How to read a vendor BAA: plans, covered services, exclusions

Read a vendor’s business associate agreement against the workflow your clinic intends to use—not its marketing label. Identify the exact subscription, named services, exclusions, and connected tools. Then separate what the documents establish from questions that still need written answers.

HIPAA guides

Start with the plan and workflow you need covered

Begin with these reading questions:

• Contracting entity: Which legal entity provides the service and enters into the agreement with your clinic?
• Eligible plan: Does the agreement apply to your exact subscription?
• Covered services: Which products, features, and data are expressly included?
• Exclusions: Which services or uses are outside the stated scope?
• Agreement execution: What must your clinic and the vendor complete, and where is that recorded?

Describe the workflow in ordinary language before reviewing the documents. For example: a patient submits an intake form, an automation sends the attachment to cloud storage, and staff receive a notification. Note whether that notification contains patient information or only a generic status message.

A vendor offering a BAA is different from your clinic having an applicable, executed agreement. Confirm the agreement’s applicability and execution status rather than relying on an availability statement. HHS’s cloud-computing guidance, FAQ 5, states that maintaining ePHI with a cloud service provider without entering into a BAA violates HIPAA.

For background, see what a business associate agreement covers. This guide helps you evaluate scope; it does not provide legal advice or audit the vendor.

Find the agreement and confirm which plan it applies to

Collect the BAA, order form, service agreement, and any documents they reference. Compare the legal entity, customer account, product name, and subscription tier across them. Do not assume that products sold under the same brand share coverage.

Look for language explaining how the documents relate, including which terms control if they conflict. Do not assume a universal document hierarchy. HHS permits required BAA provisions to be incorporated into a services agreement or set out in a separate BAA; its cloud guidance says an SLA should be consistent with the BAA and HIPAA.

Suppose a clinic buys a paid scheduling plan. Ask:

• Is that exact tier eligible, or is a different subscription required?
• Does the agreement identify the correct clinic account and vendor entity?
• What acceptance or signature steps apply?
• Where can the clinic retrieve the completed agreement?

Payment alone is not evidence of BAA coverage. For related considerations, see free plans and BAA availability.

Treat missing documents, conflicting plan descriptions, and unclear execution status as unresolved review questions—not proof of coverage or noncompliance.

Match covered services to the features staff actually use

Look for definitions of the service, service schedules, eligible-service lists, and linked scope documents. Record the document and location supporting each conclusion; do not rely only on a general security page.

For a hypothetical file-sharing workflow, distinguish the components:

Workflow step	Service or feature	Plan	Supporting source	Unresolved scope question
Staff upload a patient file	File storage	Clinic’s selected tier	Relevant scope document and location	Is this storage service included?
Staff view the file in a browser	Document preview	Clinic’s selected tier	Relevant feature terms	Is preview processing addressed?
Staff send a sharing link	Link sharing and recipient access	Clinic’s selected tier	Sharing terms or scope schedule	Are the intended sharing method and recipient access addressed?
Another application retrieves the file	Connected application	That application’s plan	Separate provider documents	What covers processing outside the storage service?

These are hypothetical review questions, not descriptions of any vendor’s policy.

Apply the same approach to appointment reminders. Does the named service include the intended delivery channel? Are delivery reports, message history, and exports addressed? Does staff use a separate application to prepare recipient lists?

A general eligibility label does not answer those feature-level questions. See HIPAA eligible versus HIPAA compliant for the distinction.

Read exclusions before enabling extras

Search the documents for terms such as:

• Excluded services
• Preview or beta features
• Optional features
• Third-party services
• Customer responsibilities

These are search prompts, not exclusions every vendor necessarily uses.

Consider an intake form connected to an automation service and a storage account. Trace what leaves the form service: the patient’s answers, an attachment, a notification, or a link. Review each recipient’s role and applicable documents separately. Do not assume the form vendor’s agreement extends to the automation service or storage provider.

Treat AI assistants, transcription, and connected models as separate scope questions. Ask which service processes the information and what written terms address that processing. The core product’s agreement is not evidence that every optional AI feature is included. Use the guide to reviewing AI tools that may handle PHI for that review.

Also inspect secondary paths:

• Can staff attach patient files to support tickets?
• What information enters diagnostic logs?
• Where do exports and downloaded reports go?
• Does an optional feature send content to another provider?

An unanswered question belongs in the review record as unknown—not as an inferred exclusion or approval.

Review obligations, incidents, and what happens when service ends

Take the relevant clauses to your privacy or legal reviewer. These reading prompts help organize that review; they are not a statement of universal contract terms.

Clause area	Questions to resolve
Permitted uses and disclosures	What uses and disclosures does the agreement describe? Do they match the proposed workflow?
Safeguards	What does the vendor commit to, and what responsibilities remain with the clinic?
Incident reporting	What triggers a notice, who receives it, and what timing does the agreement specify?
Subcontractors	How does the agreement address subcontractors that may handle the information?
Termination	How are return, destruction, retained copies, and continuing obligations addressed?

