Security # A BAA for your firm's AI: what it is, and whether you need one. A BAA (Business Associate Agreement) is a contract in which we promise to protect the medical records you upload. Your firm decides whether it needs one. If it does, or simply wants one, ask us: it is free, and we sign it the same business day. [Start free](https://caseailegal.com/signup) ## What a BAA is. HIPAA is the federal law that protects health information. When a doctor, hospital or health insurer (a “covered entity”) shares patient records with a company that helps it, that company is a “business associate.” A BAA is the contract between them. It says the business associate will protect the records, use them only for the job, report a breach, and return or destroy them at the end. Source: [the U.S. Department of Health and Human Services, sample business associate agreement provisions](https://www.hhs.gov/hipaa/for-professionals/covered-entities/sample-business-associate-agreement-provisions/index.html). ## When a law firm needs one. A law firm needs a BAA for AI when it is a covered entity, or a business associate of one, for the records it uploads. That usually means a firm that works for doctors, hospitals, other providers or health insurers and gets patient records from them, including a firm that represents a provider in a PIP arbitration or a bill collection. HIPAA makes such a firm a business associate whether or not it has signed a BAA. A firm that only represents injured people usually gets records with its client's permission, so HIPAA usually does not make it the doctor's business associate or require a BAA with its AI tool. Auto insurers, including PIP carriers, are not covered by HIPAA. Some state health privacy laws reach further than HIPAA. Your firm decides whether it needs one. If you are not sure, ask your own counsel, or ask us for the BAA anyway. It costs nothing. ## What protects your files with or without a BAA. Every firm gets the same data protections in our Terms of Service, with or without a BAA: - **Never used to train AI.** Amazon Bedrock does not use your questions or the AI's answers to train AI models. - **No copy kept by the AI service.** Our AWS account is set so Bedrock keeps none of your questions or answers. - **One AWS account, under AWS's own BAA.** Your files are stored and processed only in our AWS account, on services AWS covers with its own BAA with us. The one exception is AWS's web search tool, which AWS has not confirmed in writing, so web search is off for firms with our BAA unless they ask for it. - **You decide what is deleted.** Files and chats stay until you delete them. If your plan ends, your files, their text and your chats are deleted 104 days later. If your firm signs our BAA, the BAA's deletion terms apply to health information. [How Case AI keeps client files private](https://caseailegal.com/security) ## What our BAA adds. Our BAA puts these promises in a signed contract with your firm, and adds the duties HIPAA requires of a business associate: - No use of your records, or anything made from them, to train or improve any AI model, by us or anyone we work with. - Only the companies listed in the BAA handle your records, under terms at least as protective. - You can delete any file, chat or case at any time, or ask us in writing to delete everything. - At the end, your records are returned or destroyed. Every customer can also ask for our AI Data Protection Addendum, a document that puts the safeguards above in writing for all case material, medical or not. It states that authorized S2Reason staff may read the questions your team asks, inside our own AWS environment, to operate, support and improve Case AI, and never to train AI. ## How to get one. - Email [support@s2reason.com](mailto:support@s2reason.com?subject=BAA%20request) and say your firm would like a BAA. - We send it for electronic signature the same business day. - You sign it, and we send you the signed copy. You can start using Case AI before it is signed. If your firm is a covered entity or a business associate, sign it before you upload patient records. ## Questions about BAAs and AI. **Does a personal injury firm need a BAA to use AI?** Usually not, but your firm decides. HIPAA covers doctors, hospitals and health insurers, and the companies that handle patient records for them. A firm that only represents injured people and gets records with the client's permission usually is not one of those. A firm that represents a doctor or hospital, for example in a PIP arbitration or a bill collection, usually is. You can ask us for a BAA either way, free. **Is the BAA free?** Yes. There is no charge for it, on any plan. **How fast can you sign it?** The same business day you ask. **Does a BAA make our AI use safe in court?** No contract can promise that. A BAA protects medical records under HIPAA. For a court, what helps is a record of what went in: Case AI gives each case an upload list and an AI use report. **Does AWS sign a BAA too?** Yes. AWS has its own BAA with S2Reason that covers the AWS services that store and process your files, including Amazon Bedrock and Amazon Textract. AWS has not confirmed in writing that its web search tool is covered, so web search is off for firms with a BAA unless they ask for it. ## Start with the free plan. No card. [Start free](https://caseailegal.com/signup)