Key Takeaways
- Review vendor agreements for missing safeguards, subcontractor clauses, and breach notification timelines.
- Missing clauses, outdated terms, and weak breach notification timelines can put healthcare data at risk.
- Regular BAA reviews help identify gaps, strengthen vendor accountability, and support HIPAA compliance.
Your practice doesn't protect patient information alone.
Your EHR stores it, and your billing company processes it. A cloud provider will keep it accessible, while every vendor handling Protected Health Information (PHI) introduces another responsibility your practice needs to understand.
A Business Associate Agreement (BAA) helps define those responsibilities. It sets the rules for how vendors handle patient data, what safeguards they must follow, and what happens when something goes wrong.
Read on to find out who needs a BAA, when HIPAA requires one, and what your practice should check before signing to avoid costly mistakes.
What Is a Business Associate Agreement?
A Business Associate Agreement (BAA) is a written contract between a healthcare provider (called a “covered entity” under HIPAA) and any outside vendor that handles PHI on the provider’s behalf.
If someone outside your practice sees, stores, or processes your patients’ health information, you need a signed BAA with them.
The agreement spells out four things:
- How the vendor is allowed to use PHI
- The safeguards they must put in place
- What happens if there’s a breach
- Who is liable if something goes wrong
HIPAA makes this contract mandatory under 45 CFR § 164.504(e) any time a covered entity discloses PHI to a vendor for a function on its behalf. The Department of Health and Human Services (HHS) also publishes sample BAA provisions on its site, originally released January 25, 2013, and most practices use that language as a starting point.
What Is the Purpose of a Business Associate Agreement?
A BAA has one real job: protect patient data when it leaves your four walls.
Every time a vendor touches PHI, there’s a risk. Accidental email leaks. Misconfigured cloud storage. Ransomware. Rogue employees. The BAA is how you shift that risk from “I hope they’re being careful” to “they contractually promised to be careful.”
Specifically, a BAA accomplishes five things:
- Defines the scope of use. The vendor may use PHI only for the services you hired them to perform. No selling to data brokers, no training AI models on it, no marketing side projects.
- Requires HIPAA-equivalent security. Encryption at rest, encryption in transit, access logs, workforce training. All the things you have to do, they now have to do too.
- Sets breach timelines. HIPAA requires breach notifications within 60 days of discovery. A tight BAA shortens that window, giving you time to notify patients and OCR before the clock runs out.
- Extends the chain downstream. If your vendor uses subcontractors (think your EHR vendor using AWS for hosting), the BAA requires those subcontractors to sign their own BAAs. This closes a huge loophole.
- Creates a paper trail for OCR. When investigators come knocking, a current, signed BAA is one of the first things they ask for. No BAA, and the fine goes up fast.
The 2025 Update You Should Know About
In January 2025, HHS proposed the first update to the HIPAA Security Rule since its last revision in 2013. The Notice of Proposed Rulemaking (NPRM) was published in the Federal Register on January 6, 2025, with a public comment period that closed March 7, 2025.
If finalized, covered entities would be required to obtain written verification from each of their business associates once every 12 months that the business associate has deployed the technical safeguards identified in the rule.
Translation: the old “sign it and forget it” BAA is going away. Your BAAs will need language that supports annual verification, and you’ll need a process to collect it.
The proposed rule isn’t law yet. It is not final until HHS issues a final rule; organizations should prepare now and plan to adjust once final dates are announced. But practices that already have tighter BAA language will have far less work to do when it drops.
When is a Business Associate Agreement Required?
You need a signed BAA any time a vendor creates, receives, maintains, or transmits PHI on your behalf. That covers more vendors than most practices realize.
Vendors That Always Need a BAA
- Billing and coding services
- Cloud storage providers (Google Drive, Dropbox, OneDrive storing patient files)
- IT support and managed service providers
- Telehealth and video platforms
- Medical transcription services
- Answering services and call centers
When You Don’t Need a BAA
- Cleaning and janitorial staff (they shouldn’t have PHI access in the first place)
- Mail carriers delivering sealed envelopes (called the “conduit exception”)
- Your landlord (unless they handle records)
- Software vendors that don’t touch PHI (an appointment reminder tool sending times only, not names)
The test is simple: does this vendor create, receive, maintain, or transmit PHI on your behalf? If yes, a BAA is suggested. If no, no BAA needed.
