BUSINESS ASSOCIATE AGREEMENT

Get the paperwork before the sales call, not after.

If you handle protected health information, a signed Business Associate Agreement has to exist before PHI moves — not at the end of a procurement cycle. Request one here and you will have a document to review within one business day. There is no charge, no obligation, and no requirement to have bought anything.

Do not put any PHI in this form. Business contact details only — no patient names, no case detail, no records. Fields on this form are length-capped and will reject anything that looks like case content rather than quietly storing it.

Entity / firm name *

Your name *

Your title

Work email *

Phone

Your role under HIPAA

"Not sure" is a fine answer — it does not slow anything down.

What the work involves

Timing

Anything we should know

We would rather use our own BAA form. Send yours anyway, but expect ours back.

Submitting this form does not create a business associate relationship — a signed agreement does. We will not send you marketing sequences for asking. Prefer email? king@krayon-ai.com or call 813-733-5997.

What you are signing with

You are contracting with KRAYON-AI, LLC, a Florida limited liability company operating from Tampa. Under a BAA we use and disclose PHI only as the agreement permits, apply appropriate administrative, physical and technical safeguards, report security incidents and breaches to you as required, bind any subcontractor to the same terms, and return or destroy PHI at the end of the engagement.

Your records are processed on hardware we own. Documents are not sent to OpenAI, Anthropic, Google, or any other public AI service. There is no cloud model API in the document pipeline. For engagements involving PHI, dedicated hardware — your files never sharing a machine with another client's — is the default rather than an upsell. The full detail is on the security page.

Deletion is on a published schedule. Source documents at 30 days, work product at 90, access logs retained 12 months, and deletion on request completed within five business days and confirmed in writing. See the retention schedule.

If you are a personal injury firm

Records you obtain in litigation are frequently not covered by HIPAA once they are in your hands, so a BAA may not be strictly required for your matters. Many firms want one regardless — because their malpractice carrier asks, because outside-counsel guidelines require it, or because it is simply the cleanest way to document that privileged records were handled properly. We will sign one either way, and we treat the records to the same standard whether or not a BAA applies.