Test mode and the BAA

Every organization starts in testing mode. You can try every feature with synthetic notes. To analyze real patient data, an owner signs the Business Associate Agreement (BAA) in the app, and the organization goes live.

Organization status

Your organization's status appears on the Home page and in Settings.

Testing mode

While your organization is in testing mode, everything works: analyzing notes, batches, the API, invitations, and buying credits. To protect patient data, the app adds the following:

• A strip at the top of every app page says Testing mode: don't paste real patient data. Owners also see a link to sign the BAA.
• Before each analysis or batch, you select the This is not real patient data checkbox. Through the API, you send "test_data": true instead. For more information, see Test mode in the API.
• Each result made in testing mode is labeled Test and shows the date it's deleted.

When test results are deleted

Each test result is deleted 30 days after it was created. The owners of your organization get an email 7 days and 1 day before results are deleted, with the number of results and the date, so you can review them first.

Test results stay test results. After the organization goes live, results made in testing mode keep their Test label and their deletion date.

Sign the BAA

Only an owner can sign the BAA, and the signature covers the whole organization. Signing also makes two-step verification required for everyone in the organization, so the owner who signs sets it up first.

1. In the sidebar, click Settings.
2. In the Business Associate Agreement section, click Review and sign.
3. Under Which describes your organization?, choose one of the following:
   • A healthcare provider or plan
   • A company that handles patient data for providers, for example a billing or coding company.
4. Read the agreement. To keep a copy of the text, click Download text.
5. If the page shows First, set up two-step verification, click Set up two-step verification, follow the steps, and you return to the agreement. For the steps, see Two-step verification.
6. Fill in Your full name, Your title, and Organization legal name.
7. In Type your full name to sign, type your full name exactly as you entered it.
8. Select I am authorized to sign this agreement for my organization.
9. Click Sign agreement.

The page confirms Agreement signed, and your organization is live. The owners get an email, and you can download the signed agreement as a PDF. From then on, everyone in the organization signs in with two-step verification; anyone who hasn't set it up is asked to the next time they open the organization. Signed agreements stay listed on the BAA page under Signed agreements, each with Download PDF.

New versions of the BAA

The BAA that an owner signs is the current version. MedChartScan can publish a new version of the BAA, for example when the law or a subprocessor changes. If your organization signed an earlier version, an owner signs the new one by a due date, usually 30 days after it's published. The version you signed before still covers the patient data you sent under it.

Organizations in testing mode aren't affected: when an owner signs, they sign the current version.

When a new version is published

• The owners get an email that names the version and the due date, with a link to Settings > BAA. They get a reminder 14 days, 7 days, and 1 day before the due date, until an owner signs.
• Owners and admins see a strip at the top of every app page, for example An updated BAA needs your signature by December 3, 2026. Other members see it only after the due date.
• Everything keeps working as usual until the end of the due date (UTC).

Re-sign an updated BAA

1. Click Review and sign in the strip at the top of the page, or go to Settings and, in the Business Associate Agreement section, click Review and sign.
2. Read What changed and the agreement text. The page shows the version and the due date.
3. Check Which describes your organization?. It starts with the choice from your last signature.
4. Fill in the form and click Sign agreement, as in Sign the BAA.

The page confirms that the new version is signed. The owners get an email with the signed copy, and both versions stay listed under Signed agreements.

If your organization is paused

If no owner signs by the end of the due date (UTC), new processing is paused, and the owners get one email saying so, with a link to Settings > BAA:

• A strip at the top of every app page says New notes are paused. Owners see a link to review and sign.
• New analyses and batches, and retries of failed notes, are blocked, from the app and the API. The API returns 403 baa_resign_required.
• Notes that were still waiting in a batch queue at the due date fail without charge. You can retry them after the BAA is signed.
• Everything else keeps working: you can open, export, and delete results, buy credits, invite people, and manage API keys.

To end the pause, an owner signs the new version as described in Re-sign an updated BAA. Processing resumes as soon as the owner signs. If you need more time, write to support@medchartscan.io before the due date.

Related pages

• Security and patient data
• Team and roles
• Test mode in the API