Skip to main content
hipaa.tel

Plain-language HIPAA explainers, cited to HHS and the regulation. General information, not legal advice. Operated by AdvancedCare USA Inc.

Business associate agreements under HIPAA

A business associate agreement (BAA) is the contract HIPAA requires before a vendor can handle protected health information for a covered entity. Here is who needs one, what it must say, and what a BAA does not do.

Last reviewed against the Code of Federal Regulations (45 CFR Parts 160 and 164) and HHS OCR guidance linked on this page on .

The short answer

If a person or company creates, receives, maintains, or transmits PHI on your behalf — a billing service, a cloud host, an EHR vendor, an IT contractor with access to patient data — HIPAA requires a written agreement with them (45 CFR 164.502(e) and 164.504(e)). The agreement limits what they can do with the PHI and commits them to safeguard it, report breaches, and return or destroy it when the work ends.

Who is a business associate

HIPAA defines a business associate in 45 CFR 160.103 (opens in a new tab) as a person or entity, other than a member of the covered entity’s workforce, that performs a function or service for the covered entity involving PHI. Typical examples HHS gives include:

  • claims processing, billing, and revenue cycle services;
  • data storage and hosting, including cloud services that store ePHI, even if the provider cannot view it (HHS cloud guidance (opens in a new tab));
  • IT support, EHR, and practice-management vendors with access to PHI;
  • legal, accounting, consulting, and transcription services that involve PHI.

Usually not business associates: your own workforce; another provider you share PHI with for treatment; and “conduits” that only transmit data, such as the postal service or an internet service provider. A cleaning or maintenance contractor whose exposure to PHI is incidental is generally not a business associate either.

What 45 CFR 164.504(e) requires the agreement to say

  • The permitted and required uses and disclosures of PHIThe business associate may not use or disclose PHI in a way the covered entity itself could not.
  • No other use or disclosureExcept as the contract permits or the law requires.
  • Appropriate safeguardsIncluding compliance with the Security Rule for electronic PHI.
  • ReportingAny use or disclosure not provided for by the contract, including breaches of unsecured PHI under 45 CFR 164.410.
  • SubcontractorsAny subcontractor that handles the PHI must agree to the same restrictions, under its own BAA.
  • Patient rightsMake PHI available for access, amendment, and an accounting of disclosures where the business associate holds it.
  • HHS accessMake internal practices, books, and records available to HHS to determine compliance.
  • Return or destruction at terminationReturn or destroy the PHI when the contract ends, if feasible; otherwise extend the protections.
  • Termination rightAuthorize the covered entity to terminate if the business associate violates a material term.

Paraphrased from 45 CFR 164.504(e)(2); read the regulation for the exact wording. The Security Rule’s parallel requirement is 45 CFR 164.314(a).

Templates

HHS publishes sample business associate agreement provisions (opens in a new tab). HHS notes that the sample language is not a complete contract: it has to be adapted to the relationship, and it does not cover the rest of the commercial terms. Searching for a “business associate agreement template” usually leads to versions of this HHS text.

What a BAA does not do

  • It is not a certification. A signed BAA does not make a vendor “HIPAA compliant”; it creates contractual obligations. Ask how the vendor actually protects data.
  • It does not move your obligations. The covered entity still has its own Privacy and Security Rule duties.
  • Business associates are directly liable too. Since the 2013 Omnibus Rule, OCR can enforce certain requirements directly against business associates; HHS lists them in its direct liability fact sheet (opens in a new tab).

Before you sign

  • Confirm the vendor actually handles PHIIf it never touches PHI, a BAA is not required and may signal a misunderstanding of the service.
  • Check breach-reporting timingThe rule sets an outer limit; many covered entities negotiate a shorter window so they can meet their own 60-day deadline.
  • List the subcontractorsAsk which subcontractors will handle the PHI and confirm they sign BAAs.
  • Ask where data is stored and how it is returnedTermination terms matter most when you change vendors.
  • Keep the signed copyRetain HIPAA documentation for six years from creation or last effective date (45 CFR 164.530(j), 164.316(b)).

Common questions

Do I need a BAA with my EHR or billing vendor?
Generally yes. Both typically create, receive, maintain, or transmit PHI on your behalf, which makes them business associates under 45 CFR 160.103.
Do I need a BAA with another doctor I refer a patient to?
No. Disclosures between providers for treatment do not require a business associate agreement (45 CFR 164.502(e)(1)(ii)).
Does a cloud provider that cannot see my data need a BAA?
Yes, according to HHS. A cloud service that stores ePHI is a business associate even if the data is encrypted and the provider does not hold the key.
Is there an official HIPAA BAA template?
HHS publishes sample business associate agreement provisions. It is a starting point, not a complete contract; have counsel adapt it.

Sources

  1. 45 CFR § 164.504(e) — Business associate contracts (opens in a new tab) — Electronic Code of Federal Regulations
  2. 45 CFR § 164.314 — Organizational requirements (Security Rule) (opens in a new tab) — Electronic Code of Federal Regulations
  3. 45 CFR § 160.103 — Definitions (business associate, covered entity, PHI) (opens in a new tab) — Electronic Code of Federal Regulations
  4. Business Associates (FAQs and guidance) (opens in a new tab) — HHS Office for Civil Rights
  5. Sample Business Associate Agreement Provisions (opens in a new tab) — HHS Office for Civil Rights
  6. Direct Liability of Business Associates (fact sheet) (opens in a new tab) — HHS Office for Civil Rights
  7. Guidance on HIPAA & Cloud Computing (opens in a new tab) — HHS Office for Civil Rights

Questions about this page

Ask about anything explained here, or tell us if a citation is out of date. We can point you to the HHS source; we cannot advise on your organisation’s obligations. Do not send protected health information through this form.

Get in touch

Or email [email protected]

Last reviewed against the Code of Federal Regulations (45 CFR Parts 160 and 164) and HHS OCR guidance linked on this page on .

Every requirement on this page is cited to the regulation or to HHS guidance. If you find one that has changed, tell us and we will correct it.

Business Associate Agreement (BAA): What HIPAA Requires