> ## Documentation Index
> Fetch the complete documentation index at: https://docs.usehasp.com/llms.txt
> Use this file to discover all available pages before exploring further.

# BAA Gating

> Why certain API calls require an active BAA, how to upload one, and which tiers require what.

A Business Associate Agreement (BAA) is a legal contract required by HIPAA before a covered entity or business associate may share Protected Health Information (PHI) with a service provider. The HASP AI API processes requests that may contain PHI — to do so lawfully, your organization must have a signed BAA on file.

## When BAA is required

Any inference request on the HASP AI API may be gated by BAA status. The API checks your organization's BAA status on every request. If PHI handling is enabled (which it is by default) and no signed BAA is on file, the request fails with:

```json theme={null}
{
  "type": "error",
  "error": {
    "type": "permission_error",
    "message": "A signed Business Associate Agreement is required to access this feature.",
    "hasp_code": "BAA_REQUIRED",
    "hasp_details": {
      "baa_url": "https://api.usehasp.com/v1/compliance/baa"
    }
  }
}
```

The `hasp_details.baa_url` field links directly to the endpoint where you can retrieve the current BAA status for your organization.

## Resolving BAA\_REQUIRED

1. **Retrieve the current BAA** via `GET /v1/compliance/baa`. This returns the current template version and signing instructions.
2. **Sign the BAA** through the HASP dashboard under **Settings → Compliance → BAA**. The BAA is electronically signed and tied to your organization.
3. **Retry your request.** Once signed, the `BAA_REQUIRED` gate lifts immediately — no propagation delay.

## Which tiers require a BAA

Every paid HASP tier — Solo, Professional, Business, and Enterprise — includes BAA coverage. The BAA requirement is enforced uniformly: regardless of tier, you must have a signed BAA on file before the API will process requests that may contain PHI.

Free evaluation accounts can make API requests, but they are not covered under a BAA. Do not send real PHI from a free evaluation account.

## What the BAA covers

The HASP BAA covers HASP's handling of PHI in the context of AI inference:

* The PHI scan and redaction step (Microsoft Presidio sidecar, run by HASP).
* Encrypted storage of message content (if `store` is not set to `false`).
* Transmission of messages to the upstream inference provider (Anthropic) under Anthropic's own BAA with HASP.
* Audit log retention.

The BAA does **not** cover how you handle PHI in your own application before sending it to the API.

## Checking BAA status programmatically

```bash theme={null}
curl https://api.usehasp.com/v1/compliance/baa \
  -H "Authorization: Bearer hasp_api_live_<key>"
```

The response includes `baa_status` (`not_signed` | `signed` | `expired`), `current_version`, and `re_sign_deadline`. Monitor the `current_version` field — when HASP updates the BAA template, you may be required to re-sign.