This Business Associate Agreement ("BAA") is between Wren Clinical LLC, a Washington limited liability company ("Business Associate" or "Wren Clinical"), and the mental health practice that holds a WrenEHR account ("Covered Entity").
Covered Entity agrees to this BAA when the person creating its WrenEHR account – or, for an account created before this BAA was first published, a Practice administrator – accepts it on Covered Entity's behalf. Business Associate records who accepted, when, and which version. This BAA is entered into pursuant to the Health Insurance Portability and Accountability Act of 1996 and the Health Information Technology for Economic and Clinical Health Act, and the regulations promulgated thereunder (collectively, "HIPAA"), and is incorporated into and governed by the WrenEHR Terms of Service.
A1. Definitions
Terms used but not otherwise defined in this BAA have the same meaning as in the HIPAA Rules (45 CFR Parts 160 and 164).
"HIPAA Rules" means the Privacy, Security, Breach Notification, and Enforcement Rules at 45 CFR Parts 160 and 164, as amended by the HITECH Act.
"PHI" means Protected Health Information as defined at 45 CFR § 160.103, limited to PHI that Business Associate creates, receives, maintains, or transmits on behalf of Covered Entity in connection with the Platform.
"ePHI" means PHI that is created, received, maintained, or transmitted in electronic form.
"Breach" has the same meaning as in 45 CFR § 164.402.
"Security Incident" has the same meaning as in 45 CFR § 164.304.
"Subcontractor" means any third party engaged by Business Associate that creates, receives, maintains, or transmits PHI on behalf of Business Associate.
"Client" means an individual who receives mental health services from Covered Entity. "Client" corresponds to the term "individual" as used in the HIPAA Rules (45 CFR Part 164). Where a provision of this BAA references a HIPAA regulation that uses the statutory term "individual," that regulation's language controls for purposes of that provision.
"Authorized User" means an individual whom Covered Entity has invited to use its WrenEHR account.
"Platform" means WrenEHR, the electronic health record and practice-management platform that Business Associate operates at ehr.wrenclinical.com – including its clinician application, client portal, telehealth rooms, the Wren Recorder browser extension when connected to WrenEHR, any WrenEHR mobile application Business Associate makes available, and related services.
"Session Audio" means audio of a clinical session captured by the Platform – through the in-app recorder (including in a telehealth room), the Wren Recorder browser extension, or a WrenEHR mobile application – or uploaded by an Authorized User, and processed for transcription. The obligations of this BAA apply identically to Session Audio however it was captured.
"Support Session" means a time-limited session in which Business Associate's personnel use Covered Entity's account through the Platform, as described in Section A3.12.
A2. Permitted Uses and Disclosures of PHI
A2.1 Permitted Uses
Business Associate may use PHI only as necessary to provide the Platform services, including:
(a) maintaining Covered Entity's electronic health records and practice-management functions, including client records, scheduling, clinical documentation, psychotherapy notes and notebooks (including pairing with WrenEHR mobile applications), forms and electronic signatures, billing, reporting and analytics, and the client portal;
(b) generating AI-assisted clinical documentation drafts, answers, search filters, summaries, and suggestions via AWS Bedrock, at the request of Authorized Users or as Covered Entity's settings direct, including reading images of handwritten notes and documents that Authorized Users submit, and reformatting an Authorized User's draft notes at that user's request;
(c) producing transcripts from Session Audio, and from Authorized Users' dictation, using third-party transcription services (AssemblyAI);
(d) storing Ask Wren conversations for the Authorized User who created them for twenty-four (24) hours after the conversation's last message, and in-progress drafts of AI-assisted documentation guides for about ten (10) days after they were last saved;
(e) importing records that Covered Entity provides from another system, and retaining a working copy of that source data so that Covered Entity can review and undo the import;
(f) sending email and text messages to Clients and their parents or guardians on Covered Entity's behalf as Covered Entity configures, including appointment reminders and notices, portal invitations, document and billing notices, birthday greetings, and messages Authorized Users send to selected Clients;
(g) operating telehealth sessions between Covered Entity's Authorized Users and Clients;
(h) preparing and transmitting insurance eligibility inquiries, claims, claim status inquiries, and payer enrollments, and receiving payer responses, acknowledgments, and remittance advice, at Covered Entity's direction;
(i) facilitating card payments between Clients and Covered Entity through Covered Entity's own payment-processing account;
(j) publishing calendar feeds and add-to-calendar links that Authorized Users or Clients choose to use;
(k) performing administrative functions such as tenant isolation, usage metering, audit logging, backup, and security monitoring;
(l) providing customer support directly related to Covered Entity's use of the Platform, including through Support Sessions, and handling support messages, help-assistant conversations, and feedback (including screenshots) that Authorized Users send to Business Associate; and
(m) for the proper management and administration of Business Associate and to carry out its legal responsibilities, as permitted by 45 CFR § 164.504(e)(4).
