HIPAA Business Associate Agreements (BAA): What They Cover and What to Check

A HIPAA business associate agreement (BAA) is the contract that permits a vendor to handle protected health information (PHI) for you. It sets out what the vendor may do with PHI and what it must protect and report. A BAA covers only the plans and services it names, so the useful questions are which plan it applies to, which services it lists, and what it excludes. This guide lists the provisions HIPAA requires, explains what a template can and cannot do, and shows how to read a vendor's BAA scope before any PHI goes into a tool. For related topics, see the other HIPAA guides.

What a business associate agreement is, in one paragraph

A business associate is a person or organization that creates, receives, maintains or transmits PHI on behalf of a covered entity, or on behalf of another business associate (provided it performs a qualifying function or service and is not acting as a workforce member; PHI-handling subcontractors are also business associates under 45 CFR 160.103). HIPAA allows a covered entity to share PHI with a business associate only after it gets satisfactory written assurances that the PHI will be safeguarded. The BAA is that written assurance (more precisely, 45 CFR 164.502(e) and 164.504(e) generally require a written contract or qualifying written arrangement; specified alternative arrangements are permitted, so a standalone BAA is not always required).

A BAA does not make a tool or an organization "HIPAA compliant." It divides obligations between the parties. The vendor commits to certain safeguards and duties, and you keep responsibility for how you configure and use the tool. HIPAA has no certification program. A vendor badge saying "HIPAA certified" is marketing. The signed BAA and its scope are what an evaluator needs to see. For the underlying terms, see the business associate and covered entity definitions.

Who needs a BAA (and who usually doesn't)

Most vendors in a clinic's software stack that handle PHI are business associates. Typical examples:

• Cloud hosting and storage for an EHR, a patient portal or backups
• Email that staff use to send referral letters or lab results
• Team chat where front-desk staff discuss a patient's rescheduled procedure
• File sharing for scanned intake forms and insurance cards
• Online forms that collect patient history
• Billing and claims services
• IT providers and MSPs with remote access to workstations or servers
• AI APIs that summarize, transcribe or classify text containing PHI

Subcontractors need BAAs too. If your billing company stores claims data with a cloud provider, the billing company needs its own BAA with that provider. Each business associate must get assurances from the subcontractors that handle PHI for it under 45 CFR 164.502(e)(1)(ii) and (e)(2), and 164.308(b)(2)–(3), when those subcontractors create, receive, maintain or transmit PHI on its behalf. Developers usually sit in the middle of this chain. They sign BAAs with their healthcare customers and then need BAAs from their own hosting, messaging and AI providers. See BAAs when you build a health app.

Common exceptions to check before you skip a BAA:

• Conduit exception. Services that only transport information and do not store it beyond what transmission requires, such as postal services or certain telecom carriers; HHS limits this exception to transmission-only services and temporary storage incidental to transmission, not persistent cloud storage or hosted email that retains mailboxes.
• Workforce members. Your own employees are not business associates when acting as workforce members; 45 CFR 160.103 also includes volunteers, trainees and other people whose work conduct is under the entity’s direct control.
• Treatment disclosures to other providers. Sending records to a specialist for treatment does not make that specialist your business associate for that treatment disclosure; HHS expressly gives the example of a hospital sending a referred patient’s chart to a specialist without a BAA.

Quick test: if the tool will store or process PHI at all, even occasionally, assume you need a BAA. Exceptions are narrow, and most cloud software that stores data does not qualify as a conduit.

What a HIPAA-compliant BAA must include

HIPAA sets the minimum content of a BAA. Use this table as a checklist when reviewing any agreement, whether it comes from the vendor or from your own counsel.

