If a vendor creates, receives, maintains or transmits protected health information on your behalf, you need a signed HIPAA business associate agreement with them before any of that data changes hands. That includes your hosting provider, your email provider, your backup provider and, in most cases, your web developer.
A HIPAA business associate agreement is not paperwork for its own sake. It is the mechanism that turns a vendor’s security promises into legal obligations, and its absence is one of the most common findings in enforcement actions. Here is what it must contain, who needs one, and the exception that gets misapplied more than any other.
What is a Business Associate Agreement?
A Business Associate Agreement is a contract between a covered entity and a vendor that handles protected health information on its behalf. It sets out what the vendor may do with the data, the safeguards they must maintain, and what happens when things go wrong.
Under HIPAA a business associate is any person or organization that creates, receives, maintains or transmits PHI to perform a function on behalf of a covered entity. The definition is about the data relationship, not the industry. A shredding company and a cloud host are both business associates.
Since the Omnibus Rule, business associates are directly liable under the Security Rule. Your vendor is not merely accountable to you by contract; they are accountable to regulators too.
What must a HIPAA business associate agreement contain?
45 CFR 164.504(e) sets out the required terms. At minimum a compliant BAA must:
- Describe the permitted and required uses and disclosures of PHI by the business associate
- Provide that the business associate will not use or further disclose PHI other than as the contract permits or the law requires
- Require the business associate to comply with the Privacy Rule where it is carrying out the covered entity’s obligations
- Prohibit uses or disclosures that would violate the Privacy Rule if the covered entity made them itself, except for the business associate’s own proper management or data aggregation services
In practice a good BAA goes further and states breach notification timelines, what happens to your data at termination, and whether subcontractors are permitted. Those are the clauses worth reading closely, because they decide what actually happens on your worst day.
Do subcontractors need their own BAAs?
Yes. A business associate must have a BAA with each subcontractor before disclosing PHI to them. Every downstream party in the chain is itself a business associate and is contractually bound in the same way.
This matters when you are choosing a host. If your provider resells someone else’s infrastructure, your patient data passes through at least one more organization, and that organization needs its own agreement in place. It is a fair question to ask directly: who else touches this data, and do you have agreements with them?
A provider that owns and operates its own hardware has a shorter chain to account for. That is not a marketing point so much as a smaller surface area to audit.
What is the conduit exception, and does my host qualify?
Almost certainly not. The conduit exception is narrow and widely misread. It covers entities that only provide transmission services for PHI, including any temporary storage incidental to that transmission. HHS gives the US Postal Service and private couriers as the examples.
The limit is explicit: entities that access PHI on a regular or frequent basis to perform a service on a covered entity’s behalf are not conduits. A hosting provider storing your database is not passing an envelope along. It is holding the data.
The related misconception is that encryption gets a host off the hook. It does not. A cloud provider engaged to create, receive, maintain or transmit ePHI is a business associate whether or not it holds the keys or can read the contents.
Which of your vendors need a HIPAA business associate agreement?
Work through the list by asking one question of each: can this vendor touch PHI? If yes, you need an agreement.
- Hosting provider — yes, if patient data lives on their servers
- Email provider — yes, if any message could contain PHI, and in practice they always can
- Backup provider — yes, backups of ePHI are ePHI
- Web developer or agency — yes, if they have access to systems holding PHI
- Practice management or EHR vendor — yes
- Shredding or records disposal — yes
- Answering service or scheduling tool — yes, appointment data tied to a person is PHI
A vendor that genuinely never encounters PHI, such as an accountant handling only aggregate financials, does not need one. When in doubt, the safer read is that they do.
What if a vendor will not sign?
Then you cannot give them PHI. There is no version of this where the technology is good enough to substitute for the agreement.
Watch for three patterns when you ask. Some providers offer a BAA only on higher-priced tiers, which turns a legal requirement into an upsell. Some offer one that disclaims nearly all responsibility, which is worth reading before signing. And some say their platform is “HIPAA compliant” while declining to sign anything — that is the clearest signal to walk away, because compliance without a contract is just a claim.
How LiberationTek handles a HIPAA business associate agreement
We sign a Business Associate Agreement, and we do not gate it behind a premium plan. Our healthcare hosting is built for practices that need the agreement as much as the infrastructure.
We also keep the chain short. The hardware is U.S.-owned and we operate it ourselves rather than reselling someone else’s platform, so there are fewer parties between you and your patient records, and fewer downstream agreements to verify.
For the wider picture of what compliant hosting involves, see our guide to HIPAA compliant hosting. If you want to check whether your current setup has gaps, book a consultation and we will go through it with you.
What should you actually read in the BAA?
