HIPAA & Business Associate Information
Effective Date: [Effective Date]
Last Updated: [Last Updated Date]
Draft notice. This document is provided for informational purposes and as a high-quality starting draft. It does not constitute legal advice. Axiogen's actual policies and agreements must be reviewed, customized, and approved by qualified legal counsel licensed in the relevant jurisdictions before publication or use.
1. Our HIPAA posture in one paragraph
Axiogen AI ("Axiogen") builds commercial and market intelligence for pharmaceutical and medical-device companies in medical aesthetics. Our core dataset describes practices and practitioners in their professional capacity — not patients — and is assembled from public and commercially licensed sources. That data is not Protected Health Information ("PHI") under the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations ("HIPAA"). Axiogen is not a Covered Entity. We become a Business Associate only when a Covered Entity (or another Business Associate) chooses to upload PHI to the Platform or to instruct us to process it, and in that case we do so under a signed Business Associate Agreement ("BAA"). Our security program is designed to align with the HIPAA Security Rule's administrative, physical, and technical safeguard standards, and we support customers' HIPAA obligations with the controls described below. There is no such thing as HIPAA "certification," and we do not claim one.
2. What the Axiogen dataset is — and is not
| The Axiogen dataset contains | The Axiogen dataset is not designed to contain |
|---|---|
| Professional information about clinicians, injectors, and practice staff: credentials, licensure, NPI, practice affiliations, professional contact details | Patient names, records, or identifiers |
| Practice-level information: locations, services and products offered, devices, firmographics, public reviews about the practice | Treatment, diagnosis, or health-status information about any patient |
| Publicly posted professional and practice social-media content and engagement metrics | Health information about the professionals themselves |
| Public regulatory and transparency records (e.g., FDA, USPTO, CMS Open Payments) | Insurance, claims, or billing information |
| Derived analytics: segments, scores, influence tiers, relationship graphs, next-best-action recommendations | Electronic health records or any clinical system integration |
Where a public source incidentally contains patient-related content (for example, a practice's public post), Axiogen does not extract, index, or profile the individuals concerned. [CONFIRM WITH ENGINEERING and keep consistent with the Privacy Policy, Section 3.3.]
Because the dataset concerns professionals and businesses rather than patients, our customers can use the Platform for territory planning, KOL identification, credential validation, and outreach planning without creating a Business Associate relationship with Axiogen.
3. When Axiogen acts as a Business Associate
A Business Associate relationship arises only when a customer that is a Covered Entity or Business Associate under HIPAA elects to have Axiogen create, receive, maintain, or transmit PHI on its behalf. Examples could include a customer uploading patient-support-program data, adverse-event follow-up records, or other Customer Content that identifies patients.
In that situation:
- A BAA must be signed before any PHI is uploaded. Our Terms of Service and Data Processing Addendum prohibit uploading PHI without one.
- The BAA governs. It sets out the permitted uses and disclosures of PHI, our safeguard obligations, breach reporting, subcontractor flow-down, individual-rights support, and return or destruction of PHI at the end of the engagement.
- PHI is processed only as instructed. We use and disclose PHI only as permitted by the BAA and as required by law, and never for Axiogen's own purposes, for marketing, or to enrich the shared Axiogen dataset.
- Minimum necessary. Customers are asked to limit uploaded PHI to the minimum necessary for the purpose, and Platform features should be scoped accordingly.
Most pharmaceutical manufacturers are not themselves Covered Entities for their commercial operations, and most Axiogen use cases do not involve PHI. If you are unsure whether your intended use involves PHI, contact [Legal Contact Email] before uploading data, and consult your own privacy counsel.
