Business Associate Agreements 101 for Healthcare Practice Owners

A business associate agreement, or BAA, is the contract that lets a vendor handle your patients’ protected health information (PHI) on your behalf. If a company stores, sends, or reads PHI for your practice and there is no BAA, your practice has a HIPAA problem, no matter how secure that company’s product is.

This guide explains what a BAA is, when you need one, what it has to say, and how to review one. It is general information, not legal advice. Have your attorney review any agreement before you sign it.

What Is a Business Associate Agreement?

HIPAA calls your practice a covered entity. A business associate is a person or company that performs a function for you that involves creating, receiving, maintaining, or transmitting PHI. The BAA is the written contract between the two that:

• sets out how the business associate may use and disclose PHI,
• requires the business associate to safeguard it, and
• says what happens if something goes wrong.

Since the 2013 HIPAA Omnibus Rule, business associates are directly responsible for complying with the HIPAA Security Rule and parts of the Privacy Rule. The BAA does not shift your responsibility away. It documents who is doing what.

When Does a Practice Need a BAA?

You need a BAA with any vendor whose service touches PHI. For a typical healthcare practice, that usually includes:

Vendor type	Why PHI is involved
EHR or practice management system	Stores the patient record
Patient texting and messaging platform	Messages can identify a patient and mention care
Phone system, call recording, AI voice agent	Calls and recordings can contain PHI
Appointment scheduling and reminders	Names, dates, and treatment types
Online intake forms	Health history and insurance details
Email service used to contact patients	Patient emails tied to treatment
Cloud storage and backup	Holds records and images
Billing and claims services	Diagnosis and payment data
IT support with access to systems	Can see PHI while servicing systems

Two cases that confuse practices:

• Disclosures between treating providers for treatment purposes do not require a BAA. Sending a record to a specialist for a referral is a treatment disclosure, not a business associate relationship.
• A free or consumer tool is not exempt. If a staff member pastes PHI into a consumer app that will not sign a BAA, the practice has no contract protecting that data.

What Must a BAA Contain?

HIPAA specifies the elements a BAA has to cover. At a minimum, a compliant BAA should:

1. Describe permitted uses and disclosures. What the vendor may do with PHI, limited to providing the service for you.
2. Prohibit other uses. The vendor may not use or disclose PHI except as the agreement permits or as required by law.
3. Require appropriate safeguards. Including compliance with the Security Rule’s administrative, physical, and technical safeguards for electronic PHI.
4. Require reporting. The vendor must report to you any use or disclosure not allowed by the agreement, including security incidents and breaches of unsecured PHI.
5. Flow down to subcontractors. Any subcontractor that handles PHI for the vendor must agree to the same restrictions.
6. Support patient rights. The vendor must help you provide patients access to their records, amendments, and an accounting of disclosures where applicable.
7. Make records available to HHS. The vendor’s internal practices and records about PHI must be available to the U.S. Department of Health and Human Services for compliance review.
8. Address termination. At the end of the relationship the vendor returns or destroys PHI where feasible, and the agreement allows you to terminate if the vendor materially breaches it.

A Checklist for Reviewing a Vendor’s BAA

Before you sign, work through these questions:

• Does it cover every service you are buying? A BAA for the core product that excludes an add-on feature leaves a gap.
• Does it name subcontractors or require flow-down? Ask which subprocessors touch PHI, including AI model providers.
• How fast must the vendor report a breach? Look for a defined timeline, not “promptly.”
• What happens to your data when you cancel? Return and destruction terms should be explicit.
• Does the vendor limit its own liability to near zero? Compare liability and indemnification terms to the risk.
• Is the vendor willing to sign a BAA at all? If a vendor will not sign one, do not put PHI in that product.
• Is the BAA tied to your account, or is it a general web policy? Keep a signed copy on file.

BAAs and AI Tools

AI features add a question that older BAAs never anticipated: where does PHI go when the AI processes it? A vendor can be willing to sign a BAA and still send data to a consumer AI provider that retains it for training. Ask directly whether any PHI leaves the vendor’s environment for a third-party AI model, and under what BAA terms. Our glossary entry on HIPAA-compliant software covers this in more detail, as does Is AI software HIPAA compliant?.

Keep Your BAAs Organized

Treat BAAs as part of your compliance file:

1. Keep a list of every vendor that handles PHI and the date each BAA was signed.
2. Store signed copies where your compliance lead can find them.
3. Review the list when you add a tool, especially a messaging, phone, or AI tool.
4. Remove access and request data return when you retire a vendor.

How PatientCopilot Handles BAAs

PatientCopilot enters into Business Associate Agreements with healthcare practice customers who use the platform to handle PHI. See the HIPAA policy for how the platform addresses PHI, and the HIPAA-compliant texting page for how that applies to patient messaging.

For related reading, see HIPAA-compliant software, HIPAA texting rules for healthcare practices, and HIPAA-compliant patient intake.

Frequently Asked Questions

Does every vendor need a BAA?

Every vendor that creates, receives, maintains, or transmits PHI on your behalf does. A vendor that never touches PHI, such as a company that only supplies office furniture, does not.

Who is responsible if a vendor has a breach?

Both can be. Business associates are directly liable under HIPAA, and your practice still has obligations as the covered entity, including notifications where required. The BAA should define reporting duties clearly.

Is a BAA the same as being HIPAA compliant?

No. A BAA is necessary, not sufficient. Compliance also depends on safeguards, access controls, logging, and how your own staff use the tool.

Can a vendor refuse to sign my BAA and send theirs?

Yes, vendors commonly use their own form. Review it against the checklist above, and ask your attorney to negotiate terms that do not fit.

Start with PatientCopilot and see how a healthcare-specific platform handles patient communication.