Does my vendor need a BAA? How to tell
Practices add vendors constantly, and each one raises the same question: do we need a Business Associate Agreement with them? The answer comes down to what the vendor does with patient information, not what the vendor calls itself. Here is a practical test, the common exceptions, and what to do when a vendor says no. This is general information, not legal advice.
- If a vendor creates, receives, maintains or transmits patient information on your behalf, it is almost always a business associate and needs a BAA.
- Storing encrypted data still counts. HHS says a cloud provider is a business associate even if it cannot read the data.
- The main exceptions are narrow: your own workforce, other providers you share information with for treatment, pure transmission conduits, and incidental access.
- If a vendor will not sign, the answer is not to send them patient data.
The three-question test
HIPAA's definition of a business associate, in 45 CFR 160.103, turns on activity. Run any new vendor through the three questions below. If the answer to all three is yes, you need a signed BAA before any patient data moves:
- Will the vendor touch protected health information at all? PHI is any individually identifiable health information, including something as ordinary as a name tied to an appointment time at a medical office. If the vendor will create, receive, store, view or send any of it, keep going.
- Is the vendor doing it for you? A vendor performing a function or service for your practice, such as hosting, billing, answering phones, messaging patients or analyzing your schedule, is acting on your behalf. A separate provider treating the same patient is not.
- Is the vendor outside your workforce? Employees, volunteers and trainees under your direct control are workforce members, not business associates. An outside company or independent contractor is.
Common vendors, sorted
These are typical answers. The details of a specific arrangement can change them, so use this as a starting point rather than a ruling.
- EHR and practice management software: yes. They maintain your records.
- Billing companies and clearinghouses: yes for billing services; clearinghouses have their own HIPAA status but typically sign BAAs with providers.
- Answering services and call centers: yes. They take messages with patient names and reasons for calling.
- Patient texting, reminder and recovery platforms: yes. They hold appointment data and message logs.
- IT support and managed service providers: yes, if they can access systems holding PHI.
- Cloud storage, backup and hosted email: yes. They maintain your data, even if it is encrypted.
- Shredding and records storage companies: yes. They receive PHI to destroy or keep it.
- Accountants, consultants and attorneys: yes, when their work involves PHI. The HIPAA definition names legal, accounting and consulting services specifically.
- Your phone carrier or internet provider: usually no. These are typically treated as conduits, explained below.
- A cleaning crew: no. Any exposure to PHI is incidental, not part of their job.
The exceptions, and how narrow they are
Treatment. The definition of business associate excludes disclosures to another health care provider about a patient's treatment. Sending a referral to a specialist or an order to a lab does not require a BAA with that provider.
The conduit exception. HHS guidance treats companies that only transmit information, with no more than temporary storage incident to that transmission, as conduits rather than business associates. The classic examples are the postal service and internet service providers. The exception is narrow: HHS has said in its cloud computing guidance that it covers transmission-only services, and that any company that stores data for you is not a conduit.
Encrypted storage is not an exception. In the same guidance, HHS states that a cloud service provider that stores electronic PHI is a business associate even if the data is encrypted and the provider does not hold the key. Persistent access is what counts.
Incidental access. HHS explains that people whose work does not involve PHI, such as janitors or a plumber fixing a sink, are not business associates even if they could glimpse a record. You still need reasonable safeguards to limit what they see.
Financial institutions. A bank processing ordinary payment transactions, such as cashing a patient's check, is generally not a business associate for that activity under a specific HIPAA provision on payment processing.
The tricky cases
Free trials and demos. A vendor that reviews even one real schedule export during a demo is receiving PHI. The BAA comes first, or the demo uses fake data.
Messaging platforms versus carriers. The wireless carrier that delivers a text is usually a conduit. The software platform that schedules the message, stores the conversation and logs replies is not, because it maintains PHI. You need a BAA with the platform.
General-purpose software. Word processors, spreadsheets, video tools and AI chat assistants often have a consumer tier with no BAA and a business tier with one. The same product can be fine or forbidden depending on which plan your staff are logged into.
Subcontractors. You do not sign BAAs with your vendor's vendors. Under 45 CFR 164.502(e), the business associate must get its own written assurances from any subcontractor that handles your PHI. Ask your vendor to confirm that chain exists.
When a vendor won't sign
Some vendors refuse, either because they do not want HIPAA obligations or because their product is not built for health data. You have three options:
- Find a vendor that will sign. For most categories of practice software, several options exist that offer BAAs.
- Restructure so no PHI is involved. A marketing designer working on your logo does not need patient data. Keep it that way.
- Walk away. "We take privacy seriously" or "we are HIPAA compliant" is not a substitute. Without a signed BAA, sending that vendor PHI is a disclosure HIPAA does not permit.
A five-minute vendor intake routine
Give one person on your team ownership of this checklist and run it before anyone signs up for a new tool:
- Write down exactly what data the vendor will see. If it includes anything about patients, assume a BAA is needed.
- Ask the vendor for its BAA in writing. Note the plan or tier it covers.
- Ask which subcontractors handle the data and where it is stored.
- Record the signed BAA in your vendor list with the date and storage location.
- Only then connect accounts, upload files or share screens with real patient data.
DocsMD is a business associate, and signs like one
DocsMD works from your schedule export, so it handles PHI and is your business associate. That is why it signs a BAA with every practice before any patient data moves, including for the free leak audit. Data stays encrypted at rest and in transit in U.S. data centers. See the details on our HIPAA and BAA page.
Questions
Does a vendor need a BAA if it only sees patient names and appointment times?
Yes. A name linked to an appointment at a health care practice is protected health information. A vendor that receives or stores it on your behalf is a business associate.
Does my phone company need a BAA?
Usually not. Carriers that only transmit calls and texts are typically treated as conduits. A software platform that stores messages or call recordings for you is different and does need one.
If the data is encrypted, can I skip the BAA?
No. HHS guidance on cloud computing says a provider that stores encrypted PHI is still a business associate, even without the encryption key.
Do I need a BAA with the specialist I refer patients to?
No. Disclosures between providers for a patient's treatment are excluded from the business associate definition. This article is general information, not legal advice.