What is a business associate agreement (BAA)?

Who counts as a business associate?

Generally, any outside company that does something for your clinic that involves PHI. HHS lists examples, and several will sound familiar:

• An EHR vendor or managed IT provider that needs access to PHI to support your systems
• A cloud provider that stores your PHI, even if the data is encrypted and the provider holds no key
• A company that builds a patient app or portal and handles patients' PHI
• A third party AI chatbot on your patient portal that handles PHI, for things like symptom questions, reminders, or scheduling
• A billing or claims service
• Your accountant or attorney, if the work involves PHI

When you do not need one

HHS says a BAA is not required in several common situations:

• Sending a patient's records to another provider for treatment, such as a specialist or a lab
• Submitting a claim to a health plan for payment
• A service like a janitor or electrician, as long as any access to PHI is only incidental and reasonable safeguards are in place
• A company that acts only as a conduit, like the US Postal Service or certain couriers. HHS limits this to transmission-only services, including temporary storage that is incidental to the transmission. A company that accesses PHI regularly, or maintains it for storage or processing, is not a conduit and needs a BAA

The test is simple. Is the other party working for you, or providing you a service, in a way that involves PHI? If yes, you need the agreement.

What a BAA has to say

Among other things, HHS says the contract must make the vendor:

1. Use PHI only in the ways the contract allows, or as the law requires
2. Put safeguards in place, including the HIPAA Security Rule requirements for electronic PHI
3. Report any improper use or disclosure to you, including breaches of unsecured PHI
4. Help you answer patients' requests for copies, corrections, and accountings of disclosures
5. Open its records on PHI to HHS when HHS checks your compliance
6. Return or destroy the PHI when the contract ends, if feasible
7. Hold any subcontractors who see PHI to the same rules

The contract must also let you end it if the vendor breaks a material term.

What skipping it can cost

The Center for Children's Digestive Health is a small pediatric practice with seven clinics in Illinois. It paid HHS $31,000 to settle potential HIPAA violations. It had been sending PHI to a records storage company since 2003, and neither side could produce a signed BAA before October 12, 2015.

The practice was small. HHS reviewed it anyway, after investigating the storage company.

A BAA is not a seal of approval

HHS and OCR do not endorse, certify, or recommend specific technology or products. Be careful with any vendor that claims HHS approval.

The agreement also keeps working after you sign it. If you learn a vendor is breaking it, HHS expects you to take reasonable steps to fix the problem, and to end the contract if that fails and ending it is feasible.

A quick check for your clinic

1. List every vendor that touches patient information, including software you forget about
2. Ask each one for a BAA before any PHI is shared
3. Check the agreement against the seven points above
4. Keep signed copies where you can find them
5. Repeat this when you add a new tool

What we do

AtlantiX Labs signs a BAA before we touch any patient information. See how we handle it on our Security and Compliance page.

This guide is general information, not legal advice. Your compliance adviser can confirm what applies to your practice.