Provision	What to look for	Citation
Permitted and required uses and disclosures	Uses limited to the services you contracted for. No use of PHI for the vendor's own purposes beyond what the rule allows.	45 CFR 164.504(e)(2)(i); permitted uses are those allowed by the BAA and HIPAA, which can include proper management and administration and specified data aggregation (ecfr.gov)
No other use or disclosure	The vendor will not use or disclose PHI except as the contract permits or the law requires.	45 CFR 164.504(e)(2)(ii)(A) (ecfr.gov)
Safeguards and Security Rule compliance	Appropriate safeguards, and compliance with the Security Rule for electronic PHI.	45 CFR 164.504(e)(2)(ii)(B) and 164.314(a)(2)(i)(A)
Reporting of incidents and breaches	Duty to report security incidents and breaches of unsecured PHI. Check the stated timeline and what the report must contain.	45 CFR 164.314(a)(2)(i)(C) requires security-incident reporting; under 164.410(b), breaches of unsecured PHI must be reported without unreasonable delay and no later than 60 calendar days after discovery, subject to the law-enforcement delay provision in 164.412 days"]
Flow-down to subcontractors	Subcontractors that handle PHI agree to the same restrictions and conditions.	45 CFR 164.504(e)(2)(ii)(D) (ecfr.gov)
Individual rights support	Support for patient access, amendment and accounting of disclosures.	45 CFR 164.504(e)(2)(ii)(E)–(G)
HHS access to books and records	The vendor makes its practices and records available to HHS for compliance review.	45 CFR 164.504(e)(2)(ii)(I) (ecfr.gov)
Return or destruction at termination	PHI returned or destroyed at the end of the contract. If that is not feasible, protections continue for as long as the vendor keeps it.	45 CFR 164.504(e)(2)(ii)(J) (ecfr.gov)
Termination for material breach	Your right to end the contract if the vendor materially violates it.	45 CFR 164.504(e)(2)(iii) (ecfr.gov)

Business associates are also directly liable for certain HIPAA violations, regardless of what the contract says. This is one reason vendors negotiate their BAAs carefully. It does not reduce your own obligations.

BAA templates: what the "best" template actually is

Most organizations start from the HHS sample business associate agreement provisions (a free, optional resource published January 25, 2013, and last reviewed June 16, 2017; the claim that most organizations start with it is not established). The sample is free, written by the regulator, and covers the required provisions above. For most readers asking about the "best HIPAA agreement template," it is the right starting point.

A template only covers the legal minimum. It does not settle the terms that usually get negotiated:

• Scope. Which services, plans and environments the agreement covers.
• Breach notification timing. Many organizations want a shorter window than the regulatory maximum.
• Liability, indemnification and insurance. Who pays for breach response and notification costs.
• Data location and retention. Where PHI is stored and how long it is kept after termination.

In practice, larger vendors almost always require their own BAA and will not sign yours. Your template matters mainly in two cases. The first is when a smaller vendor has no BAA of its own, for example a local transcription service or answering service. The second is when you are the business associate and need to pass obligations down to your own vendors.

Have counsel review any BAA before signing, especially the negotiated terms. This page explains the requirements. It is not legal advice.

How vendors scope their BAAs: plans, covered services, exclusions

A vendor's statement that it "signs BAAs" is not enough to approve a tool. Check these four things in the vendor's BAA and trust documentation:

1. Plan. BAA availability is often limited to paid or enterprise plans, or offered as a separate addendum. Free tiers are commonly excluded. A clinic on the free plan of a tool usually has no BAA, even if the vendor offers one on a paid plan.

2. Covered services. Many BAAs list the specific products or features in scope. Treat anything not on the list as outside the agreement. A vendor may cover its core storage product but not its analytics add-on, for example (a documented example is Google Workspace: an eligible organizational account must accept the BAA and check its covered-functionality list, which includes Gmail, Drive and listed editors, Calendar, Chat, Meet and other named services; the legacy free edition cannot accept the BAA, and purchased feature entitlements must be checked separately).

3. Exclusions. Common exclusions include:

• Beta and preview features
• AI features, especially those that send data to third-party models
• Integrations and marketplace apps built by other companies
• Consumer versions of the same product sold under the same brand

4. Configuration requirements. Some BAAs apply only when specific settings are enabled or when you use designated accounts or regions (more precisely, BAAs can impose configuration obligations rather than automatically lose coverage when a setting is wrong; AWS states that its BAA requires PHI encryption at rest and in transit).

This directory records each vendor entry in that same format: plan, covered services, exclusions, source and verification date. Each entry then gets a verdict:

• Yes: a BAA is available and covers the services in question.
• Conditional: a BAA is available only on certain plans, for certain services, or with required configuration.
• No: the vendor states it does not sign BAAs.
• Unknown: no vendor source was found.

Every verdict cites the vendor's own BAA or trust page and the date it was checked.

