What does HIPAA mean for Salva?
HIPAA governs how Protected Health Information (PHI) is collected, stored, and shared. Salva handles PHI any time a patient talks to it — names, phone numbers, symptoms, treatment context.
To stay compliant, two things have to be true:
- The technology is designed so PHI is encrypted, access-controlled, audited, and retained only as long as needed.
- The legal agreement between you (the covered entity) and us (your business associate) is in place — that's the BAA.
We do both.
What does the BAA cover?
A BAA is a written agreement that defines what we will and won't do with your patients' PHI. Ours covers:
- Permitted uses (running the service you signed up for, nothing more)
- Safeguards (encryption in transit and at rest, access controls, audit logs)
- Breach notification obligations
- Subcontractor pass-through (any third-party processors are bound by the same terms)
- Return or destruction of PHI on termination
It's modeled on the HHS-recommended template, with edits specific to how Salva operates.
Which plans are eligible for a BAA?
| Plan | BAA available? |
|---|---|
| Basic | No — Basic is chat-only and not intended for PHI |
| Pro | Yes |
| Growth | Yes |
If you need PHI coverage and you're on Basic, upgrade to Pro before requesting the BAA.
How do you request a BAA?
Email support@getsalvaai.com with the subject "BAA request" and include:
- Your practice name
- The Salva account email
- Your business legal entity (LLC, PC, etc.)
- The signer's name and email
You'll get a docusign-ready document within two business days. Sign, return, and you're covered.
- Confirm you're on Pro or GrowthBasic is chat-only and not eligible. Upgrade to Pro before requesting if needed.
- Email support@getsalvaai.comSubject line: 'BAA request'. Include your practice name, Salva account email, business legal entity (LLC, PC, etc.), and the signer's name and email.
- Receive the docusign documentTurnaround is typically under two business days. You'll get a pre-filled document ready to sign.
- Sign and returnOnce signed and returned, you're covered. Keep a copy in your compliance records.
Which subprocessors are involved?
Salva relies on a handful of well-known third-party vendors to operate (hosting, voice infrastructure, payments, AI providers). Each one is bound by a BAA or equivalent before any PHI ever flows to them. The full current list is on the BAA page and privacy policy.
What doesn't a BAA do?
A BAA is a contractual layer. It doesn't override technical controls or remove your own HIPAA obligations as a covered entity. You still need to:
- Train staff on PHI handling
- Maintain your own access controls inside your practice
- Conduct security risk assessments per HHS guidance
For Salva's technical security controls — encryption, RLS, audit logs — see How Salva protects your data.
Published May 23, 2026