Business Associate Agreement
Last updated: July 22, 2026
This is a placeholder, not an agreement.
The Business Associate Agreement for Rooted Collective has not been finalised. This page exists so the platform can record acknowledgements correctly, and it does not create any obligation on you or on Rooted Collective. You will be asked to review and accept the real agreement before you see any client through the platform, and that acceptance will be recorded separately from this one.
What this document will cover
HIPAA requires a written agreement between parties who handle protected health information on one another's behalf. The finalised version of this document is expected to set out:
- which party is the covered entity and which is the business associate, and for what;
- the permitted uses and disclosures of protected health information;
- the safeguards each party must maintain;
- how a breach is reported, by whom, and within what period;
- what happens to client information when a provider leaves the platform;
- how long records are retained, and by whom.
What the platform does today
Described here because it is true now and does not depend on the finalised agreement. Rooted Collective runs on Google Cloud under a signed HIPAA Business Associate Addendum, restricted to services that addendum covers. Client information is encrypted in storage and in transit. Access is restricted by role and enforced on the server. Records of who accessed what are kept for six years in storage whose retention period is locked and cannot be shortened.
A fuller description is available in the compliance summary, which the Rooted Collective team can provide on request.
Questions about this document should go to hello@rootedcollective.com.