Business Associate Agreement

Version 2026-10-29

1. Parties and purpose

This Business Associate Agreement (the “BAA”) is between the dental practice that accepts it (the “Practice” or “Covered Entity”) and SmileDesk LLC, a California limited liability company (Secretary of State file number B20260415105) (“SmileDesk” or “Business Associate”). SmileDesk provides a virtual receptionist service to the Practice under the SmileDesk Service Agreement (the “Service Agreement”), and in doing so creates, receives, maintains, and transmits Protected Health Information on the Practice's behalf. This BAA is entered into to satisfy the Health Insurance Portability and Accountability Act of 1996 (HIPAA), the Health Information Technology for Economic and Clinical Health Act (HITECH), and their implementing regulations at 45 CFR Parts 160 and 164, including 45 CFR 164.504(e) and the 2013 Omnibus Final Rule. It takes effect on the date it is accepted, as recorded under section 17.

2. Definitions

Capitalized terms not defined here have the meaning given to them in the HIPAA Rules. In particular:

• Breach has the meaning at 45 CFR 164.402.
• Business Associate has the meaning at 45 CFR 160.103 and here means SmileDesk.
• Covered Entity has the meaning at 45 CFR 160.103 and here means the Practice.
• Designated Record Set has the meaning at 45 CFR 164.501.
• Electronic Protected Health Information (ePHI) has the meaning at 45 CFR 160.103, limited to the information SmileDesk creates, receives, maintains, or transmits for the Practice.
• HIPAA Rules means the Privacy, Security, Breach Notification, and Enforcement Rules at 45 CFR Parts 160 and 164.
• Individual has the meaning at 45 CFR 160.103 and includes a person's personal representative under 45 CFR 164.502(g).
• Protected Health Information (PHI) has the meaning at 45 CFR 160.103, limited to the information SmileDesk creates, receives, maintains, or transmits for the Practice. For SmileDesk this includes, at least, patient names, phone numbers, the content of texts, web chats, call transcripts, and call recordings, appointment details, and insurance carrier and member ids.
• Required by Law has the meaning at 45 CFR 164.103.
• Secretary means the Secretary of the United States Department of Health and Human Services or a designee.
• Security Incident has the meaning at 45 CFR 164.304.
• Subcontractor has the meaning at 45 CFR 160.103.
• Unsecured PHI has the meaning at 45 CFR 164.402.

3. Permitted and required uses and disclosures

• SmileDesk may use and disclose PHI only as necessary to perform the services described in the Service Agreement for the Practice, or as Required by Law, and in no other way. In particular, SmileDesk may use PHI to answer patients, to triage, to schedule, to send reminders, to run the eligibility checks a patient asks for, to write appointments into the Practice's practice-management software, to page the Practice about emergencies, to audit the assistant's own quality and safety, and to show everything to the Practice in its dashboard.
• SmileDesk may use PHI for its own proper management and administration and to carry out its legal responsibilities. SmileDesk may disclose PHI for those purposes only if the disclosure is Required by Law, or if SmileDesk obtains reasonable written assurances from the recipient that the PHI will be held confidentially, that it will be used or further disclosed only as Required by Law or for the purpose for which it was disclosed, and that the recipient will notify SmileDesk of any instance it becomes aware of in which that confidentiality has been breached.
• SmileDesk may de-identify PHI in accordance with 45 CFR 164.514(a) to (c). Information de-identified under that standard is no longer PHI, and SmileDesk may use it to improve the safety and quality of the service. SmileDesk will not use PHI or de-identified information to market to the Practice's patients.
• SmileDesk may provide data aggregation services relating to the health care operations of the Practice, as 45 CFR 164.504(e)(2)(i)(B) permits.
• SmileDesk will not use or disclose PHI in any manner that would violate Subpart E of 45 CFR Part 164 if done by the Practice, except as the second and fourth points above allow. SmileDesk will not sell PHI and will not use or disclose PHI for marketing or fundraising.

4. Minimum necessary

SmileDesk will request, use, and disclose only the minimum amount of PHI necessary to accomplish the intended purpose, in accordance with 45 CFR 164.502(b) and 164.514(d). The assistant is built on this principle: it asks only what scheduling and triage need, it is instructed never to request a social security number, a card number, or a full date of birth over text, it verifies identity before revealing anything about an existing appointment and says the same thing whether or not a record exists when it cannot, and it never shares one patient's information with another person without verified authorization. The details are on our HIPAA and security page.

5. Safeguards

SmileDesk will use appropriate administrative, physical, and technical safeguards, and will comply with Subpart C of 45 CFR Part 164 (the Security Rule) with respect to ePHI, to prevent the use or disclosure of PHI other than as this BAA provides. These safeguards include, at a minimum:

• Encryption of PHI in transit, using TLS, and at rest.
• Access controls: individual logins for practice staff, passwords stored as salted hashes, sessions stored as hashes, isolation of each practice's data so that staff see only their own practice, and access inside SmileDesk limited to the people who need it to provide and support the service.
• Audit logs: every action the assistant takes with PHI, including a booking, a cancellation, an emergency flag, a page to the dentist, and an eligibility check, is written to an audit trail the Practice can read.
• Removal of card numbers, named security codes, and social security numbers from messages before they are stored, read by the assistant, or logged.
• Daily message caps and a kill switch that bound what the assistant can do if something goes wrong.
• Written policies and workforce training proportionate to SmileDesk's size, and a risk analysis reviewed at least once a year and after any material change to the service.