A2.2 Permitted Disclosures
Business Associate may disclose PHI: (a) as necessary to Subcontractors in accordance with Section A5; (b) to Clients, their parents or guardians, insurance payers, and other recipients as directed by Covered Entity through its use and configuration of the Platform, including through the client portal, client messages, insurance transactions, and calendar links and feeds; (c) as required by law; (d) for the proper management and administration of Business Associate or to carry out its legal responsibilities, provided that disclosures are required by law or Business Associate obtains reasonable written assurances from the recipient that the information will remain confidential and be used or further disclosed only as required by law or for the purpose for which it was disclosed, and that the recipient will notify Business Associate of any instance in which the confidentiality of the information has been breached; or (e) as otherwise directed in writing by Covered Entity.
Payment processing. Business Associate discloses to Covered Entity's payment processor (Stripe) only what processing Clients' card payments requires: payment amounts; card details and billing ZIP codes, which are entered in the browser and sent directly to Stripe; internal record identifiers for Covered Entity, the Client, and the invoice; and Covered Entity's business profile, which identifies it as a provider of outpatient mental health services. Business Associate does not send Stripe Client names, contact information, diagnoses, service codes, or dates of service. These disclosures are made within the payment-processing activities described in Section 1179 of HIPAA (42 U.S.C. § 1320d-8).
A2.3 Prohibited Uses
Business Associate shall not: (a) use or disclose PHI for any purpose not expressly permitted by this BAA or required by law; (b) use PHI, including Session Audio, transcripts, Ask Wren conversations, clinical notes, or generated documentation, to train, fine-tune, benchmark, or otherwise improve any AI model; (c) sell PHI or use PHI for marketing or advertising purposes; or (d) use PHI in a manner that would violate the HIPAA Privacy Rule if done by Covered Entity, except as permitted by Section A2.1(m).
A2.4 Minimum Necessary
Business Associate will use, disclose, and request only the minimum amount of PHI necessary to accomplish the intended purpose, consistent with 45 CFR § 164.502(b) and the HITECH Act.
A3. Obligations of Business Associate
A3.1 Safeguards
Business Associate will implement and maintain appropriate administrative, physical, and technical safeguards to protect the confidentiality, integrity, and availability of ePHI, in compliance with the HIPAA Security Rule (45 CFR Part 164, Subpart C). Specific safeguards include: encryption at rest (AES-256) for stored ePHI, including databases, file storage, and backups; encryption in transit (TLS) between users' browsers and the Platform and between the Platform and its Subcontractors; separation of each covered entity's data enforced in the database by row-level security; role-based access controls within Covered Entity's account; automatic sign-out after inactivity; audit logging of access to and changes in PHI; threat detection, and a web application firewall in front of the Platform's web application and API; and continuous database backups, with monthly database backups copied to a second United States region, and version history for stored files. Email and text messages to Clients are delivered over standard email and carrier networks, which may not be encrypted end to end.
A3.2 No Unauthorized Use or Disclosure
Business Associate will not use or disclose PHI other than as permitted or required by this BAA or as required by applicable law.
A3.3 Workforce
Business Associate will ensure that its workforce members who access PHI are trained on and comply with the requirements of this BAA and the HIPAA Rules.
A3.4 Reporting – Impermissible Uses and Disclosures, and Security Incidents
Business Associate will report to Covered Entity any use or disclosure of PHI not provided for by this BAA, and any Security Incident, of which it becomes aware, without unreasonable delay and in no event later than thirty (30) days after discovery. The parties acknowledge that attempted but unsuccessful Security Incidents occur routinely (e.g., port scans, failed login attempts) and that ongoing notice of such incidents is hereby deemed provided unless Covered Entity requests a specific report.
A3.5 Reporting – Breach
Business Associate will notify Covered Entity of any Breach of Unsecured PHI without unreasonable delay and in no event later than thirty (30) days after discovery. For purposes of this Section, a Breach is treated as discovered as of the first day on which the Breach is known to Business Associate or, by exercising reasonable diligence, would have been known to Business Associate, consistent with 45 CFR § 164.410(a)(2). Notification will include, to the extent reasonably available: (a) identification of individuals whose PHI was or is believed to have been affected; (b) a description of the Breach, including the date of the Breach and the date of discovery; (c) the types of PHI involved; (d) steps Covered Entity should take to protect affected individuals; (e) steps Business Associate has taken to investigate and mitigate the Breach and to protect against further Breaches; and (f) contact information for Business Associate. Business Associate will supplement the notification promptly as further information becomes available. Notice to Covered Entity satisfies Business Associate's breach notification obligation; Covered Entity is responsible for notifying affected individuals and HHS as required by HIPAA.