Four clauses decide what happens on your worst day, and they vary enormously between vendors. The required terms are the floor, not the whole document.
- Breach notification window. How many days does the vendor have to tell you? HIPAA gives you 60 days from discovery to notify affected individuals, so a vendor clause of “within 60 days” leaves you no time at all. Look for 5 to 10 days.
- Subcontractor permission. Does the agreement let the vendor pass your data to subcontractors, and must they tell you who? Blanket permission with no notification means you cannot know who holds your data.
- Return or destruction at termination. What happens when you leave, in what format, and by when. A vague clause here is how practices end up unable to retrieve their own records.
- Limitation of liability. Many vendor BAAs cap liability at a few months of fees. That is a commercial decision you should make knowingly rather than discover afterwards.
What a HIPAA business associate agreement does not do
A BAA allocates responsibility. It does not transfer yours. Three misconceptions are worth naming:
It does not make the vendor “HIPAA compliant.” Compliance is a state a vendor maintains, not a status a contract confers. The agreement obliges them to safeguard the data; it does not verify that they do.
It does not cover uses you never authorized. If a vendor uses PHI outside the permitted purposes, the agreement is what they breached, not a permission they relied on.
It does not remove your obligation to do diligence. You still need to satisfy yourself that the vendor’s safeguards are real, and to include them in your risk analysis. A signed BAA with a vendor you never assessed is a document, not a defense.
How to run a HIPAA business associate agreement review in one afternoon
Most practices do not have a BAA problem so much as a filing problem. The agreements exist somewhere, signed at different times by different people, and nobody can say with confidence which vendors are covered. A single afternoon fixes that, and the exercise usually turns up two or three genuine gaps.
Start from the money, not from memory. Pull twelve months of card statements and accounts payable and list every technology vendor you pay. This catches the subscriptions that were set up quickly and never revisited, which is exactly where a missing HIPAA business associate agreement tends to hide. Add anything free you rely on too – a free tier still touches data.
Sort the list into three piles. Definitely handles PHI, definitely does not, and not sure. Be honest about the middle pile: if a vendor could see patient names and appointment times, it handles PHI, even if that was never the intention. The “not sure” pile is the one to work through with the vendor directly.
For each vendor in the first pile, find the signed agreement. Many larger providers publish a standard HIPAA business associate agreement that you accept online, and the signed copy sits in your account portal rather than your filing cabinet. Download a PDF of each one and keep them together. If you cannot find it, you do not have it.
Check the date and the subcontractor clause. An agreement signed years ago may predate the vendor’s current architecture, and the HHS guidance on business associates and subcontractors is clear that the obligations flow downstream. A vendor that has since moved your data onto a third-party platform should be able to say so and confirm its own agreements are in place.
Write the register. One spreadsheet: vendor, what they do, whether they touch PHI, whether a HIPAA business associate agreement is signed, the date, and where the copy is stored. This is the document you will be asked for, and it takes minutes to update when you add a vendor.
Then close the gaps. For any vendor handling PHI with no agreement, ask for one in writing. Most will send a standard form the same day. A vendor that will not sign, or that cannot explain why it does not need to, has told you something important about whether it belongs in a healthcare practice’s supply chain.
Diarise the review annually, ideally alongside your risk analysis. The first pass is the slow one; after that a HIPAA business associate agreement review is a twenty-minute job.
Frequently asked questions
Is a BAA legally required?
Yes. HIPAA requires a covered entity to obtain satisfactory assurances, in the form of a written contract, that a business associate will safeguard PHI. Sharing PHI with a vendor without a BAA is itself a compliance failure.
Does my hosting provider need a BAA if the data is encrypted?
Yes. A provider that creates, receives, maintains or transmits ePHI is a business associate regardless of encryption, and regardless of whether they can read the data.
What is the conduit exception?
It applies to entities that only transmit PHI, including temporary storage incidental to transmission, such as postal services and couriers. Entities that access PHI regularly to perform a service are not conduits, so it rarely covers a hosting provider.
Do I need a BAA with my web developer?
If they can access systems that hold PHI, yes. Access is what triggers the requirement, not whether they intend to look at the data.
Who is responsible if a business associate causes a breach?
Business associates are directly liable under the Security Rule, but the covered entity retains its own obligations. A BAA allocates responsibility; it does not transfer yours away.
This article is general information, not legal advice. Consult a qualified professional about your own HIPAA obligations.
Related reading
- HIPAA Compliant Hosting: 5 Questions to Ask Before You Sign
- HIPAA Compliant Email With a Signed BAA — What a BAA-backed mailbox actually includes.
- HIPAA Compliant Hosting for Healthcare — Where the rest of a practice’s data lives.