Protected Health Information and Business Associate Addendum

What it is

The agreement conditions the use of Protected Health Information with the Service on execution of a Business Associate Addendum. The agreement also states that the Service is not PCI compliant, which the customer acknowledges.

Why it matters (compliance & governance perspective)

This provision establishes a prerequisite BAA execution for any use of PHI with the Service, consistent with HIPAA requirements for covered entities and business associates. The explicit PCI non-compliance acknowledgment restricts use cases involving payment card data and places contractual notice on customers regarding that limitation.

Consumer impact (what this means for users)

Under this clause, customers who are HIPAA covered entities or business associates using PHI with the Service must execute a separate Business Associate Addendum before doing so. The terms include a customer acknowledgment that the Service is not PCI compliant, precluding payment card data from being submitted to the Service.

What you can do

Institutional analysis (regulatory & governance intelligence)

(1) REGULATORY LANDSCAPE: This provision directly engages HIPAA and the HITECH Act, including 45 CFR Parts 160 and 164, which require covered entities and business associates to execute a compliant BAA before sharing PHI with service providers. The PCI non-compliance disclosure engages PCI DSS standards and the contractual and regulatory obligations of customers who process, store, or transmit cardholder data. (2) GOVERNANCE EXPOSURE: High for healthcare sector customers. Use of PHI without an executed BAA would constitute a HIPAA violation by the covered entity, with potential HHS OCR enforcement exposure. The PCI non-compliance acknowledgment creates a clear contractual and regulatory risk for any customer that submits cardholder data to the Service. (3) JURISDICTION FLAGS: HIPAA applies federally in the United States to covered entities and business associates. State health data protection laws in states such as California (CMIA), New York, and Texas may impose additional requirements beyond HIPAA that apply to PHI submitted by customers in those states. (4) CONTRACT AND VENDOR IMPLICATIONS: Procurement teams at healthcare organizations or firms handling PHI must confirm BAA execution before any PHI is processed through the Service. The BAA template is located at https://trust.harvey.ai/ and must be executed by both parties before PHI use commences. Payment-related use cases are contractually excluded by the PCI non-compliance acknowledgment. (5) COMPLIANCE CONSIDERATIONS: Compliance teams at covered entities should integrate BAA execution into vendor onboarding workflows and confirm that the Harvey BAA meets HIPAA-required provisions under 45 CFR 164.504(e). The PCI acknowledgment should be documented as a use-case restriction in internal data governance policies.

Applicable agencies

Provision details

Other risks in this policy

• Customer Indemnifies Harvey for Input and Customer Data Claims high
• Customer Owns Its Content high
• Customer Right to Terminate After Adverse Update high
• Elevated Data Breach Cap at 2x Fees Paid or $500,000 high
• General Aggregate Liability Cap at Fees Paid or $250,000 high
• Harvey Indemnifies Customer for IP Infringement Claims high