Business Associate Agreement (BAA) Under HIPAA: A Practice Guide

Smarter Billing. Stronger Practice.

discover how we help you!

A HIPAA business associate agreement is a written contract between a covered entity, such as your practice, and any outside person or company that handles protected health information (PHI) on your behalf. If a vendor creates, receives, maintains or transmits PHI for you, HIPAA requires that contract before any PHI changes hands. Billing companies, clearinghouses, and practice management and hosting vendors usually fall into this group. A signed BAA is the minimum. It does not prove the vendor is secure, and it does not move your accountability to someone else.

This guide covers who needs a BAA, what it must say, where practices get caught, and how to review one before you sign.

One For All Medical Billing

Billing Support For Your Practice

One For All Medical Billing provides specialty-focused billing and revenue cycle management for healthcare providers across Oklahoma and nationwide.

Visit One For All Medical Billing

TL;DR

A BAA is required whenever a vendor handles PHI for your practice, including billing, claims processing, hosting, and backup services.
The contract must set permitted uses, require safeguards, require breach and incident reporting, cover subcontractors, and provide for return or destruction of PHI at the end.
Business associates are directly liable under HIPAA, but you still have to act if you learn of a material breach.
A BAA is not a compliance guarantee. Pair it with a service agreement, vendor due diligence, and regular audits.
Review the breach reporting terms and the subcontractor language most closely. Those clauses decide how well you are protected when something goes wrong.

What a business associate agreement is, in plain terms

HIPAA’s Privacy and Security Rules let a covered entity share PHI with a vendor only if it gets satisfactory assurance that the vendor will protect it. The BAA is how that assurance is documented. HHS describes business associates as people or organizations that perform functions or services for a covered entity involving PHI, and the agreement as the contract that defines what they may and may not do with it.

Three parties are involved:

Covered entity: your practice, clinic, health system or health plan.
Business associate: the vendor that touches PHI to do its job for you, such as a billing company.
Subcontractor: any company the business associate uses that also touches that PHI. It needs its own BAA with the business associate.

Treatment is a notable exception. HIPAA does not require a BAA for disclosures between providers for treatment purposes, so a referral to a specialist does not need one. HHS lists this and other exceptions on its business associates guidance page.

Who needs a BAA

The test is function and access, not the vendor’s industry. If a company handles PHI for you, assume you need a BAA. Common examples for a medical practice:

Medical billing and revenue cycle management companies
Claims clearinghouses and coding services
EHR and practice management software vendors that store or access PHI
Cloud hosting, data centers and ePHI backup providers
Document storage and shredding companies
Answering services, transcription services and IT support firms with access to patient data
Attorneys, accountants and consultants who see PHI while serving you

The AMA’s HIPAA guidance for physicians makes a practical point: a vendor with persistent access to PHI, such as a hosting or backup provider, generally calls for a BAA even if it cannot read the data. Review vendors by the access they have, not only by the service they sell.

Billing companies are easy to spot. The overlooked ones are software tools, hosting providers and cloud storage that quietly hold patient data. If you are unsure whether a platform counts, start with how it stores data, who at the vendor can reach it, and whether it will sign a BAA. A vendor’s published data security and patient privacy practices are a reasonable first read, though they never replace a signed agreement. If a vendor handling PHI will not sign a BAA, do not send it PHI.

What a HIPAA-compliant BAA must contain

HHS publishes sample business associate contract provisions that spell out the required elements. In summary, the contract must:

Establish permitted and required uses and disclosures of PHI by the business associate.
Prohibit other uses and disclosures beyond what the contract allows or the law requires.
Require appropriate safeguards, including compliance with the Security Rule for electronic PHI.
Require reporting of any use or disclosure not allowed by the contract, including security incidents and breaches of unsecured PHI.
Flow down obligations to subcontractors, so anyone who handles PHI for the business associate agrees to the same restrictions.
Support patient rights, by making PHI available for access, amendment and accounting of disclosures.
Make internal practices, books and records available to HHS for determining your compliance.
Provide for return or destruction of PHI at termination, where feasible.
Allow you to terminate if the business associate materially violates the contract.

