HIPAA Business Associate, from day one.
Zenith signs a Business Associate Agreement with every client practice before any patient information changes hands. We work inside your EHR, use HIPAA-eligible tools, and keep PHI off any platform that isn’t covered by a BAA.
This website collects no protected health information.
Our contact form, chatbot, and analytics are limited to business-contact information from providers and administrators. We ask every visitor to keep patient details out of this site and out of unencrypted email. If you need to share PHI with us, we’ll do it under a signed BAA, inside your EHR or an equivalent HIPAA-covered channel.
Signed BAA before any PHI
Before a single patient record moves, Zenith signs a Business Associate Agreement with your practice. The BAA governs permitted uses, safeguards, breach notification, and return or destruction of PHI at the end of the engagement.
Your EHR stays the system of record
Clinical staff work inside the EHR or CCM platform your practice already uses. No PHI gets exported to Zenith-owned tooling. The patient record never leaves your governance.
Three layers, the HIPAA Security Rule way.
Our safeguards framework mirrors the HIPAA Security Rule’s Administrative, Physical, and Technical categories. The controls below describe the posture we operate under; the implementation specifics, written policies, device inventory, audit-log samples, workforce training records, are shared during BAA review on request.
Administrative
- Workforce HIPAA training before any clinical access
- Written policies, procedures, and sanctions for violations
- Named privacy & security contact for every engagement
- Access reviews and the Minimum Necessary rule
Physical
- Locked workspaces for personnel handling PHI
- Device inventory and controlled hardware disposal
- No printing or local storage of patient records
Technical
- Access via client-controlled EHR / CCM platforms only
- Encrypted transmission of all PHI; MFA on every account
- Audit logging on access to patient information
- HIPAA-eligible email tooling (Google Workspace / Microsoft 365, each under a BAA)
Minimum Necessary, enforced.
Zenith accesses, uses, and discloses only the PHI needed to perform the clinical work in your Business Associate Agreement. No bulk exports, no “just in case” lookups, no analytics on patient records.
Breach notification, within statute.
In the event of a breach of unsecured PHI, we notify your practice without unreasonable delay and within the timeframe required by HIPAA and the governing BAA. Your practice remains responsible for notifying patients and HHS under 45 CFR 164.
Need the audit-ready version?
Our formal HIPAA Statement covers role, safeguards, BAA scope, breach notification language, and contacts in the format your compliance officer expects. Request a sample BAA on the call and we’ll send a redlineable version within two business days.
- Sample BAA based on HHS model provisions
- Named compliance contact for your account
- Monthly summary reports formatted for audit