Create client BAA and service agreements

1 / Operating model

Treat drafting, approval, generation, delivery, and acceptance as different controls

2 / Readiness

Approve the parties, template, owner, terms, and retention rule before drafting

For BAAs, counsel should evaluate required provisions such as permitted and required uses, safeguards, incident reporting, subcontractor obligations, access and amendment support, records availability, return or destruction of PHI, and termination rights. Use HHS sample provisions as an authoritative reference, not a substitute for legal review.

3 / Access and preflight

Verify page access, action permissions, practice context, and Gmail before work

1. Open Client Agreements using your named account.Admin and Super Admin roles pass the admin route. A non-admin needs the exact pages:client_agreements permission.
2. Confirm create or update authority.Page access does not guarantee writes. Saving and sending need the applicable agreements:create or agreements:update action plus file upload or create authority. Deletion needs agreements:delete.
3. Check the intended organization and default practice.The page has no practice selector. The database row and storage path use the current default practice, not the provider selected in the form.
4. Verify the recipient through an approved source.Send requires a valid client email. Do not rely on an old directory field when legal delivery instructions specify another address.
5. Connect Email Outreach / Gmail before Send.The current Send action uses the connected Gmail account and backend email endpoint. Save or Print can still be used when email is intentionally not required.
6. Use sample data for training.Never test a legal workflow with patient PHI, credentials, banking details, another tenant, another Xpand product, or Guardian Connect data.

Administrators can review users in User Management and permission presets in Roles. Do not widen someone to Admin only to bypass a denied agreement action.

4 / Client identity

Select a directory record, then verify every legal field manually

1. Choose Business Associate Agreement or B2B Service Agreement.The selected tab controls the maintained document template and type-specific fields.
2. Search the central client directory.Search results combine active dedicated providers and legacy provider employee rows, remove duplicate email or shadow identities, and show up to eight matches.
3. Select the intended client record.The page fills display name, phone, and locality from city, state, and ZIP. Service agreements also receive email. BAA and service party fields are populated according to the selected type.
4. Verify the full legal name and entity.A provider or practice display name may differ from the contracting legal entity. Replace only with authorized legal data.
5. Enter the full legal address.Street address is not automatically supplied by the current selection flow. Confirm street, city, state, ZIP, and any required jurisdiction.
6. Verify phone, website, email, signer, and title.Auto-fill is a convenience, not authoritative legal evidence. Legacy provider results can also have no canonical provider_id.
7. Confirm provider selection did not change practice.It only links provider data and fills form fields; the protected record still uses the current default practice.

Use Providers / Clients to correct authorized directory data. Do not alter a legal identity only inside one agreement when the canonical source is wrong.

5 / Business Associate Agreement

Complete the party, timing, reporting, cure, and governing-law fields

6 / Service Agreement

Translate the approved offer into complete, unambiguous commercial terms

Do not use the service agreement to promise a feature, compliance certification, SLA, integration, payer outcome, or financial result that is absent from the approved offer and current product.

7 / Preview and signatures

Review the entire rendered document before drawing or generating anything

1. Read from title through signature blocks.The preview updates immediately from form values. Check names, pronouns, defined terms, addresses, dates, reference, numbering, fees, units, jurisdiction, and every inserted variable.
2. Compare against the approved source.Review clause wording and exhibits, not only visible fields. A complete-looking preview is not proof that the maintained template is current.
3. Confirm the service-provider identity.Verify DentalXpand legal name, contact, website, signer, and title before either party signs.
4. Capture only authorized signatures.Use the client signature pad only when the signer is present and the approved process permits canvas capture. DentalXpand signature is optional and must be applied only by its authorized signer.
5. Use Clear when a mark is wrong.The signature is emitted as a PNG data URL and embedded in the generated PDF. Clear the canvas and redraw before generation; never reuse another person’s image.
6. Do not call the result executed without evidence.Confirm signer authority, consent, counter-signature, delivery, acceptance, legal effective conditions, and the governed executed-copy process separately.

8 / Generate, save, or send

Choose the action from its actual result, not its button label alone

1. Use Print when an approved local handoff is required.Choose Save as PDF in the browser dialog, store it only in the approved repository, and remember the DentalXpand Records list will not contain it.
2. Use Save for a controlled draft record.Wait for the success message, refresh the saved list, open the PDF, and verify client, type, date, file content, organization, and intended default-practice ownership.
3. Use Send only after final recipient review.Confirm connected Gmail, recipient address, approval to send, and no sensitive information in the message beyond the required agreement.
4. Do not click repeatedly while generation is running.Wait for completion or a clear error so duplicate files, records, or messages are not created.

9 / Delivery evidence

Separate saved-record success from email-send success

1. Wait for the explicit send-success confirmation.The row is created before email is sent. If Gmail fails afterward, a protected file and sent row can remain even though delivery failed.
2. Verify the connected account’s Sent folder when required.Use recipient, subject, time, and attachment name as delivery evidence. Do not expose the document to unauthorized staff while checking.
3. Understand the two recipient paths.The message includes a PDF attachment and a temporary signed download URL. The attachment remains with the email; the signed link normally expires after about one hour.
4. Generate a new link by reopening the saved record.Refresh Client Agreements and use Open PDF to obtain a new signed URL. Do not make the storage bucket public to avoid expiry.
5. Keep attachments within the backend limit.The Gmail endpoint rejects an attachment set above roughly 18 MB decoded, or about 24 MB after base64 expansion. Generated agreements should normally be much smaller.
6. Record acceptance outside this page.Use the approved signing and executed-document process to capture return, consent, identity, date, counter-signature, and final storage.

10 / Records and retention

Reconcile the saved PDF, metadata, delivery evidence, and executed copy

The record stores agreement type and date, effective date, optional reference, provider link, protected file URL and path, form data JSON, status, creator, timestamps, organization, and tenant practice. Apply the approved retention schedule and legal-hold process; never delete solely to make a list cleaner.

11 / Tenant, practice, and data protection

Verify the default-practice owner before Save or Send

12 / Troubleshooting and completion

Resolve the failed stage without widening access or inventing evidence

Completion checklist

• I know whether the relationship needs a BAA, Service Agreement, both, or another approved instrument.
• I use a counsel-reviewed, party-specific template and do not treat DentalXpand or HHS sample language as automatic legal sufficiency.
• I verify named account, exact page and action permissions, connected Gmail when sending, organization, and intended default practice.
• I select the correct client but manually verify legal name, full address, contacts, signatory, title, and provider link.
• I verify every BAA timing field, safeguard obligation, termination rule, governing law, and required exhibit.
• I verify service scope, fee basis and value, billing cycle, payment terms, commitment, notice, start date, and governing law.
• I read the entire preview and capture a signature only through an authorized process.
• I understand that Print creates no record, Save creates a draft record, and Send creates a sent record before Gmail completes.
• I verify explicit email success and do not treat a saved row, temporary link, or sent status as acceptance or execution.
• I reconcile the protected PDF, metadata, delivery evidence, returned executed copy, and retention owner.
• I delete only with retention and legal-hold approval and verify both database and protected file outcomes.
• I exclude PHI, credentials, banking details, unrelated tenants, other Xpand products, and Guardian Connect data.
• I stop at wrong-practice, cross-tenant, or legal-identity uncertainty and use the approved correction path.

Open Client Agreements, review Operate a DSO or multi-practice workspace, continue to Configure organization branding and client context, verify approved identity in Settings, or return to all learning resources.