"), and you intend to send protected health information ("PHI") through the PALM SOUQ gateway, you must sign a Business Associate Agreement with PALM SOUQ before doing so. Without a signed BAA, our Terms of Service prohibit sending PHI to the Service.
The BAA is available on the Growth and Scale plans. It supplements the Terms of Service and the Data Processing Addendum. This page summarizes the standard terms of our BAA; the signed agreement controls.
2. Permitted uses and disclosures
PALM SOUQ may use and disclose PHI only to perform the Service for you as described in the Agreement, which means forwarding requests to the model providers you configure, counting tokens, evaluating loop heuristics and enforcing your limits, or as required by law. PALM SOUQ will not use or disclose PHI in a manner that would violate Subpart E of 45 CFR Part 164 if done by you, and applies the minimum necessary standard.
3. How PHI flows through PALM SOUQ
Under Zero Payload Retention, request and response bodies are processed in gateway memory only for the life of the request. They are not written to disk, logs, metrics, traces or backups. PALM SOUQ stores request metadata (timestamps, token counts, model, cost, status and the identifiers you send in PALM SOUQ headers), which is why the BAA requires that you never place PHI, such as patient names, medical record numbers or dates of service, in headers. Use opaque tenant and user identifiers instead.
You remain responsible for having a BAA in place with each model provider that will receive PHI, and for configuring fallback chains so that PHI is only routed to providers covered by such an agreement.
4. Safeguards
- Administrative, physical and technical safeguards that comply with the HIPAA Security Rule, 45 CFR Part 164 Subpart C.
- Encryption of data in transit with TLS 1.2 or higher, and encryption at rest with AES-256 for all stored metadata.
- Workforce training on HIPAA obligations, with sanctions for violations.
- Unique user identification, automatic session timeout and audit logging for all production access.
- Annual risk analysis as part of our SOC 2 Type II program.
5. Reporting and breach notification
PALM SOUQ will report to you any use or disclosure of PHI not permitted by the BAA, and any security incident of which it becomes aware. PALM SOUQ will notify you of a breach of unsecured PHI without unreasonable delay and in no case later than 5 business days after discovery, with the information required by 45 CFR 164.410, so you can meet your own notification duties. Unsuccessful attempts such as pings, port scans and blocked login attempts are reported in aggregate on request rather than individually.
6. Subcontractors, access and accounting
PALM SOUQ ensures that any subcontractor that creates, receives, maintains or transmits PHI on its behalf agrees in writing to the same restrictions and conditions. Because PALM SOUQ does not maintain a designated record set, requests for access, amendment and accounting of disclosures will usually be fulfilled by you; PALM SOUQ will provide reasonable assistance within 15 business days of your request. PALM SOUQ will make its internal practices and records relating to PHI available to the Secretary of Health and Human Services to determine compliance.
7. Term and termination
The BAA lasts as long as the Agreement. If either party materially breaches the BAA and does not cure within 30 days of notice, the other party may terminate the BAA and the affected Service. On termination PALM SOUQ will return or destroy any PHI it holds, which, under Zero Payload Retention, is limited to anything you placed in metadata in breach of section 3.
8. How to request a BAA
Email legal@palmsouqltd.com with your company's legal name, plan, and the name and title of your signatory, or ask your account executive. Scale customers can also negotiate a BAA alongside their order form.