Those are the legal floor. A good BAA adds practical detail on top, which is where most of the value sits.

Terms worth negotiating beyond the minimum

A defined reporting window. The law sets an outer limit, but you can require faster notice of incidents.
Who handles patient and regulator notifications, and who pays for them after a vendor-caused breach.
Cooperation duties during an investigation or audit.
Data location and offshore access, if your policies restrict them.
Transition assistance, so your data comes back in a usable format if the relationship ends.
Insurance and indemnification, reviewed by your attorney.

Breach reporting: the clause that matters on a bad day

Under the Breach Notification Rule, a business associate must notify the covered entity after discovering a breach of unsecured PHI, without unreasonable delay and no later than 60 days after discovery. Sixty days is a ceiling, not a target. A practice that learns of a breach late loses time on its own obligations to patients and regulators, so many practices write a much shorter window into the BAA, such as a few business days for initial notice.

Spell out in the agreement:

What counts as a reportable incident, including attempted but unsuccessful events
Who at your practice receives the notice and by what method
What information the vendor must supply: what was involved, who was affected, what was done
What the vendor must do to contain and fix the problem

We walk through the mechanics in more detail in our guide to the HIPAA Breach Notification Rule.

Who is liable: you, the vendor, or both

Since the HITECH Act, business associates are directly liable for compliance with certain HIPAA requirements. This includes the Security Rule safeguards and breach notification duties, and it includes failing to have BAAs with their own subcontractors. A vendor cannot hide behind the contract.

That does not make your obligations disappear. HHS has addressed when a covered entity is responsible for a business associate’s actions. You are not expected to monitor every daily security measure. But if you learn of a pattern of activity or a practice that violates the contract, you must take reasonable steps to cure the breach, and if that fails, end the relationship. Knowing and doing nothing is where practices run into trouble.

Putting that together:

The BAA assigns specific duties to the vendor.
The vendor is accountable to regulators for those duties.
You remain accountable for choosing a vendor, having the agreement, and acting on what you learn.

For how regulators weigh these failures, see our overview of the HIPAA Enforcement Rule.

A BAA is not a compliance guarantee

The most common mistake is treating the signature as the finish line. A BAA is a contract. It says what the vendor promised, not what the vendor actually does. The AMA’s advice on keeping watch over a third-party biller is direct on this: put a business associate agreement in place, define the full scope of your expectations in the service contract, and keep auditing and staying involved in your billing.

For a billing relationship, that means pairing the BAA with:

A service agreement that defines responsibilities, turnaround times, reporting and performance expectations
Regular reports on claims submitted, denials, A/R and collections that you actually read
Periodic audits of a sample of claims and posted payments
A contingency plan covering what happens if the vendor has a breach, goes out of business, or you part ways

Questions to ask before you sign with a billing vendor

Billing companies handle some of the most sensitive data in your practice: demographics, insurance details, diagnoses and procedures. Before signing, ask:

Will you sign our BAA, or do you require yours? If it is yours, can our attorney review and edit it?
Which subcontractors, clearinghouses or offshore teams will touch our PHI, and do they have BAAs with you?
How do you control and log access to our data?
What is your incident response process, and how fast will we hear about an event?
How is PHI encrypted in transit and at rest?
What happens to our data and records if we end the contract?
When was your last security risk analysis, and can you describe what changed as a result?
Who trains your staff on HIPAA, and how often?

Our due diligence checklist for billing partners extends this list to credentials, financial controls and reporting. If you want to be ready for a regulator’s questions, our guide to surviving a HIPAA compliance audit shows what documentation to keep.

