BaseCloud is HIPAA compliant, and we sign a Business Associate Agreement (BAA) with your practice. Medical and dental practices, therapists, clinics and insurers can now run their calls, texts, email and patient records in one CRM, with the agreement their compliance team asks for first.
This article covers how to get a BAA account and what changes once you have one, followed by the safeguards behind the claim.
How to get a BAA account
Ask BaseCloud for a BAA through our contact form or your usual BaseCloud contact. We sign the agreement with your practice, and our team switches your account to a BAA account.
Every change to that setting is recorded in your activity log, so your compliance records show exactly when your account became a BAA account.
What changes in a BAA account
Private notifications
In a BAA account, notifications on phones and computers simply say what happened: ‘New message’, ‘Incoming call’, ‘Missed call’ or ‘Upcoming meeting’. Patient and caller details stay off the lock screen and open inside BaseCloud when your team taps the notification.
Mark as done still works from the notification. The BaseCloud Phone app shows the caller once the call reaches the phone, and call history shows who called.
The HIPAA notice in your notification settings
Every user in a BAA account sees a HIPAA notice under Settings > your user > Notifications, above the Push settings. It explains how notifications work in a BAA account, so each person on your team knows why their alerts read the way they do.
AI on providers covered by a BAA
AI in BaseCloud workflows runs on OpenAI and Anthropic, the providers covered by a BAA. Your automations use AI under the same agreement as the rest of your account.
Connect any AI app whose provider has signed a BAA with your practice. Settings > AI Connections reminds every account of this before anything is connected.
Support inside the CRM
BaseCloud support helps BAA accounts inside the CRM itself. Your support conversations and fixes happen in the same protected account as your patient data.
The safeguards behind the claim
BaseCloud put these protections in place across the platform, and they run automatically for every account:
- Audit logs of file access, database activity, sign-ins, key vault reads and admin changes, kept for six years in a tamper-proof, write-once archive closed to the public internet
- Every database statement a person runs is logged
- Microsoft Defender on the servers, the file store, the key vault and the database, with every uploaded file scanned for malware
- API keys and passwords stored encrypted in Settings > App Connections & Keys > Keys, and never shown again to anyone
- Staff reach the phone switches over a private network, with every sign-in recorded by name
- BaseCloud staff access ends automatically the moment someone leaves BaseCloud’s team, open sessions included
- Engineering leads are alerted the moment a sensitive admin change happens
- Daily geo-redundant backups of both phone switches, in the US and South Africa
- Client details stay out of system monitoring, which sees the shape of each request
- Permissions enforced on every action, in the CRM, the Phone app, the API and connected AI apps such as Claude and ChatGPT
- Every BaseCloud cloud resource tracked live against the HITRUST and HIPAA control set of 586 checks
BaseCloud is also CASA Tier 2 certified, and two-factor sign-in is available for every user.
Where to read more
Our security page gathers every safeguard in one place for your compliance team, and the HIPAA page shows how BaseCloud runs a practice’s calls and patient records under a BAA. Ask us for your BAA today and we will switch your account over.