If a vendor touches your patients’ health information, HIPAA requires a signed agreement before they ever handle it. Skipping it is a violation on its own, even if nothing goes wrong. Here is who needs one and what it must contain.
If you run a healthcare practice, you rely on outside vendors for all sorts of things: billing software, your telehealth platform, cloud storage, maybe a scheduling tool. The moment any of those vendors can see, store, or send your patients’ health information, HIPAA requires a specific contract between you first. That contract is a HIPAA business associate agreement, or BAA.
Plenty of providers do not realize this until an audit or a breach forces the issue. A missing BAA is not a small paperwork gap; it is a HIPAA violation by itself, whether or not any patient information is ever exposed. Here is exactly when you need a HIPAA business associate agreement, who counts, what has to be in it, and what happens if you skip it.
The Core Rule In One Sentence
Here is the whole thing distilled down. If a vendor creates, receives, maintains, or transmits protected health information on your behalf, HIPAA requires a signed BAA with that vendor before they handle any of it.
That is the test, and it is broader than most people expect. It does not matter whether the vendor ever looks at the data, whether it is encrypted, or whether anything goes wrong. If they can touch your patients’ health information as part of serving you, you need the agreement. Everything below builds on that one rule.
What Is A HIPAA Business Associate Agreement And When Is One Required?
A HIPAA business associate agreement is a written contract between a covered entity, like your practice, and a vendor that handles protected health information on your behalf. It sets out what the vendor is allowed to do with that information, requires them to protect it, and spells out what happens if there is a breach.
One is required any time you hand off protected health information, often shortened to PHI, to an outside party to perform a service for you. Billing, cloud hosting, practice management software, and shredding companies are classic examples.
The agreement has to be in place before the vendor starts handling the information, not signed after the fact once a problem appears. This is a foundational contract for any practice, and our page on HIPAA business associate agreements covers what a proper one looks like.
Who Qualifies As A Business Associate Under HIPAA?
A business associate is any person or company that performs work for your practice that involves access to protected health information. The key is the access, not the job title. If their service puts them in contact with PHI, they are a business associate, whether they are a giant software company or a solo bookkeeper.
Common examples in a healthcare practice include billing services, electronic health record and practice management platforms, cloud storage providers, telehealth platforms, IT support with access to your systems, and even a shredding vendor that destroys records with PHI on them.
One point trips people up constantly: cloud and software vendors count even if they only store encrypted data they cannot read. HHS has been clear that a service maintaining your PHI is a business associate even when it never views the information and holds no decryption key. So “they can’t actually see it” is not a reason to skip the BAA.
What Must Be Included In A HIPAA BAA?
Federal regulations spell out the required contents of a BAA, and a compliant one has to cover a specific set of points. Leaving any of them out can make the agreement inadequate under HIPAA. At minimum, a BAA must address:
- Permitted uses and disclosures of PHI, defining exactly what the vendor may and may not do with it.
- Safeguard requirements, obligating the vendor to protect the information with appropriate security measures.
- Breach notification, requiring the vendor to report any breach of unsecured PHI, generally within 60 days of discovery.
- Subcontractor obligations, ensuring any downstream vendors the business associate uses are held to the same HIPAA requirements.
- Access, amendment, and accounting, covering patients’ rights to their information.
- Return or destruction of PHI when the contract ends.
- HHS access, allowing the government to review compliance, and termination rights if the vendor materially breaches.
These requirements come straight from the HIPAA rules, and you can review the government’s own sample business associate agreement provisions from HHS as a reference. That said, the federal minimum is a floor, not a ceiling; a well-drafted BAA for your practice often adds terms like indemnification and tighter breach-reporting timelines.
General contract fundamentals matter here too, and our business contracts in New York page covers that groundwork.
Do Therapists And Counselors Need A BAA With Their Billing Software?
Yes. If your billing software handles your clients’ protected health information, and virtually all billing software does, you need a signed BAA with that vendor. Billing is one of the most common business associate relationships in a therapy or counseling practice, precisely because it runs on patient data.
The same goes for most of the digital tools a modern practice depends on: your electronic health record system, your practice management platform, and your telehealth service all typically require a BAA. Many reputable healthcare vendors offer a standard BAA and will sign one on request, so part of choosing a HIPAA-conscious vendor is confirming they will.
Telehealth in particular carries its own layer of contracts, and our telehealth service agreements page speaks to that directly. If a vendor that handles PHI refuses to sign a BAA, that is a serious red flag about using them at all.
What Happens If You Don’t Have A HIPAA BAA In Place With A Vendor?
Operating without a required BAA is a HIPAA violation in itself, regardless of whether a breach ever happens. The Office for Civil Rights, the agency that enforces HIPAA, can impose civil penalties for the missing agreement alone, and those penalties scale with how careless the lapse was.
The financial exposure is real. Penalties in 2026 range from roughly a few hundred dollars per violation at the low end to well over a million dollars per violation category per year for willful neglect that goes uncorrected. Worse, missing BAAs tend to surface during breach investigations and audits, which means the gap often gets discovered at the worst possible moment, compounding an existing problem.
And having a signed BAA does not fully offload your risk either; you are still expected to vet and monitor your vendors, not just collect a signature. The takeaway is simple: the cost of putting proper BAAs in place is trivial next to the cost of being caught without them.
A Simple Way To Stay Covered
If you want a practical habit rather than a legal headache, do this. Make a list of every outside vendor that touches your patients’ information in any way, then confirm you have a signed BAA with each one before they handle a single record. Any new vendor gets the same check before you onboard them.
Think of it as a standing rule: no PHI access without a signed BAA first. Practices that follow that one rule rarely get caught flat-footed in an audit, because the paperwork is already done before the information ever changes hands. It is a small discipline that closes one of the most common compliance gaps in healthcare.
The Bottom Line
A HIPAA business associate agreement is required whenever an outside vendor creates, receives, maintains, or transmits your patients’ protected health information, and that includes billing software, telehealth platforms, and cloud storage, even when the vendor cannot read the data.
A compliant BAA has to cover permitted uses, safeguards, breach notification, subcontractors, and return of PHI at termination, among other terms. Operating without one is a violation on its own and can bring serious penalties. Line up a signed BAA with every vendor that touches PHI, and you close one of the easiest compliance gaps to avoid.
Need Help Getting Your BAAs In Order?
J. Cameron Law, PLLC helps healthcare and wellness practices in New York put the right HIPAA agreements in place, so your vendor relationships are compliant before an audit or a breach ever tests them.
Whether you are setting up a new practice, onboarding software, or realizing you are not sure which vendors you have agreements with, the right guidance closes the gaps before they become expensive problems.
