A signed BAA before go-live
Alors is a HIPAA Business Associate to every practice it serves. Each practice signs Alors’s Business Associate Agreement from the Compliance page of its dashboard, and Alors doesn’t go live for a practice, or receive any patient data from it, until that’s done. No contract to chase down: review the exact terms, sign, and download a signed, dated copy for your compliance file at any time.
Safeguards in place
- Implement administrative, physical, and technical safeguards to protect PHI from unauthorized use or disclosure
- Encrypt PHI in transit using TLS 1.2 or higher and at rest using AES-256 encryption
- Maintain role-based access controls limiting PHI access to authorized personnel only
- Conduct regular security risk assessments and remediate identified vulnerabilities
- Maintain audit logs of access to PHI and review them regularly
- Ensure all workforce members receive HIPAA privacy and security training
Subprocessors are under BAAs too
Every vendor Alors relies on that touches PHI, including voice AI, hosting, and the practice-management integration, is bound by its own BAA with Alors, consistent with HIPAA’s requirements for subcontractors. Alors remains responsible for those vendors’ handling of PHI. The full, current list is public.
Questions
For compliance questions, a copy of the BAA for your records, or to report a potential incident, email support@alorsai.com.