What is a HIPAA BAA

BAA applicability framework.

A business associate is a person or entity that performs functions involving the use or disclosure of PHI on behalf of a covered entity. Common business associates for medical practices:

• EHR vendors — Epic, athenahealth, eClinicalWorks, NextGen, Allscripts, Greenway, and others.
• IT service providers — MSPs (like Qventive), cloud hosting, email security, endpoint protection vendors.
• Billing and revenue cycle services — third-party billing vendors, RCM services.
• Medical transcription services — traditional and AI-assisted.
• Shredding and records management — paper records disposal, electronic records archival.
• Attorneys and consultants receiving PHI as part of their services (not all — depends on engagement).
• AI vendors processing PHI — ambient scribing, diagnostic AI, clinical decision support. See our healthcare AI compliance page.
• Business associate subcontractors — vendors used by business associates must also have BAAs (downstream BAAs).

Not business associates: entities receiving PHI for their own treatment, payment, or healthcare operations (other healthcare providers treating the patient, health plans paying claims). Janitorial services, maintenance personnel, and conduits (like USPS) generally aren't business associates because they don't systematically access PHI.

What HIPAA requires in a BAA.

HIPAA specifies required BAA content at 45 CFR § 164.504(e). The BAA must:

• Establish permitted and required uses and disclosures of PHI by the business associate.
• Prohibit the business associate from using or disclosing PHI other than as permitted by the BAA or required by law.
• Require appropriate safeguards to protect PHI, including compliance with HIPAA Security Rule for electronic PHI.
• Require reporting of any unauthorized use or disclosure to the covered entity, including breach notification.
• Require business associate to ensure any subcontractors handling PHI agree to the same restrictions via downstream BAAs.
• Require business associate to make PHI available to the covered entity, to an individual requesting access, or for amendment or accounting of disclosures.
• Require business associate to comply with HIPAA when performing covered entity obligations on the covered entity's behalf.
• Require business associate to make its internal practices available to HHS for audit purposes.
• Provide for return or destruction of PHI upon termination, or continued protection if return/destruction infeasible.

HHS provides a sample BAA covering required elements. Most vendor BAAs are modifications of this baseline.

Operational BAA workflow for medical practices.

BAA inventory

Maintain inventory of all business associate relationships — who has BAA, BAA effective date, scope of services, and renewal/termination status. Small practices commonly have 15-30 business associates; larger practices often 50+. Without structured inventory, BAA gaps accumulate. See our vendor management page.

New vendor onboarding

Any new vendor potentially accessing PHI requires BAA before PHI access begins. Onboarding workflow should include BAA execution as gate to PHI access. Practices that allow vendor access before BAA execution create compliance exposure.

BAA review

Review vendor-provided BAAs for HIPAA-required elements and specific terms (breach notification timing, indemnification, subcontractor provisions, termination rights). Many vendor BAAs include elements favorable to the vendor that practices should negotiate. Legal counsel review for significant BAAs is common practice.

Termination and data return

When vendor relationships end, BAA typically requires return or destruction of PHI. Practical execution of this during vendor offboarding prevents lingering PHI exposure. EHR migrations and vendor changes should include explicit data return/destruction workflow per BAA terms.

Breach coordination

Business associates must report suspected breaches to covered entity (timing specified in BAA, typically without unreasonable delay and no later than 60 days). Covered entity's breach notification obligations follow. Strong BAA terms around breach notification improve incident response effectiveness.