Business Associate Agreement FAQ

A Business Associate, as defined under 45 CFR Section 160.103, is a person or organization that works on behalf of a covered entity. The work must involve the use or disclosure of Protected Health Information (PHI). If the work involves creating, receiving, maintaining, or transmitting PHI, that entity is likely a Business Associate. If that describes your company, our business associate compliance guide covers your own HIPAA obligations.

A BAA is a written contract required under 45 CFR Section 164.502(e). Under this regulation, covered entities must obtain satisfactory assurances from their business associates that PHI will be appropriately safeguarded. The agreement establishes the permitted uses and disclosures of PHI and the responsibilities of each party. Learn more about our BAA management services.

Many people think every vendor needs a BAA. That is not true. Being a vendor and being a Business Associate are not the same thing.

It depends on how you use it. If Microsoft stores, sends, or handles your patient data (ePHI), then yes, you likely need a BAA with them. Microsoft does offer a BAA for qualifying Microsoft 365 plans. Any business using Microsoft 365 to process ePHI should sign one before using the service that way.

If you use Google Workspace to store, send, or handle patient data, you should get a BAA from Google. Google provides a BAA for Google Workspace accounts, and an administrator must accept it in the Admin Console before using Workspace services with ePHI.

In most cases, yes. An IT company with access to systems that hold ePHI meets the Business Associate definition under 45 CFR Section 160.103. That holds true even if it does not store patient data directly. Managed service providers, help desk vendors, and IT support companies often require a BAA.

Yes. A shredding company that handles records with PHI meets the Business Associate definition. It maintains or has access to PHI while destroying them. A BAA is required before the shredding company begins handling your records.

Usually, no. A janitorial service does not often create, receive, maintain, or transmit PHI, so it generally does not meet the Business Associate definition. But if janitorial staff have unsupervised access to areas where PHI is stored or visible, practices should put physical safeguards in place. A confidentiality agreement may also help.

Fix a missing BAA as soon as you find it.

BAAs should be reviewed at minimum annually. Most practices review their BAAs once a year. They also review when the vendor relationship changes in a material way, such as a shift in the scope of services, the types of PHI handled, or the vendor's security posture. Annual review also aligns with the Security Risk Assessment cycle required under 45 CFR Section 164.308(a)(1)(ii)(A).

One of the biggest mistakes is failing to evaluate vendor risk.

At a minimum, check if a BAA is needed and review vendor risk. Use a short survey, a security review, or both.

Know exactly how patient data will be shared, stored, sent, accessed, or released.

Yes. A vendor can decline to sign any agreement.

Weigh the risks of keeping the vendor. Decide if you can still use them safely or if you need to find a new option.