A3.6 Access and Amendment
The Platform maintains PHI in Covered Entity's Designated Record Set. Business Associate makes that PHI available to Covered Entity, for purposes of 45 CFR §§ 164.524 and 164.526, through the Platform itself: Covered Entity's Authorized Users can view, amend, and export it directly. Covered Entity is responsible for responding to Clients' requests for access and amendment. If a technical problem with the Platform prevents Covered Entity from providing or amending PHI, Business Associate will, upon Covered Entity's written request, make the affected PHI available or make the amendment Covered Entity directs within a reasonable time that allows Covered Entity to meet its obligations under those sections.
A3.7 Accounting of Disclosures
Business Associate will document disclosures of PHI that it makes and that would be subject to an accounting under 45 CFR § 164.528, and will make that information available to Covered Entity upon written request, within a reasonable time that allows Covered Entity to provide an accounting of disclosures. The Platform's audit log, which Covered Entity's administrators can view and export, records access to and changes in PHI by Authorized Users and by Business Associate's personnel during Support Sessions.
A3.8 Obligations Carried Out for Covered Entity
To the extent Business Associate carries out any of Covered Entity's obligations under Subpart E of 45 CFR Part 164, Business Associate will comply with the requirements of Subpart E that apply to Covered Entity in the performance of those obligations.
A3.9 HHS Access
Business Associate will make its internal practices, books, and records relating to PHI available to the Secretary of HHS upon request for purposes of determining compliance with HIPAA.
A3.10 Tenant Isolation
Business Associate processes PHI on behalf of multiple covered entities. Business Associate maintains logical separation of PHI between covered entities, enforced in the database by row-level security, and will not commingle PHI across covered entities.
A3.11 Audit Controls
Consistent with 45 CFR § 164.312(b), the Platform records an audit log of activity in Covered Entity's account, including sign-ins by Authorized Users and Clients; access to Client records (one entry per user per Client within a fifteen-minute period); opening of specific notes and documents; downloads of documents and PDFs and exports of the audit log; and the creation, change, signing, co-signing, unlocking, and deletion of records. Each entry records the user, time, IP address, and a request identifier, and entries made during a Support Session are marked as such. Audit entries contain identifiers and event types, not the content of records. Covered Entity's administrators can view and export the audit log in the Platform. The audit log is retained for the life of Covered Entity's account, and the Platform's application database role is permitted only to add audit entries, not to change or delete them. Business Associate also keeps logs of administrative actions it takes on Covered Entity's account and of activity in its cloud infrastructure.
A3.12 Support Access
Business Associate's personnel will use Covered Entity's account through Support Sessions only (a) to respond to a support request from Covered Entity or its Authorized Users, (b) to investigate or resolve a Security Incident or a defect affecting Covered Entity, or (c) as required by law. A Support Session may be started only by Business Associate personnel authorized to do so, requires a stated reason, and ends automatically after sixty (60) minutes. During a Support Session, personnel cannot use the Platform's functions to sign, co-sign, unlock, or delete notes, or to delete or merge Clients. Actions taken during a Support Session are recorded in Covered Entity's audit log and identified in the Platform as performed by Wren Support.
Business Associate's personnel do not otherwise access PHI in Covered Entity's account, except (i) PHI that Authorized Users include in support messages, help-assistant conversations, or feedback (including screenshots) they send to Business Associate, and (ii) as necessary to operate, secure, maintain, back up, and restore the Platform, including work an Authorized User requests.
A4. Obligations of Covered Entity
A4.1 Lawful Instructions
Covered Entity will not request Business Associate to use or disclose PHI in a manner that would not be permissible under the HIPAA Rules if done by Covered Entity.
A4.2 Notice of Privacy Practices
Covered Entity is responsible for maintaining and providing its own Notice of Privacy Practices to Clients as required by 45 CFR § 164.520 (which uses the statutory term "individuals").
A4.3 Client Authorizations and Consents
Covered Entity is responsible for obtaining any required Client authorizations before submitting PHI to the Platform; for obtaining any consents required by applicable federal, state, and local recording, wiretapping, two-party consent, and telehealth recording laws before capturing Session Audio, and for informing session participants of recording, which the Platform does not do; and for obtaining any consents required by law before the Platform sends text or email messages to Clients on its behalf.
