Hi - Yes, TrueVault does sign a BAA. We also carry a comprehensive cyber liability insurance that covers any post-breach costs and regulator fines (hopefully it'll never come to that).
Do you add clients as named insureds on that coverage?
If not, it's not really worth the paper it's printed on for your clients.
We will on a case by case basis. But there are other contractual indemnification options as well. Ping us and we can tell you all about it.
Yes, they do sign BAAs -- it's the last point on the page.
Sure there is. You find out whether you're compliant when OCR moves to the resolution phase of your enforcement action.