La documentación del producto está disponible solo en inglés.
Compliance agreements (BAA and DPA)
Personal injury records hold health information about your clients, so a firm on the Professional plan agrees in writing to how Esqase may handle that information before it records the first case. Your firm owner reads and accepts one agreement, once, inside Esqase. Accepting it also switches on three protections for everyone at the firm.
Note: This is an agreement between your firm and Esqase. It is separate from the Terms of Service your firm accepted at signup, and separate from anything you sign with your own clients.
Before you begin
- Only the firm owner can accept. Every other member sees the same card with a line asking the owner to accept it, and no buttons. See Managing firm members.
- Your firm has to be on the Professional plan. On Standard there is nothing to accept, because personal injury is not in the plan. See Your Esqase subscription.
- Your firm's registered country decides which agreement you get. A firm registered in the Philippines is offered a Data Processing Agreement. Every other firm, the United States included, is offered a Business Associate Agreement. Your country is set on your firm profile and is shown to you again before you accept. See Your firm profile and details.
- Nothing else in Esqase waits on this. Only personal injury is held behind it.
Where the agreement appears
Click Personal injury in the sidebar. Until the agreement is accepted, you get one full-width card instead of the module:
- The title reads Business Associate Agreement required, or Data Processing Agreement required for a firm registered in the Philippines.
- The firm owner sees a short explanation of what the records are, what the agreement covers, and what accepting turns on, plus two buttons: Read and accept, and Open the published version (which opens the same agreement on the Esqase website in a new tab).
- Everyone else sees the explanation and a line asking them to have the firm owner accept it.
Your matters do not show the Medical, Damages, Claims, and Settlement tabs either, so the card is the one place the agreement is offered. Until it is accepted, nothing personal injury can be saved anywhere. That is enforced when a record is written, not only on the screen.
Accept the agreement
You need to be the firm owner.
- Click Personal injury in the sidebar, then click Read and accept on the card.
- The agreement opens in a dialog. Read the panel at the top, Accepting changes two things for everyone at your firm, which explains the two controls that switch on the moment you accept.
- Under Confirm where your firm is registered, tick the box that names your country, for example "My firm is registered in the United States." Which agreement you are accepting is decided by this, so check it against your records. If it is wrong, follow the Change it in Firm settings link, correct the country, then come back and start again. If your firm has no country recorded, the box instead says that you have no registered country set and accept the agreement anyway.
- Read the agreement in the scrolling panel. The version you are accepting is shown underneath it. Open the published version opens the same text on the Esqase website if you would rather read it full width or send it to your own counsel first.
- Enter the Full name and Title of the person accepting on behalf of the firm.
- Type ACCEPT in the confirmation box. The accept button stays disabled until the country box is ticked, both fields are filled in, and the word matches.
- Click Accept the business associate agreement (or Accept the data processing agreement). Esqase confirms with Business Associate Agreement accepted and the module opens.
Esqase records who accepted it, the name and title they typed, the date and time, the exact version of the document, and the network address and browser used. That record is written to your firm's audit trail. See Activity log and audit trail.
What accepting turns on
Three things change for the whole firm at the moment the agreement is accepted. None of them can be switched off while the agreement is in force.
1. Two-factor authentication becomes required
Every member of the firm has to use two-factor authentication. Anyone who has not set it up is taken to the setup screen the next time they open Esqase, with the line "Your firm requires two-factor authentication. Set it up to continue." There is no Skip on that screen while it is required, and they cannot reach the dashboard, settings, or any other firm screen until they finish.
Members also cannot turn their own two-factor authentication off while the firm requires it. The Turn off button is still on their security page, but using it returns "Your firm requires two-factor authentication, so it cannot be turned off. Ask your firm owner if this needs to change."
The firm-wide switch under Settings > Firm is locked on, with the line "Required while your firm's business associate agreement is in force" (or "data processing agreement" for a firm in the Philippines). See Two-factor authentication (2FA).
2. Push and email alerts stop carrying case details
Notifications that leave Esqase say what kind of thing happened and nothing more. A push alert or a notification email reads Task assigned and Open Esqase to see it., never the client, matter, document, or provider name. Billing emails drop your firm name too.
The notifications list inside Esqase is unchanged: the bell, the Notifications page, and the corner messages all still show the full title and body. See Notifications.
3. AI document indexing is turned off
The firm-wide AI document indexing setting is switched off, so no new or updated document is read to build a summary or a search index. Your firm turns it back on deliberately, and personal injury cases stay opted out until someone opts each one in.
On each personal injury case, the Medical tab's Incident details card carries a Let Esqase read documents on this case switch. It is off by default on personal injury matters. Turning it on lets the documents on that case be analyzed so your team can search what is in them.
Important: Turning the firm-wide setting back on does not turn on any personal injury case. Each case is opted in on its own, by someone with Update access for personal injury.
When the agreement is updated
If Esqase changes the text of the agreement, your firm accepts the new version before it can carry on recording personal injury. The same card comes back, this time titled Business Associate Agreement updated (or Data Processing Agreement updated), the owner's button reads Read and accept the update, and the description says the agreement your firm accepted has been updated and needs to be read and accepted again.
Accepting the update files the earlier acceptance rather than replacing it, so what your firm agreed to and when stays on record.
The same thing happens if your firm's registered country is corrected in a way that changes which agreement applies: Esqase asks for the agreement that matches the new country, and files the old one.
Where to see it afterwards
Go to Settings, then Firm. The firm owner sees two read-only reminders under the profile fields:
- Security shows Require two-factor authentication switched on and locked, with the reason underneath.
- Notifications shows Content-free notifications with an On badge and the same "Required while your firm's ... is in force" line, naming the agreement your firm holds.
The published version of each agreement is on the Esqase website: the Business Associate Agreement and the Data Processing and Outsourcing Agreement (Philippines).
Common questions
Can I accept both agreements? No. Your firm holds one at a time, the one that matches your registered country. Accepting the other files the first.
We are not in the United States or the Philippines. Which one do we get? The Business Associate Agreement. Confirm your registered country in the dialog before you accept, and talk to your own counsel if your jurisdiction needs something different.
Can I turn two-factor authentication or content-free alerts back off? Not while the agreement is in force. They are part of what the agreement commits your firm and Esqase to.
What happens to the agreement if we move back to Standard? It stays on record, and so do the two controls. Moving to Standard hides the module; it does not undo what your firm agreed to.
Does accepting delete or change anything? No. It records the acceptance and switches on the three protections above. Nothing your firm has entered is touched.