HIPAA Business Associate Agreements: Complete BAA Guide

Any person or entity (other than a workforce member) that creates, receives, maintains, or transmits PHI on behalf of a covered entity or performs services involving PHI disclosure: claims processing, billing, data analytics, utilization review, quality assurance, practice management, IT support with PHI access, cloud service providers hosting ePHI, e-prescribing gateways, transcription, shredding and storage companies, patient safety organizations, and lawyers, accountants, or consultants whose services involve PHI. Health information exchanges and personal health record vendors serving covered entities count too. The test is function, not label: if the vendor touches PHI to serve you, a BAA is required before the first byte moves.

45 CFR 164.504(e) requires: permitted and required uses and disclosures (no broader than the covered entity's own rights); no use or disclosure beyond the contract or law; appropriate safeguards including Security Rule compliance for ePHI; reporting of breaches, security incidents, and impermissible uses to the covered entity; ensuring subcontractors agree to the same restrictions via their own BAAs; making PHI available for individual access, amendment, and accounting; making books and records available to HHS; and returning or destroying PHI at termination where feasible. Negotiated additions, breach-notification deadlines shorter than 60 days, indemnification, audit rights, insurance, are commercial choices layered on the regulatory floor.

Almost certainly not. The exception covers entities providing mere transmission services where any PHI access is random or infrequent, couriers, the postal service, ISPs in their pure transport role. OCR's cloud computing guidance is explicit that a cloud service provider maintaining ePHI is a business associate even if it holds only encrypted data and lacks the decryption key, persistence of storage, not ability to read, is the test. Major cloud providers (AWS, Microsoft, Google) all sign BAAs for their eligible services, which tells you what they concluded. A vendor refusing a BAA while claiming conduit status for storage or processing is describing a violation you would be committing.

The 2013 Omnibus Rule extended direct liability downstream: a business associate's subcontractor that handles PHI is itself a business associate and needs a BAA with the business associate above it, and so on to the bottom of the chain. The covered entity contracts only with its direct business associate; the flow-down duty travels contractually. In diligence, ask vendors for their subcontractor lists and confirmation of downstream BAAs, a breach at a fourth-tier subprocessor still lands on your notification desk. Business associates should inventory their own subcontractors with the same rigor covered entities apply to them, since OCR can enforce directly at any tier.

The disclosure itself is impermissible, no breach or harm required. OCR settlements make the point: Raleigh Orthopaedic ($750,000) for handing x-ray films with PHI to a vendor without a BAA; North Memorial Health Care ($1.55 million, combined with a risk-analysis failure) after a business associate's laptop theft; Advanced Care Hospitalists ($500,000) for using a billing service with no BAA; and multiple smaller settlements against practices whose only misstep was an unpapered vendor. After a vendor breach, the first document OCR requests is the BAA; its absence converts the vendor's incident into your violation and typically anchors the resolution amount.