# HIPAA and BAA for incident reporting

> What a BAA is, when an incident report needs one, how IncidentKit handles patient information and AI, and what we keep out of analytics.

Source: https://incidentkit.ai/hipaa · Updated Oct 5, 2026

Incident reports at healthcare facilities often contain protected health information, so the vendor is a business associate and needs a signed BAA. IncidentKit signs a BAA on Regulated and Network plans, runs Lauren on a BAA-covered AI provider, and does not allow patient information on the free Open plan. There is no official HIPAA certification for software.