Business Associate Agreement

1. Our BAA Commitment

Falcon Locum executes a Business Associate Agreement (BAA) with every covered entity client that engages our staffing services. We recognize that healthcare facilities entrust us with protected health information (PHI) during the credentialing, onboarding, and staffing process, and we take that responsibility seriously.

2. Scope of the BAA

Our standard BAA covers:

• Permitted uses and disclosures: PHI is used solely for credentialing, compliance verification, and staffing placement purposes.
• Safeguards: We implement administrative, physical, and technical safeguards including AES-256-GCM encryption at rest, TLS 1.3 in transit, multi-factor authentication on all provider dashboards, and role-based access controls.
• Breach notification: We notify covered entities of any breach of unsecured PHI within 24 hours of discovery, in compliance with 45 CFR § 164.410.
• Subcontractor obligations: All subprocessors that handle PHI are bound by equivalent BAA terms.
• Return or destruction of PHI: Upon termination, we return or securely destroy all PHI within 30 days unless retention is required by law.
• Audit rights: Covered entities may audit our compliance with BAA terms upon reasonable notice. All data access events are logged to an immutable audit ledger.

3. Technical Safeguards

Our HIPAA-compliant infrastructure includes:

• End-to-end encryption for all clinician records (AES-256-GCM)
• Multi-factor authentication (TOTP) enforced on all provider dashboard access
• Immutable audit logging with SHA-256 hash chain integrity verification
• Automated primary-source credential verification via NPDB, state board, and DEA APIs
• Role-based access controls with principle of least privilege
• Encrypted backups with restricted key access
• Incident response plan with ≤24-hour breach notification

4. How to Request a BAA

To execute a Business Associate Agreement with Falcon Locum, submit the form below or contact our compliance team directly at [email protected]. We will provide our standard BAA template within one business day. Custom BAA terms are available upon request.

5. Existing BAA Holders

If you already have a BAA on file with Falcon Locum and need to amend, renew, or terminate it, contact your account executive or email [email protected].

6. Compliance Resources

For more information about our data practices, review our Data Handling & HIPAA Compliance disclosure and our Privacy Policy.