Why free plans may not include a BAA

To evaluate a free software plan for work involving protected health information (PHI), check whether the vendor offers a business associate agreement (BAA) for that exact plan and the services you intend to use. Neither a free account nor a paid subscription establishes coverage by itself.

HIPAA guides

A free account does not establish BAA coverage

Access to a feature is not the same as contractual coverage for that feature. A free account might let staff upload files, send messages, or collect form responses. Those capabilities do not establish whether the vendor offers a BAA covering those activities.

A BAA addresses the parties’ responsibilities for specified handling of PHI; it is not blanket approval for every use of a product.

Start with what a business associate agreement covers. For the broader distinction between vendor terms and the clinic’s responsibilities, see what “HIPAA compliant” means.

An upgrade matters only if the resulting agreement covers the intended workflow. Purchasing a subscription is not approval to put PHI into it.

Why a vendor might reserve its BAA for another plan

A plan distinction can be contractual even when the visible features look similar.

Hypothetical example—not an actual vendor policy: A clinic compares two plans from the same file-sharing provider.

Question	Hypothetical free plan	Hypothetical paid plan
Can staff upload and share files?	Yes	Yes
Is a BAA offered?	No	Available for specified services
Is the patient-file workflow ready for approval?	No BAA coverage established	Still requires review of scope, activation, and settings

The paid plan’s upload button does not explain its contractual eligibility. The agreement does.

Check administrative controls and support separately. Do not assume they differ between plans unless the vendor documents the differences.

Without a vendor’s published explanation, its reason for reserving a BAA remains unknown. This guide does not establish how frequently free plans exclude BAAs.

Identify what clinic information the tool would handle

Describe the actual work before comparing subscriptions. “Scheduling tool” or “staff chat” is too broad to establish what information a vendor would receive.

Hypothetical clinic examples—not legal determinations or customer stories:

Workflow	Administrative use to assess	Patient-related use to assess
Scheduling	Publishing office hours and holiday closures	Collecting a patient’s name, appointment date, and reason for the visit
File sharing	Sharing a blank supply-order template	Uploading a completed patient referral document
Staff chat	Discussing printer-paper supplies	Identifying a patient while discussing an upcoming procedure

For each workflow, record what enters the tool, who can access it, and where it goes next. Include attachments and notifications—not just the main screen.

A clinic’s use of an application does not, by itself, determine whether a BAA is required. The application’s role and information involved matter.

Use patient data security basics to review the handling of that information alongside the contract review.

Check the plan, covered services, and exclusions

Start with the vendor’s own BAA, trust page, and plan terms. A general security statement does not establish eligibility for a particular account.

Check:

• Product and plan: Does the agreement identify the exact service and account tier?
• Activation: How does the BAA become effective—through an agreement, account acceptance, or another documented step?
• Covered services: Does the scope include the features your workflow uses?
• Exclusions: Are particular products, features, or connected services outside that scope?
• Required configuration: Does the vendor specify settings or restrictions for the intended use?

Keep the applicable agreement, evidence of acceptance or execution, and relevant account details. Follow the vendor’s documented process rather than assuming that selecting a plan activates its BAA.

Review uploads, recordings, AI functions, and connected services separately. Their presence in the same interface does not establish that they share contractual coverage.

For a closer review, use how to read a vendor BAA and AI tools and PHI.

When primary-source evidence is missing, record unknown. Encryption, a security badge, or a trust-page headline is not a substitute for the missing terms.

Compare the full workflow before choosing an upgrade

Hypothetical example: A clinic uses a form to collect patient-related information. An automation copies each submission into a shared storage folder and posts a notification elsewhere.

Reviewing only the form account leaves the automation, storage destination, and notification service unreviewed. Upgrading the form subscription does not demonstrate coverage for those other services.

Map each step:

Form → automation → storage → notification

For every step, identify the provider, information transferred, account plan, agreement, and relevant exclusions. Do not presume that the form provider’s BAA extends to another company’s service.

Then choose an appropriate path:

• Confirm a covered plan and agreement for the intended workflow.
• Choose another service with documented coverage.
• Restrict the workflow to information approved for that use.

Do not treat deleting patient names as sufficient approval to use the remaining information.

Use a short approval checklist

Keep a review record that another staff member can understand:

• Account: Vendor, product, exact plan, and account owner.
• Use: Intended workflow, information involved, and proposed users.
• Evidence: Primary-source BAA, trust page, and applicable plan terms.
• Scope: Covered services, exclusions, and connected providers.
• Activation: Required acceptance steps and evidence that they are complete.
• Configuration: Required settings, access restrictions, and responsible administrator.
• Open questions: Anything unresolved, marked unknown rather than inferred.
• Decision: Approved use, restrictions, reviewer, and conditions that require another review.

As a recommended evaluation practice, have the clinic’s designated privacy or IT reviewer resolve coverage questions before approving PHI use. A staff member’s ability to create an account should not stand in for that review.

Where to check next

Use the vendor BAA records to look for plan-specific evidence, covered services, exclusions, and source information. Compare that evidence with the account and workflow you are evaluating.

A directory entry supports evaluation. It does not audit the vendor, replace the agreement, approve the clinic’s configuration, or provide legal advice.

[editor input required: no individual product or vendor-entry path appears in the approved URL list. Supply an approved path to meet the product-page link requirement; /is/ is a vendor hub, not a product page]

Ownership disclosure: HIPAA Compliant Wiki is published by Chanty, Inc. Ownership and commercial interests do not determine category placement.

FAQ

Can a free software plan offer a BAA?

A free plan should be evaluated on its documented terms, not ruled out because of its price. Confirm whether the vendor offers a BAA for that exact plan, how it becomes effective, and which services it covers.

Does paying for a plan mean its BAA covers every feature?

No. Payment does not establish BAA availability or scope. Check the agreement’s covered services and exclusions, including any separate treatment of recordings, AI functions, uploads, and connected services.

Does a clinic need a BAA for every app it uses?

Do not assume so merely because the user is a clinic. Review the vendor’s role, the information involved, and the intended workflow with the clinic’s privacy reviewer. The legal basis for that determination needs authoritative support, as noted above.

Can we use a free account if we do not put PHI in it?

Potentially, subject to the clinic’s review and policies. Define the permitted use clearly. Check whether attachments, form fields, notifications, or connected workflows could introduce patient information despite the account’s intended administrative purpose.

Does one vendor’s BAA cover connected apps and automations?

Do not assume it does. Review the agreement’s boundaries and evaluate each connected provider that would receive information. An integration’s availability is not evidence that its provider is covered by the main application’s agreement.

What should we do when the vendor does not publish clear BAA terms?

Record the coverage as unknown and request written clarification for the exact product, plan, and workflow. Until the clinic’s reviewer resolves the question, keep PHI out of the unapproved workflow or use an alternative with documented coverage.