Business associate agreement
Attergo is a business associate under HIPAA. This agreement is executed with every pharmacy before a single event is accepted, not after onboarding, not on request.
Last updated 1 August 2026 · Promatics Informatics LLC, operating as Attergo · Changes are versioned and announced to account owners thirty days before they take effect.
Scope
This agreement governs all protected health information Attergo creates, receives, maintains or transmits on behalf of your organisation as a covered entity. It is executed per pharmacy and survives termination of the service agreement for as long as any PHI remains in our custody.
Permitted uses
Attergo uses PHI solely to perform the services: computing margin, preparing and submitting claims, assembling evidence bundles, monitoring compliance obligations and producing reporting for your organisation. No other use is permitted, including product improvement, benchmarking against other customers, or model training, unless separately agreed in writing and de-identified to the HIPAA standard.
Safeguards
- Encryption in transit with TLS 1.2 or better.
- At rest, credentials and authenticator secrets under AES-256-GCM with per-tenant derived keys. Volume-level encryption of the database and the object store is not in place.
- Tenant isolation enforced in the data layer.
- Role-based access with least privilege and mandatory two-factor authentication.
- An append-only access log recording every read of PHI, inspectable and exportable by you.
- Support access only under a named, time-boxed grant that appears in your log.
Subcontractors
Every subprocessor with access to PHI is bound by terms no less protective than these. The subprocessor list is published and versioned, with notification before any addition.
Breach notification
Notification without unreasonable delay and within the contractual window, including what was accessed, when, by whom where known, and what we have done. You receive an incident report suitable to hand to your own counsel.
Individual rights
Attergo will make PHI available to support access, amendment and accounting-of-disclosure requests within the timeframes HIPAA requires, routed through your account owner.
Return or destruction
On termination you receive a complete export. We then return or destroy remaining PHI, except where retention is required by law, in which case protections continue for as long as we hold it.