6. Reporting of security incidents and breaches

• What is reported. SmileDesk will report to the Practice any use or disclosure of PHI not provided for by this BAA of which it becomes aware, including any Breach of Unsecured PHI as 45 CFR 164.410 requires, and any Security Incident of which it becomes aware.
• When. SmileDesk will notify the Practice without unreasonable delay and in no case later than ten (10) calendar days after discovery of a Breach of Unsecured PHI or of a reportable Security Incident. A Breach is treated as discovered on the first day it is known to SmileDesk or, by exercising reasonable diligence, would have been known to any person, other than the person committing the Breach, who is an employee, officer, or other agent of SmileDesk.
• What the notice contains. To the extent possible, and supplemented as information becomes available: the identification of each Individual whose Unsecured PHI has been, or is reasonably believed to have been, accessed, acquired, used, or disclosed; a brief description of what happened, including the date of the Breach and the date of its discovery; a description of the types of Unsecured PHI involved; any steps the Individuals should take to protect themselves; a brief description of what SmileDesk is doing to investigate, to mitigate harm, and to protect against further Breaches; and contact procedures for questions. This is the information 45 CFR 164.410(c) and 164.404(c) call for.
• Unsuccessful attempts. The sides agree that this section is notice of the ongoing existence of unsuccessful Security Incidents that do not result in unauthorized access, use, disclosure, modification, or destruction of ePHI or in interference with system operations, such as pings, port scans, denied log-in attempts, and blocked malware, and that no further notice of them is required.
• Mitigation and cooperation. SmileDesk will mitigate, to the extent practicable, any harmful effect known to it of a use or disclosure of PHI in violation of this BAA, and will cooperate with the Practice on the notifications the Practice must make to Individuals, to the Secretary, and, where required, to the media under 45 CFR 164.404 to 164.408. The Practice is responsible for those notifications unless the sides agree otherwise in writing.

7. Subcontractors

In accordance with 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2), SmileDesk will ensure that any Subcontractor that creates, receives, maintains, or transmits PHI on behalf of SmileDesk agrees in writing to the same restrictions, conditions, and requirements that apply to SmileDesk under this BAA, including the safeguards in section 5 and the reporting in section 6. SmileDesk's Subcontractors fall into these categories, and each receives only what its part of the service requires:

• The AI model providers that generate the assistant's replies.
• The telephony provider that carries calls and text messages and, when recording is on, stores call recordings and transcripts for the retention window, and any underlying carrier it uses.
• The database host that stores the service's data.
• The hosting provider that runs the application.
• The insurance clearinghouse, used only when an eligibility check is run.

The Practice's own practice-management software vendor is not a Subcontractor of SmileDesk; SmileDesk reads from and writes to it under the Practice's existing agreement with that vendor. SmileDesk will provide the current names of its Subcontractors on request, and will notify the Practice before adding a new category of Subcontractor that handles PHI.

8. Access to PHI

To the extent SmileDesk maintains PHI in a Designated Record Set, SmileDesk will make that PHI available to the Practice within fifteen (15) days of a request, in the form the Practice reasonably asks for, so that the Practice can meet its obligations to Individuals under 45 CFR 164.524. If an Individual asks SmileDesk directly for access, SmileDesk will forward the request to the Practice within five (5) business days and will not respond to the Individual except to say that the Practice will. The Practice can also read every conversation, transcript, and appointment at any time in its dashboard.

9. Amendment of PHI

To the extent SmileDesk maintains PHI in a Designated Record Set, SmileDesk will make any amendment to PHI that the Practice directs or agrees to under 45 CFR 164.526, within fifteen (15) days of the Practice's request, and will forward to the Practice within five (5) business days any request for amendment it receives from an Individual.

10. Accounting of disclosures

SmileDesk will document disclosures of PHI, and the information related to those disclosures, as would be required for the Practice to respond to a request by an Individual for an accounting of disclosures under 45 CFR 164.528, and will provide that information to the Practice within fifteen (15) days of a request. Disclosures made to carry out the service for the Practice, including disclosures to the Subcontractors in section 7 for that purpose, are disclosures for treatment, payment, or health care operations that 45 CFR 164.528 does not require to be accounted for; SmileDesk's audit log records them regardless. If an Individual asks SmileDesk directly for an accounting, SmileDesk will forward the request to the Practice within five (5) business days.

11. Books and records

SmileDesk will make its internal practices, books, and records relating to the use and disclosure of PHI received from, or created or received by SmileDesk on behalf of, the Practice available to the Secretary for the purpose of determining the Practice's and SmileDesk's compliance with the HIPAA Rules. To the extent SmileDesk carries out any of the Practice's obligations under Subpart E of 45 CFR Part 164, SmileDesk will comply with the requirements of Subpart E that apply to the Practice in performing those obligations. SmileDesk will tell the Practice promptly of any request from the Secretary unless the law forbids it.

