HIPAA and your relationship with Cortexa

Why a business associate agreement matters

HHS identifies billing, data analysis and practice management as examples of functions that can create a business associate relationship when they involve protected health information (patient information covered by HIPAA). A BAA establishes allowed uses and the responsibilities for safeguarding that information.

For a practice using Cortexa, begin with the service being purchased. Analytics access and a front desk or billing workflow may involve different people, systems and fields. The agreement and access plan should match that scope before information is transferred.

What to review in the agreement

Patient information and AI training

The standard BAA promises that patient information will not be used to train AI models. It also limits what work can be done with that information and who can access it. Those protections apply even when an approved service uses AI.

If your organization has a specific AI review process, bring it into the service conversation. We can connect the question to the actual use and agreement rather than relying on a broad label such as “AI enabled.”

Who can see which information?

Cortexa’s policy ties access to the assigned role and required information. Front desk staff need enough information to coordinate an administrative next step. Billing staff need claim and payment information. Clinical questions and treatment decisions remain with the practice’s clinicians.

Staff training is required before access to patient information and must be refreshed annually. The security page describes authentication, encryption, logging and other safeguards around the service.

The practice also has a role in establishing who is authorized to grant access and in notifying Cortexa when the account’s requirements change. An accurate setup is easier to maintain when each side knows which decisions it owns.

Prepare the relationship in a clear sequence

1. Define the service.

   Identify the analytics and operating functions the practice wants Cortexa to perform.

2. Agree the information flow.

   Establish the EHR, required information, people and permissions.

3. Complete the agreements.

   Review the service terms and applicable BAA with the account’s requirements in view.

4. Connect and check the result.

   Use the agreed secure process, then verify access and reporting before relying on the new workflow.

Use this overview to start the right discussion

This page explains the relationship; the executed agreement determines the contractual terms for your practice. Begin through Cortexa’s contact page with your EHR, intended services and any specific review requirements. The connection guide explains the practical onboarding steps.