Return to dashboard

Business Associate Agreement

Policy Version: 2026-03-09 Document Revision: 2 Effective Date: March 9, 2026

This Business Associate Agreement ("BAA") is a limited-scope BAA entered into by Proveer Practice Management, LLC ("Proveer" or "Business Associate") for the benefit of each dental practice ("Practice" or "Covered Entity") that accepts Proveer's Terms of Service. This BAA covers PHI that Proveer may access via API in providing the Practice Signals Dashboard (the "Service").

1. Scope

Proveer connects to the Practice's Open Dental environment via API to retrieve operational and financial performance data used in the Service. Proveer may access PHI via API as necessary to provide the Service. Proveer is designed to minimize retention of PHI in Proveer-controlled systems and is not intended to maintain a long-term PHI store except as technically necessary for service operation. Proveer does not intend for the Service to serve as a PHI repository or designated record set.

2. Business Associate Obligations

Proveer will:

  • Use and disclose PHI only as permitted by this BAA, the Terms, or applicable law.
  • Apply the minimum necessary standard when using or disclosing PHI.
  • Implement reasonable administrative, physical, and technical safeguards to protect the confidentiality, integrity, and availability of PHI.
  • Report known or reasonably suspected impermissible uses or disclosures and security incidents involving PHI without unreasonable delay and in no event later than thirty (30) days after discovery.
  • Bind subcontractors that access PHI on Proveer's behalf to obligations substantially similar to those in this BAA.
  • Make available information required for the Practice to fulfill its obligations to provide access to, amend, or account for disclosures of PHI, to the extent such information is in Proveer's possession.
  • Make internal practices, books, and records relating to the use and disclosure of PHI available to the Secretary of the U.S. Department of Health and Human Services for purposes of determining compliance with HIPAA.
  • If Proveer becomes aware that PHI has been retained in Proveer-controlled systems beyond what is intended or necessary for the Service, use reasonable efforts to promptly remove or securely destroy that PHI and mitigate further retention or use.

3. Permitted Uses and Disclosures

Proveer may use or disclose PHI only as needed to perform services under the Terms, comply with applicable law, support Proveer's proper management and administration, and provide data aggregation services as permitted by HIPAA.

4. Practice Responsibilities

The Practice is responsible for workforce access management and prompt deprovisioning of former users. The Practice bears responsibility for unauthorized access that persists due to failure to revoke access in a timely manner.

5. Term and Termination

This BAA is effective when the Practice accepts Proveer's Terms and remains in effect while services are active. Upon termination, Proveer will return or destroy PHI in Proveer's possession where feasible. Where return or destruction is not feasible, Proveer will continue to protect such PHI under the terms of this BAA for as long as it is retained.

6. Updates

Proveer may update this BAA. A new BAA version applies prospectively and requires re-acceptance before continued use. Non-material document corrections (typos, formatting, clarifications) may increment document revision without requiring re-acceptance.

7. Regulatory Compliance

Business Associate acknowledges direct liability under the HITECH Act for applicable HIPAA Security Rule and Privacy Rule provisions. To the extent that future amendments to HIPAA or the HITECH Act impose requirements on this BAA, this BAA shall be deemed amended as necessary to satisfy those requirements.

8. General

This BAA is governed by Michigan law to the extent not preempted by HIPAA. It is incorporated with and subject to the Terms of Service. Proveer may assign or transfer this BAA and all rights and obligations under it without consent, whether by merger, acquisition, asset sale, reorganization, change of control, or otherwise; the assignee assumes all Business Associate obligations under this BAA. If any provision of this BAA is held unenforceable, the remaining provisions remain in full effect.