Business Associate Agreements: who needs one
If a vendor can see, store or pass through your patients’ health information, HIPAA requires a signed agreement with them. Most practices have two or three missing.
If a vendor can see, store or pass through your patients’ health information, HIPAA requires a signed agreement with them before they do. Most practices are missing two or three — usually the ones nobody thought of as vendors.
What a BAA is
A Business Associate Agreement is a contract between you (a covered entity) and any vendor that creates, receives, maintains or transmits PHI on your behalf (a business associate). It commits them to safeguard the information, to use it only as permitted, to report breaches to you, to hold their own subcontractors to the same terms, and to return or destroy the data when the relationship ends.
Who needs one
| Yes | EHR vendor · medical billing service · transcription · cloud storage or backup holding clinical data · email hosting used for PHI · IT provider with access to systems · patient communication and recall platforms · answering service · document shredding · collections agency · practice management consultants who see records |
|---|---|
| Usually no | Your landlord · the cleaners (with no record access) · utilities · a courier that only carries sealed packages · another provider you refer to for treatment purposes |
| Check carefully | Website host · form and CRM services · analytics · chat widgets · anything embedded in your patient portal. Depends entirely on whether PHI reaches them — see HIPAA and your website. |
The conduit exception is narrower than people hope. It covers services that merely transport data without storing it — the postal service, an ISP. A cloud provider that stores your files is not a conduit, even if it never looks at them. “We only pass it through” is rarely true of anything holding data at rest.
Building your list
Follow the money
Go through twelve months of payments. Every recurring vendor gets assessed. This catches subscriptions nobody remembers signing up for.
Follow the logins
List every system holding patient data and everyone with access, including external support accounts. Vendor remote-access tools count.
Follow the data out
Where does information physically go? Billing, labs, imaging, referrals, recall messaging, statements, collections.
Check the website
Open the network tab on a clinical page and see which third-party domains are contacted. This routinely surfaces trackers nobody knew were live.
Record the outcome for each
Vendor, what they touch, BAA signed yes/no, date, and where the document is. Note the “no” decisions and your reasoning — that record is as valuable as the agreements.
Getting one signed
Most established healthcare vendors have a standard BAA and a process for it — often self-serve in the account settings. Larger cloud providers frequently require you to accept it explicitly or be on a specific plan; being a customer is not the same as being covered.
Read what you are signing. Watch for breach notification windows long enough to blow your own 60-day deadline, subcontractor terms that let them delegate freely, and liability caps that would not cover a notification event.
Keeping it current
- Store every BAA in one place, with a named owner.
- Review the list annually, and whenever you add a vendor or change EHR.
- When a relationship ends, confirm in writing that data was returned or destroyed.
- Keep signed agreements for at least six years — HIPAA’s documentation retention period.
FAQ
Do we need one with EHR Express?
If we touch systems or data containing PHI, yes — and we will sign one. Ask and we will send it. If we only build and host a marketing website that never receives PHI, it may not be required, but we are happy to have one anyway.
Is a signed BAA proof that a vendor is secure?
No. It is a contractual commitment, not an audit. For vendors holding significant volumes of PHI, ask additionally for a SOC 2 report or equivalent evidence.
Do we need one with another doctor we refer to?
Generally no. Disclosures between providers for treatment purposes are permitted without a BAA — the other provider is a covered entity acting in their own right, not a business associate acting on your behalf.