HIPAA business associate agreement

Under HIPAA, a business associate is a person or company that handles protected health information (PHI) for a covered entity such as a clinic, practice or care facility. The rules at 45 CFR 164.504(e) spell out what the contract must contain: permitted uses, safeguards, breach reporting, subcontractor terms and access for patients and regulators.

For a growing practice this decides which tools are allowed. A phone system that stores voicemail transcripts, an AI voice agent that books appointments, a cloud recording service: each one touches PHI and needs a signed BAA before patient data flows through it. A vendor that will not sign one is not an option, however good the product.

Ask every vendor whether they sign a BAA as standard, what it excludes, where PHI is stored and encrypted, how long recordings and transcripts are kept, and how breaches are reported. Ask who their subcontractors are, because the obligations follow the data. Review the agreement with your compliance officer or attorney.