HIPAA business associate agreements: when you need one and what it must say

What is a BAA contract under HIPAA?

A practice may let a business associate create, receive, maintain or transmit protected health information (PHI) for it only with “satisfactory assurance” that the vendor will safeguard it, documented in “a written contract or other written agreement or arrangement” that meets 45 CFR 164.504(e) (164.502(e); for electronic PHI, 164.308(b) and 164.314(a)). That document is the BAA.

The vendor answers twice: under the contract, and directly under HIPAA, which makes business associates answer to OCR for ten duties, among them Security Rule compliance, breach notice to you, minimum necessary use and BAAs with their own subcontractors. Many fall short: in OCR’s 2016–2017 audits, only 17% of 41 business associates were substantially fulfilling their risk analysis duties, and 88% had not implemented appropriate risk management (90 FR 915).

Who is a business associate under HIPAA?

Anyone outside your workforce who creates, receives, maintains or transmits PHI for a function you perform (claims processing, billing, practice management, data analysis, quality assurance, utilization review), or who provides legal, actuarial, accounting, consulting, data aggregation, management, administrative, accreditation or financial services involving your PHI (45 CFR 160.103). A business associate’s subcontractors count too, and one covered entity can be another’s business associate. For consultants, see when a consultant becomes your business associate.

Sources: 45 CFR 160.103; HHS-OCR, Business Associates and Guidance on HIPAA & Cloud Computing; 42 CFR 2.11.

Whether a particular vendor fits the definition is a question for your attorney.

Does an encrypted cloud or a conduit need a HIPAA BAA?

“Lacking an encryption key does not exempt a CSP from business associate status and obligations under the HIPAA Rules.”

HHS calls encrypted storage without the key a “no-view” service. The conduit exception doesn’t reach it: it covers transmission only, such as the Postal Service, certain couriers and their electronic equivalents, with any storage temporary, and an entity that accesses PHI regularly to perform a service is not a conduit. Servers outside the United States are allowed with a BAA, but OCR says to weigh the added risks in your risk analysis. The same test reaches website tracking tools: if a tracking vendor that meets the definition won’t sign a BAA, PHI can’t go to it without patients’ authorizations (marketing compliance).

What must a HIPAA business associate agreement include?

HHS numbers ten requirements (45 CFR 164.504(e)(2)). The contract must:

1. set the vendor’s permitted and required uses and disclosures of PHI;
2. bar any other use or disclosure, except as required by law;
3. require appropriate safeguards, and Security Rule compliance for electronic PHI;
4. require a report of any use or disclosure the contract doesn’t allow, breaches of unsecured PHI included;
5. make PHI available for patients’ access, amendment and accounting requests;
6. require Privacy Rule compliance for any of your duties the vendor carries out;
7. open the vendor’s books and records on your PHI to HHS;
8. require return or destruction of PHI at the end, if feasible, or continued protection of what can’t be returned;
9. bind subcontractors to the same restrictions and conditions;
10. let you terminate if the vendor violates a material term.

The Security Rule adds one: the vendor reports any security incident it becomes aware of (164.314(a)(2)(i)(C)). HHS’s sample provisions (Jan 25, 2013) bracket what the parties may add:

• a stricter deadline for reporting a potential breach;
• whether the vendor sends breach notices to patients, OCR and the media for you;
• how it answers access, amendment and accounting requests sent to it directly;
• de-identification and minimum necessary terms;
• a cure period before termination;
• return, destruction or transfer of PHI to another vendor at the end.

A Part 2 program’s service organizations add a qualified service organization (QSO) agreement, “fully bound” by Part 2 (42 CFR 2.11; Part 2 consent rules).

Proposed, not law. HHS’s January 2025 Security Rule proposal would require you to get written verification from each business associate, at least once every 12 months, that it has deployed the required technical safeguards, and would require the BAA to have it report activation of its contingency plan within 24 hours. The federal agenda targets July 2027.

Do subcontractors need one? HIPAA compliance for business associates

Yes, with your vendor rather than with you. A business associate must sign a BAA with its subcontractor before disclosing PHI to it, on the same restrictions and conditions, and you are not required to obtain assurances from your vendor’s subcontractors (164.502(e)(1); 164.308(b)(1)).

Each link carries the same duty. A practice that knows of “a pattern of activity or practice” amounting to a material breach by its vendor must take reasonable steps to cure it and, if that fails, terminate the contract if feasible; the vendor owes the same about its subcontractors (164.504(e)(1)(ii)–(iii)). A practice can also be liable “in accordance with the Federal common law of agency” for a business associate acting as its agent (45 CFR 160.402(c)); whether a vendor is your agent is a question for your attorney.

What happens when a business associate is breached? HIPAA’s 60 days and Florida’s 10

• HIPAA: the vendor tells you without unreasonable delay and no later than 60 calendar days after discovery, identifying each affected patient to the extent possible and sending what your patient letters need, then or as it becomes available (164.410). HHS says it shouldn’t hold the first notice to gather those facts.
• Who notifies patients: the BAA can hand patient, HHS and media notices to the vendor, but HHS says “the covered entity is ultimately responsible for ensuring that such notifications occur.”
• Florida: a “third-party agent” (a vendor contracted to maintain, store or process personal information, medical history and health insurance numbers included) must notify you no later than 10 days after determining a breach, with all the information your notices need. If it sends notices for you and fails, the failure counts as your violation, and the state can pursue the vendor too as an unfair or deceptive trade practice (s. 501.171(1), (6), (9)(a), F.S.). Which clock governs a vendor’s notice is a question for your attorney.
• When it goes wrong: OCR’s findings against a patient-communication software company included failing to notify the covered entities affected by its December 2020 breach; its March 5, 2026 settlement cost $10,000 and a 3-year corrective action plan.

What happens without a BAA? HIPAA enforcement cases

Vendors pay their own settlements too: an ambulance-billing and records-hosting company ($75,000, 585,621 people, May 30, 2025) and a benefits administrator ($225,000, 136,539 people, Apr 23, 2026), both over a missing risk analysis.

What you can do today

1. List every vendor that creates, receives, stores or sends patient information, using the table above and HHS’s business associate examples, transcription included.
2. Match each to a signed BAA and check it for the ten terms and the security-incident clause above.
3. Mark the ones that need none (treatment, payment, conduits, incidental access) and write down why.
4. Ask each vendor in writing whether its subcontractors that touch your data have signed BAAs with it.
5. Raise two terms with your attorney: a breach-reporting deadline shorter than 60 days, and who sends patient notices.
6. File each BAA for 6 years after it was last in effect, and put the vendor list into your risk analysis and your HIPAA compliance checklist.

Advixor’s HIPAA compliance services develop, review and update the policies and procedures a vendor program needs; BAA wording itself goes to your attorney.