A4.4 Notification of Changes
Covered Entity will notify Business Associate of any restriction on the use or disclosure of PHI that Covered Entity has agreed to under 45 CFR § 164.522, to the extent that such restriction affects Business Associate's obligations.
A4.5 Access Configuration
Covered Entity is responsible for the access settings it controls in the Platform, including Authorized Users' roles, supervision relationships and co-signature settings, chart and caseload sharing, which additional users may unlock signed notes (a note's author, the Client's assigned clinician, and administrators always may), which Authorized Users may use AI features, its transcript retention period, whether AI processing is kept in the United States, and what is shared through the client portal. Covered Entity is responsible for promptly removing access for Authorized Users who should no longer have it.
A4.6 Psychotherapy Notes and Part 2 Records
The Platform lets Covered Entity keep psychotherapy notes separately from other records, does not show them in the client portal, and includes them in an export only when the Authorized User exporting chooses to include them. Any Authorized User with access to a Client's chart can view and edit them, AI features can read them when an Authorized User's request calls for them, and Business Associate's personnel can view them during a Support Session. Covered Entity is responsible for its designation of and access to psychotherapy notes.
The Platform does not currently provide controls specific to 42 CFR Part 2. Covered Entity is responsible for determining whether any records it maintains in the Platform are subject to Part 2 and for complying with Part 2's requirements for them. To the extent Business Associate receives, stores, processes, or otherwise deals with patient records from a Part 2 program, Business Associate acknowledges that it is fully bound by 42 CFR Part 2 with respect to those records; will, if necessary, resist in judicial proceedings any efforts to obtain access to them except as permitted by Part 2; and will not use or disclose them in proceedings against the patient except as Part 2 permits. This paragraph is intended to serve as a qualified service organization agreement under 42 CFR §§ 2.11 and 2.12(c)(4).
A4.7 Professional Responsibility
Covered Entity acknowledges that AI-generated documentation and third-party-generated transcripts produced by the Platform are drafts only. Covered Entity is solely responsible for the accuracy, completeness, and clinical appropriateness of all documentation before clinical use or submission to any payer, regulator, or other party.
A5. Subcontractors
Business Associate will ensure that any Subcontractor that creates, receives, maintains, or transmits PHI on behalf of Business Associate is bound by written obligations that are at least as restrictive as those in this BAA, including compliance with the HIPAA Security Rule, consistent with 45 CFR §§ 164.308(b), 164.314(a)(2)(iii), and 164.502(e).
Business Associate's current Subcontractors that process PHI are Amazon Web Services (for compute, storage, databases, backups, email and text-message delivery, telehealth media, client portal sign-in, and AI model access via Bedrock), AssemblyAI (for transcription of Session Audio and dictation), and Stedi (as health care clearinghouse for insurance transactions). Business Associate has executed a HIPAA-compliant Business Associate Agreement with each.
The complete list of Subcontractors, including those that do not process PHI, is maintained at ehr.wrenclinical.com/legal/subprocessors. Business Associate will update this list as Subcontractors change and will provide notice to Covered Entity of material changes involving Subcontractors that process PHI.
A6. Data Retention, Return, and Destruction
A6.1 Retention During Term
The Platform is Covered Entity's system of record. Business Associate will retain PHI for the term of this BAA, except as Covered Entity deletes it or as follows, and as further described in the Privacy Policy:
- Session Audio is deleted from Business Associate's storage after the transcript is saved, and Business Associate requests deletion of the transcription job from AssemblyAI. Audio that fails to transcribe or is abandoned is automatically destroyed by a storage lifecycle rule, generally within seven (7) days.
- Session transcripts are retained for the period Covered Entity selects – seven (7), thirty (30), or ninety (90) days, or indefinitely; thirty (30) days by default – measured from when the transcript was completed or last changed, then removed from view, restorable for seven (7) days, and permanently destroyed.
- Ask Wren conversations are destroyed twenty-four (24) hours after their last message.
- Guide editor drafts are destroyed within about ten (10) days after they were last saved.
- Source files uploaded for import are deleted fourteen (14) days after upload, and any remaining copy is purged from version storage within a few days after that. The working copy of imported source data is retained for the term to permit review and undo of the import.
- Support messages, help-assistant conversations, and feedback that Authorized Users send to Business Associate are retained for the term.
Versioned storage and backups. When PHI stored as a file is deleted through the Platform, the file and its stored prior versions are deleted from active storage. Where a file is replaced, or deleted by an automatic expiration rule, its prior versions are retained for no more than three hundred sixty-five (365) days and then permanently purged. PHI deleted from the database remains in encrypted database backups until they expire – continuous backups after thirty-five (35) days, monthly backups after one (1) year, and annual backups after three (3) years. Backups are locked against early deletion. PHI in backups remains subject to all safeguards and use-and-disclosure limitations of this BAA until it is destroyed.
