When this agreement applies
This Business Associate Agreement (BAA) applies when a customer that is a covered entity, or a business associate of one, signs it with YTT SECUNET PRIVATE LIMITED as part of an Enterprise Sovereign or Sovereign Dedicated order form. It covers protected health information (PHI) that YTT Secunet creates, receives, maintains or transmits for the customer through the gateway. Capitalised HIPAA terms have the meanings given in 45 CFR Parts 160 and 164.
PHI may pass only through tenants whose policy restricts routing to US endpoints, such as the us-hipaa-only pack, and only to providers or runtimes the customer operates itself or has its own BAA with. Growth plans, free trials and non-US zones are outside this agreement and must not carry PHI.
Why YTT Secunet is a business associate
The gateway reads request content to evaluate policy and mask identifiers, so it is not a mere conduit. YTT Secunet accepts business associate obligations even though prompts and completions are processed in memory and never written to disk. Two stored records can relate to PHI: pseudonymization vault entries, if you enable the vault, kept encrypted in the US data plane; and receipts, which carry a SHA-256 hash of each request rather than its content. We protect both as PHI.
On Sovereign Dedicated deployed in your environment, PHI stays on infrastructure you operate, and YTT Secunet's access is limited to what you grant for support.
Permitted uses and disclosures
YTT Secunet may use and disclose PHI only for the purposes below.
- To provide the service under the agreement and as the customer's policy instructs.
- For its proper management and administration or to carry out its legal responsibilities, as 45 CFR 164.504(e)(4) allows, provided any disclosure for those purposes is required by law or made under reasonable written assurances of confidentiality.
- As required by law.
Prohibited uses
YTT Secunet will not sell PHI, use it for marketing, use it to train any model or de-identify it for its own purposes. Staff access follows the minimum necessary standard, and support works from metadata unless the customer chooses to share more.
Safeguards under the Security Rule
YTT Secunet implements administrative, physical and technical safeguards that comply with Subpart C of 45 CFR Part 164, including 164.308, 164.310, 164.312 and 164.316. They include:
- zero data retention for prompts and completions, which are never written to disk or used for training;
- AES-256 encryption at rest for vault entries, receipts and configuration, and TLS 1.3 for all traffic in transit;
- role-based access limited to named staff, multi-factor authentication and logging of every administrative access;
- a documented risk analysis reviewed at least annually, workforce training and sanctions, and incident response procedures, audited under SOC 2 Type II and ISO 27001.
Security incidents and breach notification
YTT Secunet will report to the customer any use or disclosure of PHI that this BAA does not permit and any security incident it becomes aware of. This paragraph is standing notice of unsuccessful attempts, such as pings, port scans and blocked sign-in attempts, that do not lead to unauthorised access; no further report of those is required.
For a breach of unsecured PHI, YTT Secunet will notify the customer without unreasonable delay and in no case later than 60 calendar days after discovery, as 45 CFR 164.410 requires. Our practice is an initial notice within 5 business days. The notice will identify, to the extent possible, each individual whose PHI was or is reasonably believed to have been involved, and give the other information the customer needs to notify individuals, HHS and, where required, the media. We will supplement it as facts become available.
Individual rights and access by HHS
YTT Secunet does not maintain a designated record set, so requests for access (45 CFR 164.524), amendment (164.526) and an accounting of disclosures (164.528) are answered by the customer. YTT Secunet forwards any such request it receives within 5 business days and provides the information it holds within 15 business days of the customer's request.
YTT Secunet will make its internal practices, books and records relating to PHI available to the Secretary of Health and Human Services for the purpose of determining compliance with HIPAA.
Subcontractors
Under 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2), YTT Secunet ensures that every subcontractor that creates, receives, maintains or transmits PHI on its behalf, including the hosting provider for the US data plane, agrees in writing to the same restrictions and conditions as this BAA. Model providers you connect with your own credentials are not YTT Secunet subcontractors. You need your own BAA with each of them.
Term, termination, return or destruction
This BAA runs as long as the order form it is attached to, and its obligations continue while YTT Secunet holds any PHI. If either party determines that the other has breached a material term, it may terminate the BAA and the affected services if the breach is not cured within 30 days of written notice.
On termination, YTT Secunet will return or destroy all PHI it still maintains, in practice vault entries and receipts, within 30 days and certify destruction in writing. Where return or destruction is infeasible, for example because of a legal hold, YTT Secunet will extend the protections of this BAA to that PHI and limit further use to the purposes that make return or destruction infeasible.
Questions about this BAA go to legal@yttsecunet.com. Report a suspected incident to security@yttsecunet.com.