HIPAA and BAA

No PHI in, so no BAA needed.

ClaimParrot does not accept protected health information and does not offer or sign business associate agreements. An appeal argument rests on the payer's stated reason, the criteria it cited and the clinical picture, and none of those needs the patient's identity.

Never send PHI in a request, a file or an email

Why there is no BAA

A business associate is a vendor that handles PHI. ClaimParrot is built never to receive it.

HHS treats a cloud service that creates, receives, maintains or transmits ePHI for a covered entity as a business associate that needs a BAA. ClaimParrot works only from de-identified summaries, so the identifiers, the denial notice and the medical record stay with your team. If we ever offer a service that handles PHI, it will run under a signed BAA on eligible infrastructure, and we will say so on this page first.

See the subprocessors HHS cloud guidance

How identifiers are kept out

The request form refuses case fields that contain names following a label (such as "Patient:" or "Dear Mr."), member and record numbers, dates of birth, Social Security numbers, non-toll-free phone numbers, email addresses, street addresses, calendar dates or ages over 89.
The server repeats the identifier check before a request is stored, and the drafting step repeats it again before any text reaches the AI model.
If identifiers get through anyway, the request is not drafted: we delete it from storage, case files and the mailbox, and ask for a de-identified version.
Packets come back with placeholders such as [Member name] and [Member ID]; your team fills them in inside its own systems before submitting.

These checks catch common identifier patterns. They are a backstop, not a guarantee, so de-identify the summary before you send it. Retention periods and the provider list are on the Trust & security page.