A6.2 Return and Destruction Upon Termination
Upon termination of the Platform services for Covered Entity, in satisfaction of 45 CFR § 164.504(e)(2)(ii)(J):
- Return. For ninety (90) days after Covered Entity's account is closed, Covered Entity's administrators can sign in to view its PHI and download a complete export of it in commonly used electronic formats from the Platform; nothing can be added or changed during that period, and Covered Entity's other Authorized Users and its Clients have no access. Business Associate does not otherwise deliver copies. During that period the PHI remains subject to all safeguards and use-and-disclosure limitations of this BAA.
- Destruction. When that ninety-day period ends, or sooner upon Covered Entity's written request after closure, administrators' access ends and Business Associate will permanently destroy the PHI in the Platform's active systems and, on request, certify the destruction in writing. PHI in backups is destroyed as those backups expire under Section A6.1.
Because PHI in backups cannot feasibly be destroyed before the backups expire, Business Associate will extend the protections of this BAA to that PHI, and to any other PHI whose return or destruction is not feasible, for as long as it is retained, and will not use or disclose it except for the purposes that make return or destruction infeasible or as required by law.
A6.3 Data Flows Not Stored by Business Associate
Session Audio is held in Business Associate's storage only until its transcript is saved, as described in Section A6.1. Dictation audio streams directly from the Authorized User's browser to AssemblyAI and is never stored on Business Associate's infrastructure. Content submitted to AWS Bedrock is not retained by AWS or Anthropic beyond processing the request, and Business Associate does not enable Bedrock's model-invocation logging. Telehealth audio and video are carried by the Amazon Chime SDK and are not recorded by Business Associate, except as Session Audio that an Authorized User chooses to capture in the room; messages sent in a telehealth room's chat are not stored.
A7. Term and Termination of BAA
A7.1 Term
This BAA is effective as of the earlier of the date Covered Entity accepts it and the date Business Associate first creates, receives, maintains, or transmits PHI on Covered Entity's behalf, and remains in effect until all PHI in Business Associate's possession has been returned or destroyed, or until terminated as set forth herein.
A7.2 Termination for Cause
Either party may terminate this BAA if the other party has materially violated a term of this BAA and has not cured the violation within thirty (30) days of receiving written notice identifying the violation. Covered Entity may terminate immediately if it determines that cure is not possible. Termination of this BAA also terminates the Terms of Service as to Covered Entity, and Covered Entity's PHI is then returned or destroyed under Section A6.2.
A7.3 Termination on Platform Discontinuation
If Business Associate discontinues the Platform, this BAA terminates on the date the Platform ceases operation, subject to the return and destruction obligations in Section A6.2.
A7.4 Effect of Termination
Sections A1 (Definitions), A2.3 (Prohibited Uses), A3 (Obligations of Business Associate), A5 (Subcontractors), A6 (Data Retention, Return, and Destruction), A7.4 (this Section), and A9 (Miscellaneous) of this BAA survive termination for as long as Business Associate retains any PHI.
A8. Updates to This BAA
Wren Clinical may update this BAA by posting a revised version at ehr.wrenclinical.com/legal/baa. A revised BAA takes effect for Covered Entity when one of Covered Entity's administrators accepts it on Covered Entity's behalf, which the Platform asks them to do when they next sign in; until then, the version Covered Entity last accepted continues to apply. If Covered Entity does not agree to a revised BAA, it may close its account, and its PHI will be returned or destroyed under Section A6.2. Wren Clinical will update this BAA as necessary to comply with future changes to applicable law, including any regulations adopted pursuant to HIPAA.
A9. Miscellaneous
A9.1 Interpretation. This BAA will be interpreted to permit compliance with the HIPAA Rules. Any ambiguity will be resolved in favor of a meaning that permits HIPAA compliance. In the event of a conflict between this BAA and the Terms of Service with respect to PHI, this BAA controls.
A9.2 Regulatory References. A reference to a section of the HIPAA Rules means the section as in effect or as amended.
A9.3 No Third-Party Beneficiaries. This BAA is for the sole benefit of the parties. Nothing in this BAA creates any rights in any Client or other third party.
A9.4 Governing Law. This BAA is governed by the laws of the State of Washington and applicable federal law, including HIPAA.
A9.5 Entire Agreement as to PHI. This BAA, together with the Terms of Service, constitutes the entire agreement between the parties with respect to PHI and supersedes any prior agreements on the same subject.