Business Associate Agreements: What a BAA Covers and What It Does Not

Every healthcare practice has a folder of business associate agreements. Many of them were signed years ago, on the vendor's paper, without anyone reading past the first page. That is understandable. But a BAA is often mistaken for proof that a vendor is secure, and it is not. It is a contract that assigns obligations. Whether the vendor meets them is a separate question.

This post explains what a BAA does under HIPAA, what it does not do, and what to check before and after signing.

What a business associate is

A business associate is a person or company that creates, receives, maintains, or transmits protected health information on behalf of a covered entity, or provides certain services that involve PHI. Common examples in a practice include:

• The EHR and practice management vendor, especially if cloud hosted
• Billing companies and clearinghouses
• IT providers and managed service providers with access to systems holding PHI
• Cloud backup and email providers
• Transcription, answering, and patient reminder services
• Shredding companies and document storage
• Attorneys, accountants, and consultants who see PHI in the course of their work

If a vendor's work involves your patients' information, assume a BAA is needed until someone confirms otherwise.

What the rule requires

Under the HIPAA Security Rule at 45 CFR 164.308(b), a covered entity may let a business associate handle ePHI only if it obtains "satisfactory assurances" that the business associate will appropriately safeguard the information. Those assurances must be documented in a written contract or other arrangement.

The required contents for the security side are set out in 45 CFR 164.314(a). The contract must require the business associate to:

• Comply with the applicable requirements of the Security Rule
• Ensure that any subcontractors that handle ePHI on its behalf agree to the same restrictions, through their own agreements
• Report security incidents to the covered entity, including breaches of unsecured PHI as required by the Breach Notification Rule

The Privacy Rule adds more required terms, including limits on how the business associate may use and disclose PHI and what happens to the information when the contract ends. HHS publishes sample business associate agreement provisions that are a useful reference for what belongs in one.

Business associates are also directly responsible for complying with the Security Rule themselves. That includes doing their own risk analysis. The obligation does not live only in the contract.

What a BAA does not do

This is where practices get into trouble.

• It does not make the vendor secure. It creates a legal obligation for the vendor to safeguard PHI. If the vendor has weak controls, the BAA does not change that.
• It does not transfer your responsibility. You still have to include the vendor in your own risk analysis. The data is still your patients' data.
• It does not cover what the vendor actually does if the scope is wrong. If the BAA describes one service and the vendor now provides three, check that the agreement covers what is really happening.
• It does not tell you about incidents unless the reporting terms are clear. Vague reporting language leads to slow notice, and slow notice makes your own breach response harder.
• It does not replace due diligence. Signing a BAA with a vendor you never evaluated meets the paperwork requirement and nothing else.

Before you sign

For any vendor that will handle a meaningful amount of PHI, ask a few questions before the contract is final:

• What security controls do you have in place for systems that hold our data? Do you have an independent assessment or report you can share?
• Do you use MFA for your staff who access our data?
• Where is our data stored, and is it encrypted at rest and in transit?
• Which subcontractors will touch our data, and do you have BAAs with them?
• How quickly will you notify us of a security incident, and who will contact us?
• What happens to our data when the contract ends? Will it be returned or destroyed, and how will you confirm it?

The answers tell you more than the contract does. A vendor that cannot answer these clearly is telling you something about how they operate.

After you sign

A BAA is not a one-time event. Build a simple vendor register with:

• The vendor name and what PHI they handle
• The date the BAA was signed and where it is stored
• The date of the last review
• Any concerns or open questions

Review the register at least once a year, and whenever you add, drop, or change a vendor. The HIPAA risk analysis should reference it. Keep the agreements and your review notes for six years, consistent with the Security Rule's documentation requirement in 164.316.

Common gaps

• No BAA with the IT provider, even though the IT provider has administrative access to every system
• No BAA with the email or backup provider because "it is just a cloud service"
• BAAs signed with vendors the practice stopped using, while new vendors have none
• Using a vendor's template that limits incident reporting or shifts all responsibility back to the practice, without anyone reviewing it

Your counsel should review the terms. Your IT and security team should review the vendor.

Where this fits in the bigger picture

Vendors with access to patient data are a well-documented path into healthcare organizations, and several of OCR's own enforcement actions involve business associates. The NIST Cybersecurity Framework 2.0 treats supplier risk as part of governance for the same reason. The BAA is the legal floor. Knowing your vendors is the actual control.

For more on third-party risk, see our post on supply chain attacks and lessons from recent software breaches.

How we help

TRNSFRM signs business associate agreements with our healthcare clients. We also help practices build the vendor list, track which agreements are signed, and flag the gaps. Read more on our healthcare page and HIPAA overview, or score your program with the free compliance checklist. If you want help reviewing your BAAs and vendor list, book a free 45-minute Compliance Gap Audit.