Common BAA mistakes

No BAA at all. Disclosing PHI to a vendor without one is an impermissible disclosure under HIPAA, and can be a reportable breach.
Outdated agreements. A contract signed years ago may not reflect today’s services, systems or subcontractors. Review BAAs when scope changes and on a regular schedule.
Missing subcontractor coverage. Your billing company’s offshore coders or cloud host are part of the chain.
Vague breach language. Without a clear reporting trigger and timeline, disputes follow an incident.
Nobody owns the file. Keep a vendor inventory showing each vendor, what PHI it sees, BAA date and renewal or review date.
Confusing a BAA with employee agreements. Your own staff are covered by your policies and training, not a BAA. Our employee confidentiality agreement template addresses that side.

Our perspective: what we see from the billing side

We handle PHI every day for clinics, specialty practices and multi-site systems across Oklahoma and nationwide, so we sit on the business associate side of this contract. That shapes how we think about it.

First, a BAA should be a starting conversation. When a practice asks us how we handle access, subcontractors, reporting and transitions, that is a sign of a healthy relationship. Transparency is part of how we work, and we would rather answer hard questions up front than have them surface after a problem.

Second, billing and compliance are connected. Clean claims depend on accurate documentation and coding, and the same discipline protects patient information: clear processes, limited access, and records you can show. A vendor that is careful with claims is usually careful with data, and the reverse is also true.

Third, specialty matters. An urgent care, a pain management clinic and a mental health practice carry different kinds of sensitive information and different payer rules. A BAA and a service agreement should reflect how your specialty actually works, not a generic template.

Finally, keep your hands on the wheel. Even with a trusted billing partner, review your reports, ask for audits, and keep your vendor file current. Outsourcing the work does not mean outsourcing your oversight.

— One For All Medical Billing

Working with a billing partner that is ready for these questions

If you are evaluating outsourced billing, we are glad to walk through our BAA, our safeguards and how we report to you. Our medical billing services cover claims submission, denial management, coding, eligibility verification and payment posting for medical, surgical and urgent care practices, and our revenue cycle management services support larger and multi-site organizations. We bring more than 20 years of experience and a focus on specialty-specific billing.

How to review a BAA step by step

List your vendors. Include billing, software, hosting, backup, shredding, IT and answering services.
Decide who needs a BAA. Use the access test: if the vendor can create, receive, maintain or transmit your PHI, it does.
Compare each agreement with the HHS checklist. Use the sample provisions as a baseline for missing elements.
Tighten the practical terms. Breach notice timing, subcontractors, data return and cooperation.
Have counsel review it. State law may add requirements, and indemnity and insurance terms are legal decisions.
Store and calendar it. Record the signing date and a review date.
Monitor. Read the reports, audit samples, and act quickly on any red flag.

This guide is general information, not legal advice. For contract language, indemnity, or a suspected breach, speak with a healthcare attorney or your compliance officer.

FAQ

Does every vendor need a BAA?

No. Only vendors that create, receive, maintain or transmit PHI on your behalf do. Disclosures between providers for treatment do not require one, and a vendor with no access to PHI does not either. If you are unsure, treat access to patient data as the trigger and ask your compliance officer or attorney.

Is a BAA required when I outsource medical billing?

Yes. A billing company handles claims and patient information on your behalf, which makes it a business associate. HIPAA requires a written agreement in place before it receives any PHI.

How long does a business associate have to report a breach?

HIPAA requires notice without unreasonable delay and no later than 60 days after discovery of a breach of unsecured PHI. Your BAA can and often should set a shorter window. Define it in writing so there is no dispute later.

Can I use the vendor’s BAA template?

You can, but have it reviewed. Vendor templates tend to favor the vendor on liability, reporting time and data return. Compare it against the HHS sample provisions and negotiate where it falls short.

Does a signed BAA make my practice HIPAA compliant?

No. It satisfies one requirement. You still need a risk analysis, policies, staff training, vendor oversight and a response plan for incidents. If you learn a vendor is violating the agreement, you must act.