Clinician & vendor onboarding
Last updated: August 8, 2026
Who this page is for
This page is for licensed clinicians who want to deliver Simply Mindfull Moments consultations, and for vendors or subprocessors that would handle data on Simply Mindfull Moments's behalf. It explains when we need a Business Associate Agreement (BAA) from you and exactly how signatures are collected, so there are no surprises once work starts.
When a BAA is required
For the wider picture — when HIPAA applies to Simply Mindfull Moments at all and which gaps we close if it does — see the HIPAA readiness & gap checklist.
A BAA is required when
- You create, receive, maintain or transmit protected health information on Simply Mindfull Moments's behalf.
- The work sits in a covered context — clinical consultations, an engagement with an employer or health plan, or anything involving insurance billing.
- You provide support, hosting, analytics or communications services that could expose that information, even incidentally.
A BAA is not required when
- Your service never touches health information — merchandise fulfillment or general marketing tooling, for example.
- The work only involves Simply Mindfull Moments's consumer self-care features, which generally fall outside HIPAA and are instead governed by consumer protection rules and state health-data laws. Those still carry obligations; we cover them in a vendor data-processing addendum.
Still unsure? Ask us before sharing or receiving any data. We would much rather answer the question early than clean up afterwards.
Quick self-check
Four questions to work out where you land before you contact us.
- Will you create, receive, store or transmit user health information?
- If yes, a BAA is likely required. If no, a standard vendor data-processing addendum is usually enough.
- Are you acting on Simply Mindfull Moments's behalf, rather than as an independent business?
- A business associate performs a function for Simply Mindfull Moments using its data. An independent business that decides its own uses of data is treated differently and needs a separate agreement.
- Is the work tied to clinical consultations, an employer or health-plan engagement, or insurance billing?
- Those contexts are the ones where HIPAA obligations can attach to Simply Mindfull Moments, which means the BAA route applies to you too.
- Will you pass Simply Mindfull Moments data to your own subcontractors?
- If yes, tell us up front. The same obligations have to flow down to them in writing before any data moves.
Step-by-step signature workflow
- 1
Intake
Email us your contact details, your role (clinician or vendor), and a plain description of the data you would handle and why you need it.
- 2
Assessment
We confirm which agreement applies: a Business Associate Agreement, a standard vendor data-processing addendum, or neither. Nothing is shared with you before that is settled.
- 3
BAA issued
We email you the BAA as a PDF along with a short security questionnaire. Read both before signing; ask questions at this stage rather than after.
- 4
Review and sign
Your authorized signer signs the PDF and emails it back to us, including signer name, title and date. Please return the whole document, not just the signature page.
- 5
Countersignature
We sign, email you a fully executed copy for your records, and archive our copy against an effective date.
- 6
Access provisioning
Scoped credentials or access are granted only after the agreement is executed, and only to the minimum data needed for the work.
- 7
Ongoing obligations
Written flow-down to any subcontractor, prompt notification to us of any suspected breach, an annual review of the arrangement, and return or destruction of Simply Mindfull Moments data when the engagement ends.
What Simply Mindfull Moments's BAA covers
- Permitted uses and disclosures, limited to the work described in the engagement.
- Administrative, physical and technical safeguards you agree to maintain.
- Breach and security-incident notification, with the timelines stated in the agreement.
- Written flow-down to any subcontractor before data reaches them.
- Term, termination and the grounds on which either side can end the arrangement.
- Return or destruction of Simply Mindfull Moments data at the end of the engagement.
This is a summary for orientation only. The executed agreement is what governs, and its wording controls wherever it differs from this page.
Download the BAA template
Our current Business Associate Agreement template is available below so you can review it with your own counsel before we issue a copy for signature. It covers permitted uses, safeguards, breach reporting, subcontractor flow-down, individual rights support, and return or destruction of PHI, and includes an exhibit for the services, PHI categories, and approved systems in your engagement.
It is a draft prepared for legal review, not legal advice, and it is unexecuted — the effective date, governing state, party details, and exhibit content are completed during onboarding. The signed version controls.
Business Associate Agreement (PDF)Documents you'll be asked for
- Clinicians: license and credential verification for every jurisdiction you intend to work in, plus proof of professional liability insurance.
- Vendors: completed security questionnaire and a current list of subprocessors.
- Both: the name, title and contact details of your authorized signer.
Timeline expectations
Assessment usually takes a few business days once we have your intake details, and execution depends on how quickly the signed PDF and questionnaire come back. Requests that need extra credential or security review take longer. These are expectations rather than guarantees, and we will tell you if something is going to slip.
Start the process
Email partners@simplymindfullmoments.org with your role and the data you expect to handle. It helps to read the Privacy Policy and Terms of Service first, and the consultations page if you are a clinician.
A note on this page
This is general information about how Simply Mindfull Moments onboards partners, not legal advice, and it is not a determination of your own obligations. Whether a BAA applies depends on the specifics of the engagement, and the signed agreement — not this page — sets what each side has to do.