HIPAA for small clinics
Menu
Free risk assessment Policy kit & pricing Staff training preview Guides Sign in

← All guides

Guide · 2 min read

What is a business associate agreement, and which vendors need one?

A plain-English guide to BAAs for small medical practices, including which vendors need one, what it must say, and what happens if you don't have one.

What is a business associate agreement, and which vendors need one?

A business associate agreement (BAA) is a contract between your practice and a vendor that handles patient information on your behalf. In it, the vendor promises to protect that information the way HIPAA requires, and to tell you if something goes wrong.

HIPAA requires a signed BAA before the vendor gets access to protected health information (PHI).

Which vendors need a BAA?

If an outside company creates, receives, stores or transmits PHI for you, they're almost certainly a business associate. For a typical small clinic, that includes:

  • Your EHR or practice management vendor
  • Your billing company or collections agency
  • Your IT provider or managed service provider
  • Cloud email, file storage and backup services
  • Answering services and appointment reminder services
  • E-fax, patient portal, telehealth and secure messaging providers
  • Shredding and document destruction companies
  • Transcription services
  • Accountants or attorneys who see PHI

Who usually doesn't need one?

  • Other healthcare providers you share records with for treatment
  • Health plans you bill
  • Janitorial or maintenance staff who don't access PHI as part of their job
  • Internet service providers and the postal service, which act as simple "conduits" that only transmit data

When in doubt, ask for a BAA. A legitimate healthcare vendor won't be surprised.

What a BAA must include

At a minimum, the vendor agrees to:

  • Use and disclose PHI only as the contract allows
  • Follow the HIPAA Security Rule for electronic PHI
  • Report breaches and security incidents to you
  • Hold its own subcontractors to the same rules
  • Help you meet patients' rights to access and amend their records
  • Make its records available to HHS for compliance reviews
  • Return or destroy PHI when the relationship ends

What happens without one?

Sharing PHI with a vendor without a BAA is itself a HIPAA violation, even if nothing bad happens to the data. Regulators have fined practices specifically for missing BAAs. And if that vendor has a breach, you may be on the hook for notifying your patients.

A simple process

  1. List every vendor that touches patient data.
  2. Check whether you have a signed BAA on file for each.
  3. Use the vendor's BAA if they have one; otherwise use your own template.
  4. Review the list once a year.

Our HIPAA Policy & Procedure Kit includes a Business Associate Management policy with a vendor inventory, plus a ready-to-use BAA template for vendors that don't have their own.

This article is general information, not legal advice.