4. Our standard Business Associate Agreement
Axiogen offers a standard BAA that is designed to satisfy the requirements of 45 C.F.R. §164.504(e) and §164.314(a). Its principal terms include:
| Topic | Axiogen's standard position |
|---|---|
| Permitted uses and disclosures | Only to perform the Services for the customer as set out in the Agreement, for Axiogen's proper management and administration, and as required by law |
| Safeguards | Administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of electronic PHI, consistent with the Security Rule (45 C.F.R. Part 164, Subpart C) |
| Reporting | Report to the customer any use or disclosure not permitted by the BAA, any Security Incident, and any Breach of Unsecured PHI without unreasonable delay and no later than [10 / 30 — select; must not exceed 60] calendar days after discovery, with the information the customer needs to meet its own notification obligations under 45 C.F.R. §§164.404–164.410 |
| Subcontractors | Written agreements with any subcontractor that creates, receives, maintains, or transmits PHI, imposing the same restrictions and conditions that apply to Axiogen |
| Individual rights | Make PHI available for access and amendment, and provide information for an accounting of disclosures, as directed by the customer and within the timeframes the BAA specifies |
| Books and records | Make internal practices, books, and records relating to PHI available to the Secretary of Health and Human Services for compliance determination |
| Term and termination | Customer may terminate if Axiogen materially breaches the BAA and fails to cure; on termination, PHI is returned or destroyed, or, where infeasible, protections are extended for as long as PHI is retained |
| Precedence | The BAA controls over the Agreement and DPA with respect to PHI |
We review customer-paper BAAs on request. Because Axiogen operates a multi-tenant platform with standardized controls, we are generally unable to accept terms that require customer-specific infrastructure or that conflict with the standard positions above, but we will discuss reasonable modifications.
5. Safeguards that support the HIPAA Security Rule
The controls below are part of Axiogen's security program for all customers. They are described in more depth in our Security & Trust Overview and in Annex II of the Data Processing Addendum.
Administrative safeguards
- Designated security lead [title] responsible for the security program
- Documented security and privacy policies, reviewed at least annually
- Risk analysis and risk management performed at least annually and upon significant change
- Workforce security and privacy training at onboarding and at least annually; sanctions policy for violations
- Information-access management based on role and least privilege, with periodic access reviews
- Security incident procedures, a contingency plan (backup, disaster recovery, emergency-mode operation), and periodic evaluation
- Written agreements with subcontractors and sub-processors
Physical safeguards
- Hosting in [Cloud Provider] data centers with physical access controls, environmental protections, and independent third-party audits; Axiogen personnel have no physical access to hosting infrastructure
- Workstation and device controls: managed devices with full-disk encryption, screen lock, and remote wipe
- Media disposal and re-use procedures aligned with NIST guidance
Technical safeguards
- Unique user identification; SAML single sign-on with multi-factor authentication; SCIM-based automated provisioning and deprovisioning
- Role-based and row-level access controls enforcing tenant isolation
- Encryption of data in transit (TLS 1.3) and at rest (AES-256)
- Immutable audit log of user and administrative activity, with retention to support customers' accounting-of-disclosures and compliance requirements
- Integrity controls including checksums, change tracking, and tamper-evident logging
- Automatic session timeout and emergency-access procedures
6. Breach notification approach
If we discover a Breach of Unsecured PHI, Security Incident, or other impermissible use or disclosure covered by a BAA, we will:
- contain and investigate the event immediately;
- notify the affected customer within the period specified in the BAA (and in any event within the time needed for the customer to meet its 60-day obligation to notify individuals, HHS, and, where applicable, the media);
- provide, as information becomes available, the identification of each individual whose PHI was or is reasonably believed to have been affected, a description of what happened, the types of PHI involved, the steps individuals should take, what we are doing to investigate and mitigate, and contact details;
- cooperate with the customer's investigation and notifications; and
- conduct a post-incident review and implement corrective actions.
Axiogen does not notify individuals, regulators, or the media on a customer's behalf unless the BAA or the customer directs otherwise.
7. How to request a BAA
- Existing customers: contact your account manager or email [Legal Contact Email] (e.g., legal@axiogen.ai) with the subject line "BAA request," identifying the Covered Entity or Business Associate that will be party to the BAA and the categories of PHI you expect to upload.
- Prospective customers: include your BAA requirement in your initial conversation with enterprise@axiogen.ai so that the appropriate terms and Platform configuration are in place before onboarding.
- Security documentation: our Security Packet, including [the most recent SOC 2 Type II report, if issued] and a HIPAA Security Rule control mapping, is available under NDA — see [Link to request SOC 2 report under NDA].
We aim to acknowledge BAA requests within [2] business days and to return a draft within [5] business days.
8. Related documents
- Security & Trust Overview — full description of the security program
- Data Processing Addendum — processor terms and technical and organizational measures
- Privacy Policy — how we handle personal information, including professional data
- Terms of Service — acceptable use, including the prohibition on uploading PHI without a BAA
- Contact
Draft notice. This document is provided for informational purposes and as a high-quality starting draft. It does not constitute legal advice. Axiogen's actual policies and agreements must be reviewed, customized, and approved by qualified legal counsel licensed in the relevant jurisdictions before publication or use.