Business Associate Agreement

HIPAA requires a Business Associate Agreement, or BAA, between a practice and any company that handles its patients’ information for it. The BAA says how the company may use that information, how it protects it, and what it does if something goes wrong.

You sign it when you sign up

Every practice signs our BAA when it signs up, before any patient information goes into Marge. It’s part of getting started, not an extra.

What it covers

• Marge, the software: the records, notes, forms, messages and files a practice keeps in it.
• Where it runs: Marge runs on Amazon Web Services, which has its own BAA with us. We use only AWS services that AWS lists as HIPAA eligible, and patient information is encrypted in transit and at rest.
• The AI features: Ask Marge, the lab report reader and the visit scribe run on AWS under that same agreement, and your patients’ information is never used to train AI models.
• Services a practice connects: a phone, fax or payment provider has its own agreement with the practice.

Questions

Want to know what the BAA covers before you decide? Send us a note through the Book a demo form and we’ll talk it through.

How Marge keeps records safe

The Security page covers roles, the access report and the rest.

This page is a summary. The signed agreement is what counts. Last updated: October 22, 2026