Business Associate Agreements: A Practice Manager's Guide

Most practices keep a folder of signed business associate agreements that nobody on staff has read closely. They are dull documents, and they matter more than almost anything else in the compliance binder: after a vendor exposes patient data, one of the first things an investigator will want to see is whether a BAA existed and what it promised.

This is the working version for the person who actually handles vendors at a practice, usually the practice manager rather than outside counsel or IT. It goes deeper on the BAA section of our HIPAA compliance and healthcare IT guide and covers how a vendor becomes a business associate, which of your vendors qualify (including the ones that slip through), what the contract requires of them, the clauses that quietly move risk back onto you, and the yearly review that keeps the file accurate.

HIPAA defines the role by what a vendor does with your data, not by what kind of company it is. If an outside company or individual creates, receives, stores or transmits protected health information (PHI) on your behalf, it is a business associate. Those four verbs are the entire test.

Several things the test ignores: how big the vendor is, what industry it says it serves, whether its website calls the product "HIPAA compliant," and whether anyone there will ever look at a record. An offsite backup service holding encrypted images of your server qualifies because it stores PHI, even though no one there opens a file. A transcription company qualifies because it creates chart text from dictation. An IT provider with administrator rights to your systems receives and transmits PHI all day simply by doing its job.

Two edges are worth knowing. Your employees are workforce members, governed by your own policies and training, so they are not business associates. And vendors that truly never come near PHI (the landscaping crew, the coffee delivery, a shredding service that only ever handles your accounting files) need no BAA. Where practices go wrong is placing that line by instinct instead of tracing where patient data actually travels.

One rule turns this from a legal topic into a daily operations topic, because it shapes every vendor decision a practice manager makes:

Patient data does not go to a vendor until a BAA is signed. That holds during a free trial, while "the paperwork is being finalized," and for vendors whose size or reputation makes the agreement feel like a formality.

Once PHI reaches a vendor without a signed agreement, the practice is out of compliance, no matter how good that vendor's security is and whether or not anything bad ever happens. Few parts of HIPAA are this black and white. The rule also works as a screening tool: a vendor that delays, hedges or insists its standard terms already cover you when you ask for a BAA is showing you how it is likely to behave on the day something goes wrong.

In practice, build one question into every new vendor conversation and ask it before any trial begins: will this touch patient data, and is a BAA in place? Trials tend to run on live records, and live records are exactly where the rule applies.

Pull the accounts-payable vendor list and go through it one line at a time, asking the four-verb question of each. These are the categories that need BAAs, listed roughly by how often practices get them wrong:

• The IT provider or MSP. Administrator access to every system is access to everything stored in them. An IT company that serves healthcare should sign without hesitation, and one that hedges has answered your question for you. Talos signs BAAs with its healthcare clients.
• Email and productivity platforms. Microsoft 365 and Google Workspace both offer a BAA, but only on eligible business plans, and on both you must actively accept it; it does not switch on with the subscription. Consumer accounts and some entry-level plans are not eligible. A practice on an ineligible plan, or on an eligible one with the agreement never accepted, is sending PHI with no BAA at all. Confirm the plan name on the invoice instead of trusting memory.
• EHR vendors, billing companies and clearinghouses. These vendors usually know BAAs best, which creates its own blind spot: "it's in the terms somewhere" is not a signed agreement you can hand an auditor. Confirm one exists, get a copy and file it.
• Backup and cloud storage. Every place a copy of your data sits (backup services, file-sync tools, cloud archives) is PHI storage. That includes the file-sharing account an employee opened on their own.
• Phone, VoIP and texting platforms. Modern phone systems keep voicemails and call recordings as data, and patients leave names, symptoms and callback numbers in both. A texting tool that carries patient messages is plainly in scope. Give this category its own review. Talos signs a BAA for healthcare clients whose business phones run on Talos Connect, and for a deeper look at what makes a communications vendor fit for PHI and how compliant patient texting works, Talk Is Cheap's guide to HIPAA-compliant communications is a useful reference.
• Transcription services. They create chart content from dictation, whether people or AI do the work and whether it happens in the US or overseas, so they are business associates. AI transcription apps that individual clinicians adopt on their own are a fast-growing gap; the same BAA chain logic applies to every automation tool, as our post on healthcare automation under HIPAA explains.
• Shredding and record-storage companies. This is the category everyone forgets. The truck that collects paper charts and the warehouse holding old ones handle PHI in its most physical form, yet practices that scrutinize every software vendor often have no agreement with the company driving patient files across town.

The result of this exercise should be a one-page BAA inventory with four columns: the vendor, the PHI it touches, the date its BAA was signed, and where the signed copy is kept. If that resembles a row from a security risk assessment inventory, that is intentional. It is the same table.

A BAA is a binding contract that assigns specific duties to the vendor. A genuine one requires the business associate to:

• Limit its use of PHI to the services it provides you, with no side analytics, marketing use or model training unless you have agreed to it
• Apply the Security Rule's safeguards on its own systems, which gives the vendor direct regulatory obligations of its own
• Tell you about security incidents and breaches, so your own notification clock can start
• Hold its subcontractors to equivalent terms, so protection follows the data downstream
• Return or destroy your PHI when the relationship ends, and confirm that in writing
• Open its practices to regulators if an investigation calls for it

Seen this way, a vendor's reaction to the BAA is revealing. Vendors that built their service around these duties treat the agreement as routine paperwork. A vendor that pushes back is usually objecting to the duties themselves, not the form.

