HIPAA Business Associate Agreement

What this covers

A Business Associate Agreement (BAA) is the contract HIPAA requires between a healthcare provider ("Covered Entity") and any vendor that creates, receives, or stores Protected Health Information (PHI) on their behalf ("Business Associate"). Kenko signs one with every US healthcare practice that asks for it, at no extra cost, on any plan.

How Kenko protects PHI

• Encryption in transit (HTTPS/TLS) and at rest.
• Per-practice data isolation, enforced server-side — one practice's data is never readable or writable by another account.
• An immutable audit log of every create, update, and delete on an appointment or patient record.
• Automatic session logoff after 15 minutes of inactivity.
• Access restricted to individually authenticated staff accounts.

Our infrastructure is covered too

Kenko runs on Google Cloud / Firebase, using only the specific services on Google's HIPAA-covered products list — Cloud Firestore, Firebase Authentication, Cloud Functions, Cloud Storage, and Firebase Hosting — under Google's own Business Associate Agreement with us. We don't run PHI through any Firebase or Google product outside that list.

How to get one

Email hello@kenkodoc.com or use our contact form before entering any patient data. We'll send over our standard BAA for your review and signature — happy to work through any redlines your practice's counsel wants to make.

This page is a plain-language summary, not the legal agreement itself. The actual BAA we send for signature is the governing document.