A vendor that touches patient information can create breach risk before your practice sees it. A signed HIPAA business associate agreement sets PHI duties before access begins. J. Cameron Law, PLLC, helps New York practices handle BAAs.
For practice owners asking what a BAA in healthcare is, it is the contract that controls how an outside party handles protected health information, or PHI. Without the right terms, a vendor can leave the practice with weak breach notice rights.
Billing companies, EHR platforms, cloud vendors, answering services, and consultants may touch patient data. A BAA attorney in New York can match the contract to the risk.
HHS says covered entities and business associates need contracts that limit PHI use and require safeguards. The rule appears in 45 CFR § 164.504(e).
A BAA is not filed with HHS: $0 federal filing fee, last checked June 27, 2026. Its value is in enforceable vendor terms.
A healthcare practice needs a BAA when an outside service creates, receives, maintains, or transmits PHI for the practice. The test is whether the work involves PHI, not whether the vendor says it is “HIPAA compliant.”
Billing companies, EHR systems, IT support, answering services, shredding vendors, transcription services, coding companies, messaging tools, and PHI consultants may need BAAs. A therapy practice BAA should account for scheduling, diagnosis, payment, and communication records.
A BAA may not be needed when a vendor has no PHI access or only incidental contact with PHI. Examples include a landlord, janitorial service, office supplier, or website designer with no patient-data access.
Cloud vendors can be business associates even when they store encrypted ePHI without the key, according to HHS cloud computing materials. A telehealth BAA attorney can review platform terms before patient data enters the system.
For a deeper look at who counts as a business associate and what the agreement must include, see our guide on when you need a BAA and what must be in it.
A BAA should define PHI use, safeguards, breach reporting, subcontractors, access rights, PHI return or destruction, termination, and liability terms. Each clause should match the vendor’s job.
BAA Clause | Why the Clause Matters |
Permitted PHI use | Stops data use outside the hired service. |
Breach reporting | Sets timing, details, and the contact person. |
Subcontractors | Pushes duties to downstream vendors. |
PHI return or destruction | Controls data after the relationship ends. |
The BAA should say what the vendor can do with PHI and what is off-limits. Broad data-use language can create marketing, analytics, or administrative risk.
The BAA should address safeguards for electronic PHI. HHS says the Security Rule protects ePHI through confidentiality, integrity, and availability safeguards in its Security Rule materials.
The BAA should set incident reporting steps, patient-rights support, subcontractor limits, and PHI return or destruction terms. HHS breach rules require notice after a breach of unsecured PHI.
The biggest mistake is signing a generic BAA without checking the vendor’s work. A BAA should reflect access, software, subcontractors, and breach duties.
The safer step is a targeted healthcare BAA template review in NY before the practice gives a vendor patient data.
A BAA is not a full vendor contract. It handles HIPAA-specific PHI duties, while the service agreement controls price, performance, termination, and risk.
A weak setup treats the BAA as the only document that matters. That can leave gaps around downtime, data ownership, insurance, payment, property return, and disputes.
A safer HIPAA vendor contract review reads the BAA and service agreement together. The documents should not conflict on breach notice, data access, termination, confidentiality, or liability.
Employees do not normally sign BAAs because they are part of the covered entity’s workforce. Their PHI duties belong in employment documents, policies, and training records.
This matters for a receptionist, clinician, biller, or office manager who handles PHI each day. Their access must be controlled, but they are not outside business associates.
Third-party billing companies, IT providers, answering services, and consultants sit outside the workforce. Those relationships can trigger BAA requirements for a healthcare practice.
A New York therapy practice hires a scheduling and messaging platform. The platform stores names, appointment times, phone numbers, and care messages.
The vendor’s sales page says the platform is “secure,” but the practice never signs a BAA. Months later, unauthorized account access is reported, and the notice timing is unclear.
A stronger BAA would address PHI use, safeguards, subcontractors, reporting, data access, and deletion duties. Those terms reduce confusion during a breach.
A HIPAA BAA drafting attorney can tailor the agreement before the vendor receives PHI. That review can catch conflicts between sales, privacy, software terms, and the BAA.
J. Cameron Law, PLLC, helps healthcare, wellness, licensed professionals, and service-based businesses review contracts that match how the practice works. For BAAs, the firm can identify covered vendors, review vendor terms, draft provisions, and check document conflicts.
Attorney Jade Cameron has practiced law since 2009 and is admitted in New York and Connecticut. She spent more than 14 years handling business, liability, contract, and dispute matters.
That background matters because BAA problems rarely stay theoretical after a breach, audit, vendor fight, or patient complaint. Contract review helps the practice understand its terms before patient data and vendor duties become tangled.
If your practice is onboarding billing, software, IT, answering, marketing, consulting, or administrative vendors, speak with a HIPAA compliance attorney in New York before using a form.
If a vendor will touch patient information, the BAA should be reviewed before PHI is shared. Healthcare and wellness practices can schedule a consultation with J. Cameron Law, PLLC, before using a generic form or vendor document.
A HIPAA Business Associate Agreement is a written vendor contract with a covered entity. It limits PHI use and states safeguard and reporting duties.
A healthcare practice needs a BAA when an outside vendor creates, receives, maintains, or transmits PHI. Billing companies, EHR systems, IT providers, answering services, and cloud platforms are common examples.
No, every vendor does not need a BAA. A vendor needs one only when its work involves PHI.
No, a BAA is not the same as a vendor contract. The main contract should still cover payment, services, termination, liability, insurance, data ownership, and disputes.
No, employees do not normally sign BAAs. PHI access belongs in confidentiality terms, HIPAA training, privacy policies, and employment documents.
Yes, a billing company commonly should sign a BAA. Billing work can involve PHI for coding, claim submission, payment posting, collections, and insurer communication.
A BAA should say when and how the vendor must report a breach or security incident. It should name the information needed for the practice’s legal duties.
A free BAA template can miss vendor risks, state-law issues, subcontractor terms, breach timing, data return, and contract conflicts. A healthcare attorney can review whether it fits the vendor relationship.