Business Associate Agreements
Every company that touches client records has signed a BAA
HIPAA requires a Business Associate Agreement before any outside company may handle health information. Here is every one that handles your clients' records, what it does, and since when its BAA has been in place.
| Company | What it does for Waiversoft | BAA |
|---|---|---|
| Supabase | Database, file storage and sign-in — where your agency's records live | Signedsince October 5, 2026 |
| Vercel | Runs the Waiversoft web application and website | Signedsince October 5, 2026 |
| Amazon Web Services | Address lookup for client service locations, and the secure connection to APD's iConnect | Signedsince October 1, 2026 |
| Anthropic | Powers Coworker, the AI assistant | Signedsince July 21, 2026 |
| OpenAI | Coworker voice conversations and voice-to-text | Signedsince July 30, 2026 |
| Google Workspace | Our company email — where messages to our support and security addresses arrive | Signedsince October 5, 2026 |
We also use Resend (delivers Waiversoft's email: sign-in links, invitations, signature and document requests), Stripe (subscription billing) and Google and Meta (website and ad measurement). None of them receive client records, so no BAA is needed. Full list in our Privacy Policy. Last reviewed October 5, 2026.
Built into the product
How Waiversoft protects your data
Each safeguard starts from a real risk an agency faces. They run on every account from the first day — nothing to switch on.
Risk: Another agency seeing your clients
Your agency's data is walled off
Every record is tied to your agency, and the database itself refuses any request for another agency's data — on every single request, not as a setting someone could switch off.
Risk: A stolen or shared password
Only the right people get in
Everyone has their own login. Two-factor sign-in (a code from their phone) is checked on every visit once it's on. A signed-out or removed user can't keep using an old session.
Risk: Staff seeing more than they need
Each role sees only its part
Admins manage the agency. Office staff work the schedule and records. Caregivers see only their own visits and the people they serve — nothing else.
Risk: Not knowing who opened a record
Every look is recorded
Opening, downloading or exporting a document is logged with who and when, and changes to visits and notes are logged too. The trail can't be edited or erased, and it's kept even after someone leaves your agency.
Risk: A document link getting forwarded
A private document vault
Files live in private storage, never on a public link. Opening one creates a single-use link that expires in about a minute.
Risk: Private details sitting in inboxes
Nothing private in emails or notifications
Emails and phone notifications never name your clients or the documents about them — they link back to Waiversoft, where you sign in to see the details.
Risk: A lost or borrowed phone
The iPhone app locks
Turn on Face ID to lock the app whenever it's closed, and records are hidden from the app switcher so they never show over someone's shoulder.
Risk: Records quietly disappearing
Nothing disappears silently
Documents are versioned and kept, and your history stays reconstructable — what you need when an auditor asks you to prove what happened, and when.
Where your data lives
- Stored in the United States, mainly in Amazon Web Services data centers in Oregon
- Encrypted in transit (HTTPS) and encrypted at rest
- Your agency's database is backed up automatically every day
- Documents in private storage — never on a public link
- Your agency owns its records; we never sell them or use them for ads
- Close your account and we delete your personal account information within 30 days; client records are kept only as long as the law requires agencies to keep them
AI held to the same standard
- Coworker runs on AI companies that have signed Business Associate Agreements with us
- They don't use your data to train their models
- It works only inside your own agency's records
- Anything it would create, change or send waits for your confirmation
Independent monitoring
Scanned every day by an outside security platform
Beyond our own tests and reviews, an independent security platform continuously monitors Waiversoft — the code we write, the open-source packages we build on, and the cloud it runs on — against the OWASP Top 10 and the technical safeguards HIPAA's Security Rule expects.
Open-source dependencies
900+ packages checked daily for known vulnerabilities.
Our own code
Scanned daily for security flaws (SAST).
Infrastructure & cloud
Checked daily for misconfigurations.
Secrets
The codebase is scanned so credentials never ship in it.
OWASP Top 10 & HIPAA safeguards
Continuously monitored against both.
Checked on every change
Every change to Waiversoft runs automated checks: our full test suite, database tests that try to reach another agency's data, and a scan of the software we build on for known vulnerabilities. We also review the platform's security ourselves, regularly.
If something goes wrong
We investigate right away and use the locked audit trail to see exactly what was touched. If client information was involved, we tell your agency without unreasonable delay — and never later than the 60 days HIPAA allows.
A BAA with your agency
HIPAA asks your agency to have a Business Associate Agreement with any software that holds client records. We sign one with you — ask on your demo or email security@waiversoft.com.
Shared responsibility
HIPAA is a team effort — here's the honest split
No software makes an agency compliant on its own, and a vendor who promises that isn't being straight with you. We carry the technical load; you own the human side.
What Waiversoft handles
- Encrypting your data in transit and at rest
- Keeping every agency's data isolated from every other
- Logins, roles and two-factor sign-in
- An audit trail of document access that can't be edited or erased
- Private document storage with expiring access links
- Signed Business Associate Agreements with every vendor that handles client records
- Keeping client details out of emails and notifications
- Automated security checks on every change, and regular reviews
What your agency handles
- Turning on two-factor sign-in, and choosing strong passwords
- Deciding who on your team to invite, and their role
- Removing access the day someone leaves
- Never sharing logins, and not emailing client details
- Training your staff and keeping your HIPAA policies and risk assessment current
Waiversoft makes your side easier too, with two-factor sign-in, per-person roles and audit-ready records.
Questions agency owners ask us
Will you sign a Business Associate Agreement with my agency?
Yes. We sign a Business Associate Agreement with any agency that uses Waiversoft for client records. Ask for it on your demo or email security@waiversoft.com.
Is Waiversoft “HIPAA certified”?
There is no official HIPAA certification — the U.S. Department of Health and Human Services doesn't certify software, so be cautious of any vendor that claims one. What matters is whether a system has the safeguards HIPAA's Security Rule requires and signs a BAA with you. Waiversoft does both.
Who owns my agency's data?
Your agency does. We store and protect it to provide the service, and we don't sell it or use it for advertising. If you close your account, we delete your personal account information within 30 days of your request; client records are kept only as long as the law requires agencies to keep them.
Where is my data stored?
In the United States, with established cloud providers that have signed Business Associate Agreements with us — the table on this page names each one. It's encrypted while it travels and while it's stored.
Can the AI assistant see my clients' information?
Coworker, Waiversoft's AI assistant, only works inside your agency's own records, and the AI companies behind it have signed Business Associate Agreements with us. They don't use your data to train their models. Anything Coworker would create, change or send waits for your confirmation first.
What happens if there's a security incident?
We investigate right away, and because access is logged in a trail that can't be edited, we can tell exactly what was touched and when. If client information was involved, we notify your agency without unreasonable delay — never later than the 60 days HIPAA allows — so you can meet your own obligations.
Does using Waiversoft make my agency HIPAA compliant?
It handles the technical part — encryption, access controls, isolation and audit trails. Your agency still owns its side: who you give access to, staff training and your written policies. The two sides together are what HIPAA expects.
Security questions, our BAA, or a concern to report
Email security@waiversoft.com — a person reads every message. Please don't include client details.
This page was last reviewed October 5, 2026.
Keep reading
See every safeguard in your own account
Book a walkthrough and we'll show you how each one works — and bring your compliance advisor if you have one.