← All documentation

Organization settings

Settings → Organization holds your organization's profile, its members, its notification channels and the modules it uses. Only an organization admin can change it.

What your organization does

Four questions describe your organization, and every organization is asked all four. Each offers Not sure, which counts as not answered.

  • Does your organization handle protected health information (PHI)? Answer Yes, we provide care, or are a health plan or clearinghouse, Yes, we handle PHI for a covered entity, Yes, both of the above, or No.
  • Does your organization run a federally assisted substance use disorder program? (42 CFR Part 2.)
  • Does your organization receive or hold records that came from a federally assisted substance use disorder program (42 CFR Part 2 records), directly or through another organization? Part 2's restrictions follow its records to many recipients, including the bar on using them against the person they concern (42 CFR 2.12(d)), so this is asked whatever your other answers are.
  • Does your organization use, buy or build AI? This answer never changes what you can use or which questions are asked: it is used only to order what is shown first.

A HIPAA assessment asks the questions only a covered entity owes, or only a business associate owes, by your answer to the first question, and asks both if you answer Yes, both of the above, or until you answer. One that selects 42 CFR Part 2 (Substance Use Disorder Patient Records, eCFR 2026-10-05) asks the questions only a program owes unless you answer No to the second, and the questions that bind anyone holding Part 2 records unless you answer No to the second and the third.

Setup asks the first and the last of these when you name your organization, and Settings asks all four. Home's setup steps follow your answer to the first: any Yes puts the HIPAA steps (register a system that handles ePHI, start the HIPAA program assessment, sign the business associate agreement, complete your security risk analysis, say whether 42 CFR Part 2 applies) first after the Data Processing Agreement; Not sure lists them after the AI steps; No leaves them out of the list.

Your answers never hide a page or a record, and changing one deletes nothing. One answer locks something until it is done: see the business associate agreement below. AI governance assessments ask the same questions whatever you answer. An assessment that is already completed keeps the questions it was completed with.

Agreements with Backsplice

Settings → Agreements holds the two agreements between your organization and Backsplice: the Data Processing Agreement, which every organization accepts before adding records, and the business associate agreement (BAA).

An organization that answers Yes to the PHI question (a covered entity, a business associate, or both) needs an executed BAA before it adds records that may hold PHI: answers, evidence, incidents, requests, risks and the other registers. Until then it can still set up the organization, invite its team, add and describe systems, and create assessments, and every form that would save PHI says why it is locked. Organizations that answer No or Not sure are not required to sign one, though they can.

There are three ways to execute it, each open to a full organization admin (not a delegated one):

  • Read and sign the standard agreement. While it can be signed, Backsplice has signed it in advance, so it is executed the moment you sign with your password and your authenticator app (or one of your backup codes). If it cannot be signed yet, for example before Backsplice has recorded who signs it on our side, the page says so, for you and for someone you ask, and you can still upload your organization's own agreement.
  • Ask someone else to sign, such as an officer with authority to bind the organization. They are emailed a link that works for 14 days and, when they open it, a code that works for 15 minutes. They need no account. You can resend or withdraw the link while it is waiting.
  • Use your organization's own BAA: upload it already signed for your organization. Backsplice reviews it and either countersigns it or tells you why it cannot, by email. Records that may hold PHI stay locked until it is countersigned.

Each signature records the signer's name, the date and time, how they confirmed who they were, and a fingerprint of the exact words or file signed. Any member can view the executed agreement from Agreements; admins and auditors can download a custom agreement and its countersigned copy.

The logging of access to and changes of PHI that the BAA describes is your organization's audit log. Viewing a record that may hold PHI writes a phi.viewed event there: an incident that involved PHI, or where that is not yet known or was never asked, with its breach risk assessment and breach notifications; a request of a HIPAA type or under a HIPAA legal basis; an entry of the disclosure log and an accounting of disclosures; a workforce sanction; and the HHS OCR audit package, which shows several of them. Each event says who viewed it, from the dashboard, the API or a connected assistant, and names the record by its identifier only; a list writes one event with how many such records it showed, and a download is recorded as an export. An edit of an incident is recorded too, naming the fields that changed and never what they say. Reminders in the notification bell and by email name such an incident by its discovery date, never its title.