HIPAA Business Associate Agreement
Last updated Jul 15, 2026
Terms under which ELIXIR CONSUMERS handles protected health information for covered entities.
Availability
ELIXIR CONSUMERS signs a Business Associate Agreement with covered entities and business associates on Growth and Enterprise plans.
Permitted uses
ELIXIR CONSUMERS uses and discloses PHI only to provide the service and as required by law, and does not use PHI for model training or marketing.
Safeguards
Administrative, physical and technical safeguards that meet the HIPAA Security Rule, including encryption, access controls and audit logging.
Breach reporting
ELIXIR CONSUMERS reports breaches of unsecured PHI to the covered entity without unreasonable delay and no later than 30 days after discovery.
Minimum necessary
Most grant workflows require only aggregate data such as UDS tables. We recommend uploading de-identified or aggregate data wherever possible.