Checklist before a tool touches PHI

1. Get the signed BAA first. Sign it, or confirm in writing that you accepted a click-through BAA, before anyone uploads a patient document or types a patient name into the tool (electronic acceptance must create a legally binding agreement under applicable law; written confirmation alone is not enough, and HHS does not specifically approve every click-through mechanism).
2. Match your plan to the BAA. Confirm that the plan you pay for is the one the BAA covers. Confirm that each feature staff will use, such as messaging, file storage, calls or voice notes, is listed as covered.
3. Turn off or restrict what is excluded. Disable or limit integrations, AI features and guest access that fall outside the BAA, through admin settings and written policy. Example: if a chat tool's BAA excludes integrations, staff should not connect a personal Google Drive to share scanned referrals.
4. Record it in your vendor inventory. Log the BAA, plan, covered services, exclusions, signatory and next review date. To compare options within a category, start from HIPAA-compliant software by category.
5. Recheck when anything changes. Plan renames, new AI features and updated terms can change scope. Track recent changes in vendor BAA terms and review whenever you change plans.
6. Keep your share of the work. Access control, prompt offboarding when staff leave, device security and staff training stay with you under any BAA. See patient data security basics.

Example: reading one vendor's BAA scope

Take Zoom, a video and chat tool most practices already have. Its card on this site reads like this:

Field	What the vendor states
Free (Basic) plan	Not eligible. Zoom's pricing page says to select a paid plan and establish a BAA.
Pro plan	BAA available; accepted during online checkout by choosing the United States Agreement (BAA).
Business, Business Plus, Enterprise	BAA available through Zoom Sales.
Covered	Zoom Workplace services named on Zoom's healthcare page: Meetings, Phone, Chat, Docs, Whiteboard; AI features for customers with a BAA in place.
Excluded or limited	Certain AI features may not be available to customers with a BAA; Zoom does not publish which. Marketplace apps and third-party integrations are not stated as covered.
Not published	Whether the BAA adds a fee, any minimum seat count, and most security controls beyond a SOC 2 Type 2 report.
Verdict	Conditional: a BAA on paid plans for named services, with the free plan excluded and some AI features outside scope.

How to apply this. A practice on Pro that has accepted the BAA can use Meetings and Chat for staff coordination involving PHI. It should treat connected Marketplace apps as outside the agreement until Zoom or the app vendor says otherwise, and check each AI feature before turning it on for clinical conversations. A practice still on the free Basic plan has no BAA at all, whatever settings it has chosen.

The same reading works for any vendor. To check others, use BAA status by vendor; the Zoom card carries the sources and the verification date. The directory reports each vendor's scope; it does not rank vendors by BAA quality.

FAQ

Is a BAA required for every vendor I use?

No. A BAA is required for vendors that create, receive, maintain or transmit PHI on your behalf. Vendors that never handle PHI do not need one. Neither do services that qualify for a narrow exception, such as a true conduit, meaning a transmission-only service with no persistent storage beyond temporary storage incidental to transmission. If PHI will be stored or processed in the tool, assume a BAA is needed.

Does signing a BAA make a vendor HIPAA compliant?

No. A BAA divides obligations between the parties. Whether PHI is protected also depends on how you configure the tool, who has access, and whether staff stay within the covered services.

Can I use the HHS sample BAA as-is?

It covers the required provisions (including permitted uses and disclosures; the scope limitation below means it does not supply your service-specific scope or negotiated terms). It does not address scope, shorter breach timelines, liability or insurance. Have counsel review it and adapt it before use.

Who signs first, the covered entity or the vendor, and can a BAA be click-through?

There is no required signing order. In practice, whichever party's paper is used drafts the agreement and the other party reviews it. Many vendors offer BAAs that are accepted electronically in the admin console (HHS permits legally binding electronic BAAs; a documented vendor example is Google, which allows an authorized administrator to accept its BAA in the Admin console). Keep a dated copy of whatever you accepted.

What happens if a vendor refuses to sign a BAA?

Do not put PHI into that tool. Use an alternative that offers a BAA for your plan and the services you need, or limit the tool strictly to non-PHI work and enforce that by policy.

Does a BAA cover a vendor's AI features and integrations?

Only if the BAA explicitly lists them. AI features that send data to third-party models, and integrations built by other companies, are common exclusions. Check the covered-services list and ask the vendor in writing.

Do business associates need BAAs with their own subcontractors?

Yes. A business associate must obtain BAAs from subcontractors that create, receive, maintain or transmit PHI on its behalf under 45 CFR 164.502(e)(1)(ii) and (e)(2), and, for electronic PHI, 164.308(b)(2)–(3).

How often should BAAs be reviewed?

HIPAA does not set a fixed interval. Review at least annually as part of your vendor inventory. Also review whenever you change plans, the vendor updates its terms, or you start using a new feature such as AI or an integration.