HIPAA & Business Associate Agreement

1. Our Role Under HIPAA

EMS agencies, hospitals, and other healthcare organizations that use RescueLink EMS are typically HIPAA covered entities. When we create, receive, maintain, or transmit PHI on their behalf (for example, call records, patient care reports, insurance details, and messages), Nexus Link, LLC (doing business as RescueLink EMS) acts as their Business Associate. Where a customer is itself a business associate of another covered entity, we act as its subcontractor business associate.

2. The BAA Comes With Every Subscription

Our Business Associate Agreement is attached as Exhibit A to the Software Services Agreement every customer accepts when they subscribe. There is no separate form to request or sign: it takes effect with the agreement, and the signed copy is included in the executed agreement PDF. If your organization requires its own BAA form, contact us and we will review it.

3. What the BAA Commits Us To

• Permitted uses only: we use and disclose PHI only to provide the Services, as the agreement allows, or as required by law.
• Safeguards: we maintain administrative, physical, and technical safeguards and comply with the HIPAA Security Rule for electronic PHI. See our Security page.
• Minimum necessary: we limit our use and disclosure of PHI to the minimum necessary for the purpose.
• Breach reporting: we report breaches of unsecured PHI to you without unreasonable delay, and no later than 60 calendar days after discovery, along with the information you need for your own notifications.
• Subcontractors: any subcontractor that handles PHI for us must agree in writing to restrictions at least as strict as ours.
• Individual rights: we help you meet patients' rights to access and amend their records and to receive an accounting of disclosures.
• Return or destruction: when the agreement ends, we return or destroy PHI as the BAA describes, subject to legal retention requirements.
• Government review: we make our practices and records about PHI available to HHS when required.

4. Your Responsibilities

HIPAA compliance is shared. As the covered entity, your organization is responsible for:

• Giving each user only the roles and access their job requires, and removing access promptly when people leave.
• Training staff on HIPAA and your own privacy policies.
• Protecting devices used to reach the Services, including phones and tablets in the field.
• Obtaining any patient consents or authorizations your use of PHI requires.
• Telling us promptly if you suspect unauthorized access to your account.

5. Subprocessors That May Handle PHI

We rely on a small number of service providers to run the Services. Those that may handle PHI are bound by a business associate agreement or equivalent written terms. They include our cloud hosting provider (DigitalOcean), insurance clearinghouse (Stedi), and AI provider for narrative review (Anthropic), along with the other services listed in our Privacy Policy. Where a feature does not need patient identifiers, such as AI narrative review, we remove them before sending data.

6. Patients

If you are a patient and want to access, correct, or ask about your health information, please contact the EMS agency or facility that cared for you. They control your records and can act on your request; we will help them do so. You can also reach us using the details below.

7. Contact

For questions about HIPAA, our BAA, or to report a suspected privacy issue:

You may also file a HIPAA complaint with the U.S. Department of Health and Human Services Office for Civil Rights at hhs.gov/ocr.