The 7 BAA Mistakes That Put Healthcare Data at Risk
Based on real OCR enforcement cases from 2024 and 2025, these are the mistakes that keep showing up.
1. Not Having a BAA When You Actually Need One
This is the Providence Medical Institute story. A vendor was handling PHI. No BAA existed for two years. Three ransomware attacks, 85,000 affected patients, and $240,000 later, the lesson was expensive.
OCR’s enforcement priority is clear. Missing BAAs are the easiest violation to prove, and they rarely give practices the benefit of the doubt.
Run a vendor inventory this week. List every outside company that touches PHI. Confirm each one has a current, signed BAA on file.
2. Using a 2013-Era BAA That Doesn’t Reflect the 2025 Security Rule Changes
HHS last updated its sample BAA provisions on January 25, 2013, after the HIPAA Omnibus Rule. That was the baseline for a decade.
In January 2025, HHS proposed the first update to the HIPAA Security Rule since its last revision in 2013. The Notice of Proposed Rulemaking was published in the Federal Register on January 6, 2025, with a public comment period that closed March 7, 2025.
If finalized, covered entities will be required to obtain written verification from each of their business associates once every 12 months that the business associate has deployed the technical safeguards identified in the rule.
A BAA drafted before this change won’t support annual verification. You’ll need to update yours. Add a 2025-ready verification clause to every existing BAA at your next review.
3. Forgetting the Subcontractor Chain
Your EHR vendor uses AWS for hosting. AWS is a subcontractor. Your BAA has to require your EHR vendor to have a BAA with AWS. If it doesn’t, the chain breaks and you’re exposed.
The 2013 Omnibus Rule made subcontractors directly liable, but only if the BAA chain is in place. Add a line to every BAA requiring your vendor to maintain BAAs with all subcontractors who touch PHI.
4. Signing the Vendor’s Boilerplate Without Reading It
Big vendors have polished BAAs ready to go. They look official. They sound thorough. But they’re written to protect the vendor, not you.
Common gaps in vendor-drafted BAAs:
- Breach notification windows that run the full 60 days
- Vague language on subcontractor requirements
- No audit rights for the practice
- Weak termination clauses
5. Vague or Missing Breach Notification Timelines
HIPAA’s outer limit is 60 days. If your BAA says “reasonable time” or “promptly,” that’s a problem. Vendors can argue indefinitely about what “promptly” means while your reporting clock to patients runs out.
Pin the timeline down to 15 days, 30 days, something specific and written.
6. No Annual Verification Process
Most practices sign a BAA once and never look at it again. That worked in 2015. It won’t work in 2026.
With the proposed 2025 rule changes, annual verification is becoming mandatory. Practices without a tracking system will be scrambling.
Build a simple spreadsheet now with the vendor's name, BAA date, last review date, and next review date. Set a calendar reminder.
7. Missing Return or Destruction Clauses
When the contract ends, who keeps the patient data?
If your BAA doesn’t say, the vendor decides. That’s a problem. Data left on a vendor’s servers after termination is a breach waiting to happen.
Every BAA needs a clear clause. On termination, the vendor must either return all PHI or securely destroy it, and provide written confirmation.
Explore More: 12-point checklist for small practices to protect healthcare data.
HIPAA Business Associate Agreement Checklist
Use this 10-point checklist before you sign any BAA. If it can’t check all 10 boxes, ask for revisions.
- Clear definition of permitted uses and disclosures of PHI
- Required HIPAA Security Rule safeguards (encryption, access controls, training)
- Breach notification timeline (30 days or less is best practice)
- Subcontractor BAA requirement
- Return or destruction of PHI when contract ends
- Vendor cooperation with OCR investigations
- Vendor liability for violations
- Patient rights support (access, amendment, accounting of disclosures)
- Termination rights for cause
- Vendor cooperation with OCR investigations
- Annual review and update clause
Save this checklist. Share it with your office manager. Keep a copy with every signed BAA.
Keep Your Business Associate Agreements Up to Date
A signed BAA is a good start, but it doesn't guarantee your patient data is protected. Missing clauses, outdated terms, or vendors that don't follow the agreed safeguards can still put your practice at risk.
As your practice grows and adds new tools, keep your agreements up to date. A little attention now can help you avoid compliance issues and protect the trust your patients place in you.
Patient data protection starts with the right agreements and making sure everyone follows through.
.svg){kind=icon}
