← All documentation

Organization settings

Settings → Organization holds your organization's profile, its members, its notification channels and the modules it uses. Only an organization admin can change it.

What your organization does

Backsplice runs two programs side by side: HIPAA, for protected health information, and AI governance, for the AI you build, buy or use. Each has its own assessment, score and certificate.

Four questions describe your organization, and every organization is asked all four. Nothing is chosen for you: each question needs an answer before the form saves, and each offers Not sure, which is kept as your answer and counts as not answered.

  • Does your organization handle protected health information (PHI)? Answer Yes, we provide care, or are a health plan or clearinghouse, Yes, we handle PHI for a covered entity, Yes, both of the above, or No.
  • Does your organization run a federally assisted substance use disorder program? (42 CFR Part 2.)
  • Does your organization receive or hold records that came from a federally assisted substance use disorder program (42 CFR Part 2 records), directly or through another organization? Part 2's restrictions follow its records to many recipients, including the bar on using them against the person they concern (42 CFR 2.12(d)), so this is asked whatever your other answers are.
  • Does your organization use, buy or build AI? This answer never changes what you can use or which questions are asked: it orders what is shown first, and when first answered it decides whether the AI governance activities start on your calendar (any of them can be adopted later under Manage activities).

A HIPAA assessment asks the questions only a covered entity owes, or only a business associate owes, by your answer to the first question, and asks both if you answer Yes, both of the above, or until you answer. One that selects 42 CFR Part 2 (Substance Use Disorder Patient Records, eCFR 2026-10-05) asks the questions only a program owes unless you answer No to the second, and the questions that bind anyone holding Part 2 records unless you answer No to the second and the third.

Setup asks the first and the last of these when you name your organization, and Settings asks all four. Home's setup steps follow your answer to the first: any Yes puts the HIPAA steps (register a system that handles ePHI, start the HIPAA program assessment, sign the business associate agreement, complete your security risk analysis, say whether 42 CFR Part 2 applies) first after the Data Processing Agreement; Not sure lists them after the AI steps, with the business associate agreement apart, under If you handle PHI, as an optional step outside the count; No leaves them out of the list, unless the AI answer is No as well: with two answers of No, both programs' steps are listed apart, outside the count, under If you use AI and If you handle PHI, so the checklist can finish while every step stays one click away. While either answer is Not sure, Home adds one counted step after the agreements, Say whether you handle PHI (or use AI), because the answer decides which of the other steps remain.

Your answers never hide a page or a record, and changing one deletes nothing: a page an answer moves down sits under its section's More in the sidebar. With No to the AI question and no system that uses AI, the Systems register leaves out the controls that would be empty, its AI stage tiles, its risk tier and generative filters and its links to AI models and impact assessments, until a system uses AI, one of those filters is in use, or a model or impact assessment is on record. One answer locks something until it is done: see the business associate agreement below. AI governance assessments ask the same questions whatever you answer. An assessment that is already completed keeps the questions it was completed with.

Agreements with Backsplice

Settings → Agreements holds the two agreements between your organization and Backsplice: the Data Processing Agreement, which every organization accepts before adding records, and the business associate agreement (BAA).

An organization that answers Yes to the PHI question (a covered entity, a business associate, or both) needs an executed BAA before it adds records that may hold PHI: answers, evidence, incidents, requests, risks and the other registers. Until then it can still set up the organization, invite its team, add and describe systems, and create assessments, and every form that would save PHI says why it is locked. An organization that answers Not sure is not required to sign one, though it can: Home lists it as an optional step. One that answers No is not offered it.

There are three ways to execute it, each open to a full organization admin (not a delegated one):

  • Read and sign the standard agreement. While it can be signed, Backsplice has signed it in advance, so it is executed the moment you sign with your password and your authenticator app (or one of your backup codes). If it cannot be signed yet, for example before Backsplice has recorded who signs it on our side, the page says so, for you and for someone you ask, and you can still upload your organization's own agreement.
  • Ask someone else to sign, such as an officer with authority to bind the organization. They are emailed a link that works for 14 days and, when they open it, a code that works for 15 minutes. They need no account. You can resend or withdraw the link while it is waiting.
  • Use your organization's own BAA: upload it already signed for your organization. Backsplice reviews it and either countersigns it or tells you why it cannot, by email. Records that may hold PHI stay locked until it is countersigned.

Each signature records the signer's name, the date and time, how they confirmed who they were, and a fingerprint of the exact words or file signed. Any member can view the executed agreement from Agreements; admins and auditors can download a custom agreement and its countersigned copy.

The logging of access to and changes of PHI that the BAA describes is your organization's audit log. Viewing a record that may hold PHI writes a phi.viewed event there: an incident that involved PHI, or where that is not yet known or was never asked, with its breach risk assessment and breach notifications; a request of a HIPAA type or under a HIPAA legal basis; an entry of the disclosure log and an accounting of disclosures; a workforce sanction; and the HHS OCR audit package, which shows several of them. Each event says who viewed it, from the dashboard, the API or a connected assistant, and names the record by its identifier only; a list writes one event with how many such records it showed, and a download is recorded as an export. An edit of an incident is recorded too, naming the fields that changed and never what they say. Reminders in the notification bell and by email name such an incident by its discovery date, never its title.