Business Associate Agreement
Last updated: October 12, 2026
Short answer: VertiComply signs a HIPAA Business Associate Agreement on every paid plan, from Pro at $89/month, on request. It does not sign one on the Free plan. To request yours, email compliance@verticomply.com from the account that holds the subscription.
Which plans include a BAA
| Plan | Price | Signed BAA |
|---|---|---|
| Free | $0 | No. Build and test with synthetic data only. |
| Pro | $89/mo | Yes, on request |
| Business | $249/mo | Yes, on request |
| Enterprise | $349/mo | Yes, on request; custom terms negotiable |
Prices are for new customers in USD; INR pricing is on the pricing page. The HIPAA technical safeguards are generated on every plan, including Free. The BAA is the contract that lets you put real patient data in, and that needs a paid plan.
What the BAA covers
- PHI that VertiComply creates, receives, maintains or transmits on your behalf, for example in apps you deploy with VertiComply hosting.
- Our obligations as a Business Associate under the HIPAA Privacy, Security and Breach Notification Rules, including safeguards for that PHI.
- Notifying you of a breach of unsecured PHI, as the Breach Notification Rule requires.
- Flowing the same obligations down to our subcontractors that handle that PHI.
- Retaining audit logs for six years.
What it does not cover
- Apps you export and host in your own cloud account. Your BAA for those is with your hosting provider.
- Third-party services you connect yourself, such as a video, SMS, email or payment provider. Each needs its own BAA if it touches PHI.
- Pasting real patient data into prompts while you build. Use synthetic data in the builder.
- Your own administrative safeguards: risk analysis, policies, training and access reviews remain your responsibility.
Certifications, stated plainly
VertiComply does not hold a SOC 2 report or a HITRUST certification as a company. The code it generates is mapped to SOC 2 Trust Services Criteria and HITRUST CSF control categories, which shortens your own audit. HHS does not certify software as HIPAA compliant, so no builder can honestly claim to be “HIPAA certified”.
How this compares
Many no-code and AI builders do not sign a BAA at all, and those that do usually start between $500 and $1,500 a month. Our sourced table of no-code platforms that sign a HIPAA BAA lists each vendor’s plan and price, and BAA vs HIPAA explains when you need one.
Frequently asked questions
Does VertiComply sign a Business Associate Agreement?
Yes. VertiComply signs a BAA on every paid plan (Pro $89/mo, Business $249/mo, Enterprise $349/mo) on request. Email compliance@verticomply.com from the account that holds the subscription.
Is a BAA available on the Free plan?
No. Apps generated on Free include the same HIPAA technical safeguards, so you can build and test with synthetic data, but real patient data needs a paid plan and a signed BAA first.
Does the BAA cover an app I export and host myself?
No. Once you export the code and run it in your own cloud account, VertiComply no longer creates, receives, maintains or transmits that PHI. You need a BAA with your own hosting provider, for example AWS, Google Cloud or Azure.
Is VertiComply SOC 2 or HITRUST certified?
Not yet. VertiComply does not hold a SOC 2 report or HITRUST certification as a company. The code it generates is mapped to SOC 2 and HITRUST CSF controls to shorten your own audit, which is a different thing.
Does a BAA make my app HIPAA compliant?
No. A BAA allocates responsibility for PHI between you and a vendor. HIPAA compliance also needs your own risk analysis, policies, workforce training, access reviews and BAAs with every other vendor that touches PHI. HHS does not certify software as HIPAA compliant.