# Health data agreements

URL: /systems/trust-and-governance/controls/health-data-agreements · Id: `control:health-data-agreements`

> A Startup holds health fields only after every upstream that processes them signs a business associate Agreement.

A [Startup](/business/nouns/startup) holds health fields only after every upstream that processes them signs a business associate [Agreement](/business/nouns/agreement).

## Satisfies
| Criterion | Text |
| --- | --- |
| [HIPAA 164.308(b)(1)](/systems/trust-and-governance/criteria/hipaa/164-308-b-1) | A business associate handles protected health information only under satisfactory written assurances. |

## Implemented by
- [Contracting](/workflows/processes/contracting)
- [Compliance](/workflows/processes/compliance)
- [Agreements](/systems/agreements)

## Test
| Step | Rule |
| --- | --- |
| Kind | Preventive: it stops the failure before it happens. |
| Select | Every upstream that receives a health field in the report period. |
| Assert | Each has a signed business associate Agreement dated before its first receipt. |

## Owner
[Contracts Manager](/agents/legal/contracts-manager), [Legal Team](/agents/legal).

## Example
A clinic-scheduling [SaaS](/products/templates/saas) adds a transcription upstream for visit notes. The first note reaches it only after its business associate Agreement is signed and on file.