12. What the Practice agrees to

• The Practice will notify SmileDesk of any limitation in its notice of privacy practices under 45 CFR 164.520, to the extent the limitation may affect SmileDesk's use or disclosure of PHI.
• The Practice will notify SmileDesk of any change in, or revocation of, an Individual's permission to use or disclose PHI, to the extent it may affect SmileDesk. A patient's STOP reply to a text is honored by SmileDesk immediately without further notice.
• The Practice will notify SmileDesk of any restriction on the use or disclosure of PHI that the Practice has agreed to under 45 CFR 164.522, to the extent it may affect SmileDesk.
• The Practice will not ask SmileDesk to use or disclose PHI in any way that would not be permissible under Subpart E of 45 CFR Part 164 if done by the Practice, except as section 3 allows for SmileDesk's management and administration and for data aggregation.
• The Practice is responsible for obtaining any consent or authorization the law requires from patients for texting, for call recording, and for contact by the assistant, and for keeping the facts it gives the assistant accurate.

13. Term and termination

• Term. This BAA takes effect on acceptance and continues for as long as SmileDesk holds PHI for the Practice, whether or not the Service Agreement is still in force.
• Termination for cause. If either side learns of a pattern of activity or practice of the other that is a material breach of this BAA, it will notify the other in writing, describing the breach, and the other side will have thirty (30) days to cure it. If the breach is not cured within that time, or if cure is not possible, the side that gave notice may terminate this BAA and the Service Agreement on written notice. Termination under this section is effective immediately for the handling of PHI, and the Practice's service ends as the Service Agreement provides.
• Other termination. This BAA also ends when the Service Agreement ends and SmileDesk has returned or destroyed all PHI under section 14 or, where return or destruction is not feasible, when the protections in section 14 have been extended to that PHI.

14. Return or destruction of PHI

• On termination. When this BAA ends for any reason, SmileDesk will return to the Practice or destroy all PHI that it or its Subcontractors maintain in any form, and will keep no copies. Return is by an export of the Practice's conversations, appointments, patient records, and recordings in a common machine-readable format, on a request made within thirty (30) days after the Service Agreement ends. Destruction is completed within those same thirty (30) days, at the close of that window or as soon as the Practice confirms its export is complete, and covers the production database, backups on their normal rotation, and the Subcontractors in section 7. That is the one deadline section 5 of the Service Agreement gives, and it runs from the day the Service Agreement ends, not from the close of the export window.
• Infeasibility. If the return or destruction of some PHI is not feasible, SmileDesk will notify the Practice of the conditions that make it infeasible, will extend the protections of this BAA to that PHI, and will limit further uses and disclosures of it to the purposes that make return or destruction infeasible, for as long as SmileDesk maintains it. Records SmileDesk must keep by law, such as billing and tax records that contain no clinical content, and encrypted backups awaiting their scheduled expiry, are examples.
• The Practice's own records. The Practice remains responsible for keeping its own copy of any record it needs for its patients' charts. SmileDesk's export is provided for that purpose.

15. No third-party beneficiaries

Nothing in this BAA confers any right, remedy, or obligation on any person other than the Practice and SmileDesk and their respective successors and permitted assigns. In particular, no patient is a third-party beneficiary of this BAA.

16. Interpretation and miscellaneous

• Any ambiguity in this BAA is resolved to permit compliance with the HIPAA Rules.
• A reference to a section of the HIPAA Rules means that section as in effect or as amended.
• The sides agree to take the action necessary to amend this BAA from time to time as needed to comply with the HIPAA Rules or other applicable law. SmileDesk will publish the new version with 30 days' notice, and the dashboard will ask the Practice to accept it. If the sides cannot agree on an amendment the law requires, either may terminate under section 13.
• SmileDesk's obligations under sections 6, 11, 14, and 15 survive termination.
• If this BAA conflicts with the Service Agreement about PHI, this BAA controls. Otherwise the Service Agreement governs, including its provisions on governing law, venue, and limits on liability, except that nothing limits a side's liability for civil penalties imposed by the Secretary for its own violation of the HIPAA Rules.
• SmileDesk gives no legal advice. The Practice should review this BAA with its own counsel.

17. Signatures

This BAA is signed electronically. The Practice accepts it when the person creating the Practice's SmileDesk account, who confirms that they are authorized to bind the Practice, checks the box stating that they have read and accept the SmileDesk Service Agreement and the Business Associate Agreement, or when an authorized user accepts a new version from the dashboard. SmileDesk records the version accepted, the email of the person who accepted, the date and time, the client IP address our hosting provider reports for that browser, and the browser itself, and that record stands in place of a signature block for both sides under the federal Electronic Signatures in Global and National Commerce Act and California's Uniform Electronic Transactions Act. SmileDesk's acceptance is given by making the service available to the Practice once that record is made. The Practice can see its acceptance record on its Billing page and can request a signed paper copy through the contact page.