Money

Gatewayone auth, scope and meter plane

Dispatch

Dispatchroutes each call to the right providerBridgepreviewbridges a stream between transportsInterchangepreviewconverts between media formats

Studio

Clipscut and publish clipsEditorpreviewedit in the browserCollabpreviewmulti-user editing sessionsPodcastpreviewrecord and publish podcastsStudio AIpreviewAI-assisted production

Infrastructure

Pulsepreviewlive stream analyticsCodecpreviewcodec benchmarksMetricspreviewthe metrics sinkEmailpreviewthe email edgeGPUpreviewGPU seconds at the edge

Transports

Realtimepreviewthe realtime protocol planeMoQpreviewMedia over QUIC ingest and deliveryNDIpreviewNDI over the public internetDantepreviewDante audio across networksOMTpreviewOpen Media Transport streamsSRTpreviewSRT ingest and relay

Intelligence

Voicepreviewsynthetic and cloned voiceCaptionspreviewlive and file captionsChapterspreviewautomatic chapter markersTranscribepreviewspeech to textSentimentpreviewsentiment across a transcriptSearchpreviewsearch inside the mediaEnhancepreviewclean up audio and videoAcuitypreviewmedia quality analysis

Media

Media Enginepreviewthe Media Engine overview

Deliver

Listenaudio-only deliveryCrestpreviewcamera and board mix to a tabBadgepreviewembeddable live badge

Media

ClipsListenPulsepreviewRealtimepreviewMoQpreviewNDIpreviewDantepreviewOMTpreviewSRTpreviewVoicepreviewCaptionspreviewChapterspreviewEditorpreviewCollabpreviewPodcastpreviewStudio AIpreviewTranscribepreviewSentimentpreviewSearchpreviewMedia EnginepreviewCodecpreviewEnhancepreviewMetricspreviewEmailpreviewCrestpreviewAcuitypreviewBadgepreviewGPUpreview

Money

Gateway

Dispatch

DispatchBridgepreviewInterchangepreview

Company

PricingDocsSign in

Business Associate Agreement

Last updated 2026-09-01

Last updated: 2026-09-01

WAVE Online, LLC offers a Business Associate Agreement (BAA) under the Health Insurance Portability and Accountability Act (HIPAA) and the HITECH Act for Customers who are Covered Entities or Business Associates and who require HIPAA-tier service.

How to obtain a BAA

BAAs are activated on a per-Customer basis. To request execution:

  1. Email legal@wave.online with the subject “BAA Request” and your organization name.
  2. Receive the BAA template (under NDA) for your review.
  3. Execute via DocuSign or counter-sign and return.
  4. Once executed, your account is configured for HIPAA-eligible processing — including BAA-only subprocessor routing among vendors that process customer data under our BAA program (Twilio ConversationRelay BAA where applicable, Supabase BAA).

Scope summary (full terms available under NDA)

  • Permitted uses and disclosures: WAVE will use or disclose Protected Health Information (PHI) only as permitted by the BAA, the underlying Master Subscription Agreement, or required by law.
  • Safeguards: WAVE implements administrative, physical, and technical safeguards required by 45 C.F.R. §§ 164.308, 164.310, and 164.312.
  • Security incident reporting: WAVE notifies Customer of Successful Security Incidents within 24 hours; for Breaches of Unsecured PHI, within 48 hours of discovery.
  • Subcontractors: WAVE flows down BAA terms to all Subcontractors who handle PHI; the BAA-eligible subprocessor list is provided as Attachment A to the executed BAA.
  • Data return / destruction: Within 60 days of termination, WAVE returns or destroys all PHI in its possession, subject to obligations to retain PHI to comply with law.
  • Liability cap carve-out: The Master Subscription Agreement's limitation of liability does not cap damages arising from breach of HIPAA obligations, consistent with HHS guidance.

Eligible service tiers

BAAs are available on the Scale tier (WAVE's enterprise tier). Build and Ship do not include HIPAA features by default — contact enterprise@wave.online to discuss upgrade options.

Out-of-scope features

Some platform features are not BAA-eligible because their underlying subprocessors do not offer BAAs. These are disabled for BAA-active accounts and listed in Attachment B of the executed BAA. Examples may include: select third-party analytics integrations, certain social-media auto-post features, and AI features routed through models without BAA coverage.