HIPAA and the BAA
How the Business Associate Agreement (BAA) decides whether Fluent stores patient details, and the safeguards every workspace has.
What you'll learn
- How the Business Associate Agreement decides whether Fluent can store patient details for your agency, and what changes without one.
What the BAA is
The BAA is the HIPAA agreement that lets Fluent hold patient health information (PHI) for your agency, such as a patient's name with appointment details.
The Owner signs it on Review agreements, the screen where they also accept the Master Subscription Agreement. A Yes to the PHI question signs the BAA, and Fluent emails the Owner the signed copy as a PDF.
The steps are in Legal agreements and documents.
Once it's signed, the Owner's Settings › Documents shows a Business Associate Agreement (BAA) card marked Active, with HIPAA Mode Enabled. HIPAA Mode Enabled is the only HIPAA status in Fluent.
A BAA covers one agency, and the Owner never has to sign a newer version.
What changes without a BAA
Only 3 fields on an appointment depend on the BAA: the LEP client's Name, Date of Birth, and Phone Number. Everything else works the same.
Without a BAA, appointments show "Patient details are hidden until your agency signs the Business Associate Agreement (BAA)." and Fluent doesn't save those fields.
| Where | Without a BAA | With a BAA |
|---|---|---|
| Appointment form, LEP Client section | Fields hidden behind the notice | Shown and saved |
| Appointment summary | Notice in place of the fields | Shown |
| Mobile app | Patient fields stay blank | Shown to the assigned interpreter |
| Requests from an organization | Arrive without the LEP client's details | Arrive with them |
The notice on the appointment form has a Review agreements button. A save that carries patient details is refused with "Patient details can be saved once the workspace has signed the Business Associate Agreement."
What the BAA doesn't change
Comments, form fields, and customer and site names are never hidden.
Important: Without a BAA, keep patient details out of comments, form fields, and customer and site names. The agreement screen says the same: "Do not enter PHI unless a BAA is in place."
Who sees patient details
Each side sees patient details at a different point.
- Your agency's staff: with a BAA, they see patient details on the appointments their role and teams give them. See Agency roles and permissions and Manage teams.
- Interpreters: never see patient details on an offer. The details appear in the mobile app once the interpreter is assigned.
- Organizations: always see the LEP client fields. When its agency has no BAA, the request reaches the agency without those details, and the organization sees no warning.
Patient details outside the app
With a BAA, the files your agency downloads can carry patient details. Store and share them as PHI.
- Invoice downloads: The invoice PDF, the invoice lines CSV, and the QuickBooks import CSV and Excel files list each LEP client's name and date of birth.
- QuickBooks sync: Invoices synced to QuickBooks Online leave out the LEP client's name and date of birth, because QuickBooks Online isn't HIPAA compliant. See QuickBooks.
- Emails: Appointment emails end with the notice "This email may contain confidential information including PHI."
Safeguards in every workspace
Fluent protects every agency and organization the same way, whether or not a BAA is signed, and no workspace can turn these safeguards off.
- Two-factor authentication: everyone sets it up, and Fluent asks for a code on any device it doesn't trust.
- Sign-out: the web app and the mobile app sign you out after a set time with no activity.
- Exports and invoice PDFs: each asks for a code, and one code covers the next 9 minutes of downloads. Pay statement PDFs, which have no client details, don't ask.
- Records: Fluent records who viewed appointment details and who exported what.
Security overview has the times and where to report an incident.
Troubleshooting
The LEP client's name and date of birth fields are gone
Your agency hasn't signed the BAA. Ask your agency's Owner to sign it on Review agreements.
If the Owner already answered No, see the next problem.
We answered No to the PHI question and now need the BAA
After a No, the app has no screen where the Owner can sign the BAA. Patient fields stay hidden until a BAA is on file.
Important: The screen says "If your needs change, you can sign a BAA later from any appointment form, where patient details ask for one." Once the agreements are accepted, Review agreements on the appointment form doesn't offer the BAA.
Contact support and ask to sign the BAA for your agency.
An organization entered patient details, and we don't see them
Your agency had no BAA when the request arrived, so Fluent saved it without those details. Signing later doesn't bring them back.
Ask the organization to send the details again after your Owner signs the BAA.
I can't find a HIPAA setting
The signed BAA is the switch. The BAA card in Settings › Documents shows HIPAA Mode Enabled.