Under 45 CFR §§ 164.504(e)(2), (e)(5), and 164.314(a)(2), applicable BAA terms must establish permitted and required uses and disclosures, require appropriate safeguards and applicable Security Rule compliance, address reporting of unauthorized uses and disclosures, breaches of unsecured PHI, and security incidents, impose applicable downstream obligations on subcontractors, and authorize termination for a material violation. At termination, PHI must be returned or destroyed if feasible, with no copies retained; otherwise, contractual protections must continue and further uses and disclosures must be limited to the purposes making return or destruction infeasible. These requirements do not constitute a completed legal review of any agreement.

For incident notices, confirm the clinic’s contact details and internal routing. A notice sent to an unmonitored administrative inbox may not reach the person responsible for responding. Do not substitute an assumed reporting deadline for the agreement’s actual language.

For service termination, distinguish obtaining an export from understanding what happens to remaining copies. Ask about backups, retained records, and any stated limits on deletion.

Keep contractual commitments separate from implementation. An agreement does not establish that staff access, sharing settings, connected applications, devices, or clinic procedures are appropriately configured.

Record a scoped decision—and leave unknowns unresolved

Make the decision specific enough that another reviewer can understand its boundaries. Record:

• The approved workflow and information involved
• The vendor entity, account, product, and plan
• Covered services and supporting document locations
• Exclusions and features not approved for use
• The executed agreement and associated source documents
• Open questions, written answers, and configuration conditions

Keep evidence dates in the review record or a source panel, rather than scattering them through explanatory text:

Evidence field	What to retain
Vendor-owned source	BAA or trust-page reference, plus incorporated scope documents
Agreement version	Version identifier or effective date shown in the document
Verification date
Account evidence	Order form, subscription details, and execution record
Scope clarification	Written answer tied to the relevant plan, feature, and documents

HIPAA Compliant Wiki uses these verdict labels:

• Yes: Source evidence supports the stated scope.
• Conditional: Source evidence supports coverage subject to stated conditions.
• No: Source evidence establishes that the assessed plan or service is not covered.
• Unknown: Available evidence does not establish an answer.

A published verdict needs a vendor-owned BAA or trust source and a verification date. Without a supporting source, use unknown. Absence of evidence is not a negative finding.

A directory verdict is not your clinic’s approval decision. Revisit the review when the plan, workflow, enabled features, integrations, or terms change. See what to do when a vendor changes its BAA terms.

Questions to send the vendor before approving the tool

Send a description of your actual workflow with these questions:

• Does our exact product, subscription tier, and account qualify for your BAA?
• Which named services and features are covered? Please identify the supporting documents.
• Which features or uses are excluded?
• What must we execute, activate, or configure before the proposed use?
• How do your documents address the connected services in our workflow?
• Are optional AI, transcription, and connected-model features included? If not, what additional review or agreement is needed?
• What triggers incident notification, what timing applies, and where do we maintain our notification contacts?
• What happens to our data, exports, backups, and retained copies when service ends?

Ask for written answers tied to the applicable documents—not a general assurance about security. If an answer conflicts with the agreement, request clarification of the contractual basis rather than treating the response as a replacement for the terms.

You can check a vendor’s BAA availability and scope in the directory for sourced entries. Use those entries to support document collection, not replace your clinic’s review.

FAQ

Does a vendor offering a BAA mean my current plan is covered?

No. An offer does not identify whether your subscription, account, and intended services fall within its scope. Confirm the eligible plan and applicable execution steps, and retain the supporting documents.

How can I tell which features and services the BAA includes?

Match each workflow step to the agreement’s definitions, schedules, eligible-service lists, and incorporated documents. Record where coverage is established. If a feature is not clearly addressed, ask for written clarification rather than inferring coverage from the product name.

Does a BAA cover integrations and connected AI tools?

Do not assume so. Identify every provider receiving the information and review the terms applicable to each service. Treat optional AI features and connected models as separate scope questions, even when staff access them inside the main application.

What should I do if the BAA and the vendor’s website describe different coverage?

Record the discrepancy and ask the vendor to identify the applicable terms, plan, and document version. Have your privacy or legal reviewer assess unresolved contractual conflicts. Leave the disputed scope unknown until the evidence supports a decision.

What should I keep in the clinic’s vendor review record?

Keep the workflow description, account and plan details, executed agreement, source documents, evidence dates, covered services, exclusions, written clarifications, configuration conditions, and unresolved questions. Record what was approved—not simply that the vendor was reviewed.

HIPAA Compliant Wiki is published by Chanty, Inc. Ownership and payment do not determine directory verdicts or category placement.