What is a Business Associate Agreement?
Every time a practice lets an outside company handle patient information, HIPAA expects a specific contract to be in place first: the Business Associate Agreement, or BAA. This guide explains what a BAA is, what the regulations require it to say, and how to read one before you sign. It is general information, not legal advice.
- A BAA is the written contract HIPAA requires before a vendor creates, receives, maintains or transmits protected health information for your practice.
- The required contents are set out in 45 CFR 164.504(e): permitted uses, safeguards, breach reporting, subcontractor flow-down, patient rights support, HHS access and return or destruction of data at the end.
- A BAA is a contract, not a certification. HHS does not certify vendors as HIPAA compliant.
- Sign the BAA before any patient data moves, including for free trials, pilots and audits.
The short definition
Under HIPAA, a medical, dental or therapy practice that bills insurance electronically is a covered entity. When that practice hires an outside company to do work that involves protected health information (PHI), the company becomes a business associate. The HHS definition in 45 CFR 160.103 covers any person or company that "creates, receives, maintains, or transmits" PHI on the practice's behalf.
The Business Associate Agreement is the contract between the two. The HIPAA Privacy Rule, at 45 CFR 164.502(e), lets a practice share PHI with a business associate only after it obtains "satisfactory assurance" that the vendor will safeguard it, and that assurance must be documented in a written contract that meets the requirements of 45 CFR 164.504(e). The Security Rule repeats the requirement for electronic PHI at 45 CFR 164.308(b).
Your own employees are not business associates. HIPAA treats them as your workforce, which the rules define as people whose conduct is under your direct control, paid or not. The BAA is for outsiders: software companies, billing services, answering services, IT firms, shredding companies and the like.
Why the contract matters so much
Handing patient data to a vendor does not hand off your responsibility for it. The BAA is how you set the rules the vendor must follow, and it is the first document a regulator will ask for if something goes wrong.
Since the 2013 HIPAA Omnibus Rule, business associates are also directly liable for parts of HIPAA. In 2019 the HHS Office for Civil Rights (OCR) published a fact sheet listing the provisions a business associate can be penalized for on its own, including failing to comply with the Security Rule, impermissible uses and disclosures, and failing to report breaches to the covered entity. That does not take the practice off the hook for having the contract in the first place.
OCR has enforced this point directly. In 2016 an orthopedic practice in North Carolina agreed to pay $750,000 after it handed X-ray films and related information for roughly 17,300 patients to a vendor without a BAA. The corrective plan required the practice to build a process for identifying business associates and getting agreements signed before disclosing anything.
What a BAA must contain
The required terms are listed in 45 CFR 164.504(e)(2). In plain English, the contract must:
- Define permitted uses. Spell out what the vendor may and must do with PHI, and prohibit everything else except what the law requires.
- Require safeguards. Commit the vendor to appropriate safeguards and, for electronic PHI, compliance with the HIPAA Security Rule.
- Require reporting. The vendor must report any use or disclosure not allowed by the contract, including breaches of unsecured PHI.
- Flow down to subcontractors. Any subcontractor that handles the PHI must agree to the same restrictions and conditions.
- Support patient rights. The vendor must make PHI available so you can honor patients' rights to access, amendment and an accounting of disclosures.
- Follow HIPAA when doing your work. If the vendor carries out one of your Privacy Rule obligations, it must follow the rules that apply to you.
- Open its books to HHS. The vendor must make its relevant practices, books and records available to the Secretary of HHS.
- Return or destroy at the end. At termination the vendor must return or destroy all PHI, or, if that is not feasible, extend the contract's protections and limit further use.
- Allow termination. You must be able to end the contract if the vendor violates a material term.
What a BAA does not do
A signed BAA is necessary, but it is not proof that a vendor is secure. It is a set of promises. You still have to judge whether the vendor can keep them.
Be wary of any vendor that describes itself as HIPAA certified. There is no such government certification. In its published FAQ on the Security Rule, HHS states that it does not endorse or otherwise recognize private organizations' certifications, and that such certifications do not absolve covered entities of their obligations. A badge on a website is marketing. The signed agreement is the legal document.
A BAA also cannot make an otherwise impermissible use acceptable. If a vendor's contract lets it do something HIPAA itself would not allow you to do, the contract does not fix that.
Red flags to look for before you sign
Most BAAs are drafted by the vendor. Read them with these questions in mind:
- Broad data use rights. Clauses that let the vendor de-identify, aggregate or use your data "to improve our services" deserve a close read. Ask exactly what that covers, including whether data is used to train AI models.
- Slow breach reporting. HIPAA sets an outer limit of 60 days for a business associate to report a breach to you (45 CFR 164.410). You can and should ask for a much shorter window in the contract.
- Missing subcontractor terms. If the vendor relies on cloud hosts, messaging carriers or AI model providers, the BAA should require the same protections from them.
- No exit plan. Look for a clear return-or-destroy clause, a timeline and a format for getting your data back.
- BAA only on premium plans. Some vendors sign only for higher tiers. If the plan you are buying is not covered, no PHI should go into it.
- Click-through terms that exclude PHI. Some general-purpose tools say in their terms that you may not upload health information. Using them for patient data anyway leaves you with no BAA at all.
Keeping your BAAs in order
A simple system prevents most problems. Keep one list of every vendor that touches patient information, with the date each BAA was signed and where the signed copy lives. Review the list once a year and whenever you add a new tool.
HIPAA requires covered entities to retain required documentation for six years from when it was created or last in effect, whichever is later (45 CFR 164.530(j)). Keep each BAA at least that long after the relationship ends.
Most important: get the agreement signed before any data moves. Free trials, pilots, onboarding calls where a vendor looks at your schedule and free assessments all count. If a vendor will see a single patient record, the BAA comes first.
DocsMD signs a BAA before any patient data moves
DocsMD signs a Business Associate Agreement with every practice before a single patient record is shared, including for the free leak audit. Data is encrypted at rest and in transit and kept in U.S. data centers, and patient data is never used to train AI. You can review our terms on the HIPAA and BAA page.
Questions
Do I need a BAA with my EHR vendor?
In most cases, yes. An EHR or practice management vendor that hosts or maintains your patient data is creating, receiving, maintaining or transmitting PHI on your behalf, which makes it a business associate.
Do I need a BAA with my cleaning service?
Generally not. HHS guidance explains that people whose work does not involve PHI, and who might only see it incidentally, such as janitorial staff, are not business associates. You should still use reasonable safeguards to limit what they could see.
Who writes the BAA, the practice or the vendor?
Either party can. HHS has published sample business associate agreement provisions that many practices and vendors use as a starting point. What matters is that the final signed version contains every element required by 45 CFR 164.504(e).
Is a vendor that signs a BAA automatically HIPAA compliant?
No. The BAA is a contract that sets obligations. Compliance depends on what the vendor actually does, which is why you should also ask about encryption, access controls and breach response. This article is general information, not legal advice.