The costly misconception is that a BAA hands your compliance to someone else. It does not. Signing one moves none of your obligations to the vendor, and a stack of signed BAAs is not a compliance program.

The risk assessment remains yours, as do workforce training, access controls, policies and the duty to notify patients. When a vendor with a signed BAA suffers a breach of your patients' data, your practice generally still handles the notices to patients and HHS. What the agreement adds is accountability and a defensible record: the vendor now carries its own regulatory exposure for its own failures, and the signed BAA together with your documented diligence shows you did what the law asks. HIPAA civil penalties are tiered by culpability, and HHS adjusts the amounts for inflation every year; that record of diligence is what keeps a practice away from the tiers reserved for willful neglect.

Think of the BAA as one load-bearing wall in the program described in our complete HIPAA guide. You cannot build without it, and it cannot hold up the structure alone.

Most practices sign whichever BAA the vendor sends over. Before you do, look for three clauses that turn up in vendor-written agreements and quietly push risk back to you:

1. The vendor can amend the terms on its own. Wording such as "we may update these terms from time to time" means the agreement in your file may not be the one in force when a breach happens. Ask that any change require written consent from both sides.
2. The breach-notice timeline is missing or meaningless. "Without unreasonable delay" with no outer limit, or a window long enough to swallow most of the 60 days the Breach Notification Rule allows you for notifying patients, leaves you holding a deadline you may not be able to meet. Look for a firm commitment counted in days, plus enough detail (which data, which patients) for you to act.
3. Subcontractors are never mentioned. An agreement silent on downstream vendors lets your data travel to companies you have never heard of, with no equivalent obligations. The BAA should state that any subcontractor handling your PHI is bound by the same terms.

Spotting these takes no legal training, just a careful read with those three questions in hand and a willingness to request edits. Good vendors accommodate reasonable changes. Vendors that refuse are, once again, telling you something.

A BAA file decays without anyone noticing. Vendors get acquired, subscriptions get downgraded, staff pick up new tools, and an agreement signed several years ago stops matching what the practice actually uses. The cure is a habit rather than a project: once a year, compare the vendor list against the BAA file.

The best home for that comparison is the annual security risk assessment. The vendor inventory built in our SRA walkthrough is the same list, and its first phase already calls for matching each vendor that touches ePHI to a signed agreement. One pass catches the four usual problems: new vendors with no BAA, former vendors that never confirmed destroying your data, services that have grown past what the original agreement covered, and unofficial tools that arrived through someone's browser.

Making sure that review really happens, that the file stays current and that findings actually get closed is ongoing compliance work Talos handles for healthcare clients throughout the year.

Eventually a vendor will send the notice every practice dreads. How the following weeks go depends on paperwork filed long before:

1. The vendor's BAA obligation triggers first. It must notify you, which is why the notice-timeline clause mattered.
2. Your own notification duties begin. When your patients' data is involved, your practice generally owes notice to patients and HHS on the regulatory timeline, even though the vendor caused the breach.
3. Your file determines your exposure. A signed BAA, a documented yearly review and evidence of vendor vetting describe a practice that did its part. A missing BAA turns the vendor's incident into a separate violation by your practice.
4. Then you decide on the relationship. The termination and return-or-destroy terms in the BAA are what allow a clean exit if the vendor's answers fall short.

The lesson is that every stage of a vendor breach is shaped by choices made years earlier, in documents few practices ever read closely. Reading them is part of the job.

If this walk-through exposed gaps, such as vendors with no matching agreement, a phone or shredding company nobody considered, or a file older than your current EHR, the remedy takes an afternoon rather than a quarter. Build the inventory, request the missing agreements, check every new BAA for the three red flags before signing, and put the yearly review on the calendar.

Talos runs this exact exercise as part of our healthcare IT support, usually inside a broader risk assessment because the vendor walk and the ePHI inventory are the same work. If you would rather not do it alone, contact Talos or call (346) 330-3390, and we will go through the list with you, flag what is missing and give you the findings in writing.

A business associate is any outside company or person that creates, receives, stores or transmits protected health information for your practice. The deciding factor is the data that passes through them, not their industry, their size or whether anyone there ever reads a record. IT providers, email platforms, EHR and billing vendors, backup and cloud services, phone and texting platforms, transcription services and shredding companies all routinely qualify.

Every vendor that touches PHI in any form, and before any data reaches them. The ones practices miss most often are the IT provider (whose admin access reaches everything), the email platform (a BAA exists only on eligible business plans and has to be actively accepted), phone, VoIP and texting services (voicemails, recordings and messages are PHI), and physical-world vendors such as transcription and shredding companies.

No. A BAA covers a single vendor relationship by requiring that vendor to protect PHI, report breaches to you and bind its subcontractors. Your risk assessment, policies, training, technical safeguards and patient notification duties remain your responsibility. The BAA is a required part of compliance, never a replacement for it.

Look hard at three things before signing: a clause letting the vendor change the terms without your signature, a breach-notification commitment with no specific number of days (or one so long it eats into your own 60-day window), and no statement that subcontractors handling your PHI are bound by equivalent terms.

The vendor must notify your practice under the BAA, and your practice generally remains responsible for notifying patients and HHS on the regulatory timeline. How exposed you are then depends on your records: a signed BAA and a documented yearly vendor review show due diligence, while a missing BAA makes the vendor's breach your own violation as well.