Business associate agreements: which vendors need a BAA

What a business associate agreement is

HIPAA defines a business associate in 45 CFR 160.103 (opens in a new tab). It is a person or company that, on behalf of a covered entity such as your practice and not as part of its workforce, "creates, receives, maintains, or transmits" PHI for a function like billing, claims or data analysis. The definition also covers outside services that involve PHI: "legal, actuarial, accounting, consulting, data aggregation" and "management, administrative, accreditation, or financial services."

The BAA is how your practice gets what the Privacy Rule calls "satisfactory assurance that the business associate will appropriately safeguard the information" (45 CFR 164.502(e) (opens in a new tab)). It limits what the vendor can do with PHI, requires security safeguards and breach reporting, binds the vendor's own subcontractors, and lets you terminate if the vendor breaks a material term.

A BAA is not a compliance certificate, and no official certificate exists to get. Google Cloud's HIPAA page notes that HHS "doesn't offer a certification program for HIPAA compliance" (Google Cloud (opens in a new tab)).

• What a business associate is: the definition applied to real vendors, from IT and hosting to marketing agencies, plus the exceptions.

When HIPAA requires a BAA

Three provisions do the work:

1. Privacy Rule, 45 CFR 164.502(e) (opens in a new tab). You may let a business associate handle PHI for you only with satisfactory assurances, documented in a "written contract or other written agreement or arrangement."
2. Security Rule, 45 CFR 164.308(b) (opens in a new tab). The same rule for electronic PHI (ePHI). The written contract is a required implementation specification, not an optional one.
3. Contract content, 45 CFR 164.504(e) (opens in a new tab). The list of clauses the agreement must contain.

The practical test has two questions. Does the vendor do work for your practice? Does that work involve creating, receiving, storing or transmitting PHI? Two yeses mean a BAA before any data flows.

Storage alone counts. The 2013 Omnibus Final Rule added "maintains" to the definition, and its preamble says a data storage company "qualifies as a business associate, even if the entity does not view the information" (Federal Register, January 25, 2013 (opens in a new tab)). The big cloud vendors agree: Microsoft's HIPAA page says that when a covered entity uses a cloud service provider, "the cloud service provider is a business associate under HIPAA" (Microsoft Learn (opens in a new tab)).

Your duties don't end at signing. Under 45 CFR 164.504(e)(1)(ii) (opens in a new tab), if you know of a pattern of activity that materially breaches the BAA, you must take reasonable steps to cure it or end the violation, and terminate the arrangement if those steps fail and termination is feasible.

Practice vendors that usually need one

Illustrative decision table. Edge cases depend on the facts of each arrangement, so verify unusual ones with your advisor.

A few cases trip practices up. An agency that "just manages the website" usually also manages the forms, and the forms are where PHI lives. An IT contractor who remotes into the front-desk computer has routine access to the EHR. A backup service holding encrypted copies still maintains PHI.

Before you sign up for a new tool, check whether it will sign a BAA for the plan you're buying. Our dated checks of vendors' HIPAA status cover common practice software.

Vendors that usually don't

• A marketing vendor that never receives PHI. A copywriter, designer or ad specialist who works from public pages and aggregate reports is not handling patient information. Keep it that way on purpose: no inbox logins, no patient lists, no EHR access.
• True conduits. The Omnibus preamble reads this exception narrowly: it covers "mere data transmission services" such as postal couriers and internet service providers, which transport information but access it only "on a random or infrequent basis." Anyone who stores your data beyond transmission is not a conduit.
• Other providers treating the patient. The definition excludes a health care provider receiving PHI "concerning the treatment of the individual," such as a specialist you refer to.
• Your own workforce. Employees, volunteers and trainees under your direct control are workforce, not business associates.
• Vendors with only incidental exposure. A cleaning crew that walks past the front desk isn't performing a function involving PHI. HIPAA tolerates incidental disclosures only if you apply minimum necessary rules and "reasonably safeguard" PHI (45 CFR 164.530(c) (opens in a new tab)), so screens and charts still need protecting.

One vendor type sits on both sides: analytics. Google says it "does not offer Business Associate Agreements" for Google Analytics, so it can't receive PHI (Google Analytics Help (opens in a new tab)). Using it safely means keeping its tags off pages where patients log in or submit health information.

What a BAA must include

45 CFR 164.504(e)(2) (opens in a new tab) and 45 CFR 164.314(a) (opens in a new tab) set the minimum. In plain English, the vendor must agree to:

1. Use and disclose PHI only as the contract permits or the law requires.
2. Use appropriate safeguards and comply with the Security Rule for ePHI.
3. Report uses or disclosures the contract doesn't allow, security incidents, and breaches of unsecured PHI.
4. Bind its subcontractors to the same restrictions in writing.
5. Help you meet patients' rights to access, amend and get an accounting of disclosures.
6. Follow the Privacy Rule when it carries out one of your obligations for you.
7. Open its books and records to HHS for compliance reviews.
8. Return or destroy PHI at the end, or extend the protections if that isn't feasible.

The contract must also let you terminate if the vendor violates a material term. On timing, 45 CFR 164.410 (opens in a new tab) requires a business associate to report a breach "without unreasonable delay and in no case later than 60 calendar days after discovery." You can negotiate a shorter window in the BAA itself.

• BAA requirements checklist: every required clause as a checkbox, with the provision it comes from and red flags in vendor-drafted BAAs.
• Subcontractor BAAs: how the chain works when your vendor's cloud host, form processor or AI provider handles PHI too.

Getting a BAA signed, and what to do if a vendor refuses

Ask at the contract stage, before any data moves. Then work through it in order:

1. Find out whose paper you're signing. Large platforms use standard agreements. Microsoft says it "can't use a customer's Business Associate Agreement," and AWS presents its standard BAA for acceptance in AWS Artifact (AWS (opens in a new tab)). Smaller vendors often sign yours.
2. Check the scope. Many BAAs cover only certain products or plans. AWS, for example, says PHI should be processed only in its HIPAA-eligible services.
3. Compare the clauses with the required list. Look for the breach-reporting window, subcontractor terms and what happens to data at the end.
4. Have counsel review it. Especially liability caps and indemnities, which HIPAA doesn't set.
5. File the signed copy with the date, the products covered and a contact for incident reports.

• HIPAA BAA template: a starting document built on HHS's sample provisions (opens in a new tab), explained clause by clause. HHS's site blocked our automated check, so that guide works from the version HHS published in the Federal Register in 2002 (opens in a new tab) and the current regulation text.

If a vendor refuses, you have three honest options. Don't give it PHI: reconfigure so the tool never sees patient information. Replace it with a vendor that signs for the plan you need. Or, if PHI has already flowed, stop the flow and ask your compliance officer whether a breach risk assessment is required. The same logic applies to agencies; spell out PHI access in your marketing agency contracts.

Keeping a BAA inventory

A one-page register makes renewals, audits and incidents far easier. Track, for each vendor:

Keep the documents. The Security Rule requires documentation to be retained for six years from creation or from the date it was last in effect, whichever is later (45 CFR 164.316(b)(2)(i) (opens in a new tab)).

Review the register when you add a tool, change plans or renew. A plan change can move you outside what the BAA covers. Changes may be coming: a January 2025 proposed Security Rule update (opens in a new tab) would have business associates give written verification of their technical safeguards. It was still a proposal when we checked the Federal Register in October 2026. For the wider framework, see HIPAA basics.

Medfy's BAA with practices

Medfy signs a BAA with every practice before any patient data flows. Patient information from forms, chat, the inbox and the CRM is stored in separate, encrypted HIPAA databases in the US or Canada, encrypted in transit and at rest. Access is controlled by role-based permissions, with an audit log of who saw what. Marketing uses aggregate numbers only, and ad platforms never receive patient data.

That covers the website, forms, patient inbox and CRM in the $349/month base plan; see Medfy pricing. The details are on Medfy's BAA and safeguards. To see which of your current tools touch patient data, the free marketing audit flags privacy risks such as ad pixels on patient forms, using public information only.

This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.

Frequently asked questions

What is a BAA in healthcare?

A BAA, or business associate agreement, is the written contract HIPAA requires between a practice and a vendor that creates, receives, stores or transmits patient information on the practice's behalf. It limits how the vendor may use that information, requires security safeguards and breach reporting, and passes the same duties to the vendor's subcontractors. This is general information, not legal advice; confirm specifics with your compliance officer.

Does my website host need to sign a BAA?

If your site stores or processes patient information, such as form submissions, chat transcripts or booking details, yes. The host maintains that information for you, even if it never opens the files. A brochure site with no forms and no patient data on the server usually doesn't need one. Check where submissions actually land, and confirm the answer for your setup with your compliance officer or attorney.

Does a marketing agency need a BAA?

Only if it handles patient information: managing your form inbox, receiving lead lists with reasons for visit, uploading patient lists to ad platforms or logging into your EHR for reports. An agency that works from aggregate numbers and public pages usually doesn't. Decide which model you want, write it into the contract, and confirm the decision with your compliance officer or attorney.

What happens if we work with a vendor without a BAA?

Disclosing patient information to a business associate without the required written agreement is a HIPAA compliance failure on its own, whether or not anything leaks. HHS can impose civil money penalties on covered entities and business associates. Stop sending data to the vendor, get a BAA signed or move the data, and ask your compliance officer or attorney whether a breach risk assessment is needed.

Who drafts the BAA, the practice or the vendor?

Either can. Large platforms usually insist on their own standard BAA; Microsoft, for example, says it can't use a customer's agreement. Smaller vendors often accept the practice's version, which many base on HHS's sample provisions. Whoever drafts it, check that it covers every clause 45 CFR 164.504(e) requires, and have your attorney review it before signing.