What Is a Business Associate Agreement (BAA)?

Are You a Business Associate?

Under HIPAA, a business associate is any person or organization outside a covered entity’s workforce that creates, receives, maintains, or transmits PHI while performing a service for it. For a healthtech company, the question is what your service does with patient information. If your product stores, processes, or transmits PHI for a healthcare customer through hosting, message delivery, transcription, or support access, you’re a business associate. Licensing software alone doesn’t make you one: a supplier whose software runs entirely on the customer’s systems, with no access to PHI, may fall outside the role.

That includes companies providing:

• telehealth, messaging, video and AI software
• cloud hosting, IT support and managed services
• billing, coding and claims processing
• legal, accounting or consulting work that involves PHI

You’re not a business associate if:

• you’re part of the customer’s workforce: an employee, volunteer, or trainee
• you’re a healthcare provider receiving PHI to treat the patient
• you’re a true conduit that only transmits data, like the postal service or an internet service provider. A cloud provider that stores PHI isn’t a conduit, even if it never views the data. For what HIPAA requires of hosts, see What Is HIPAA-Compliant Hosting?
• your contact with PHI is only incidental, as with cleaning staff

For the full rules, see HHS’s business associates guidance.

The BAA Chain: Upstream and Downstream

For a healthtech vendor, BAAs run in two directions.

Upstream, with your customers. Each hospital, clinic, or health plan that uses your product to handle PHI needs a BAA with you. Smaller customers may sign yours; larger organizations often insist on their own.

Downstream, with your subcontractors. Any vendor that handles PHI on your behalf is your subcontractor under HIPAA, and you need a BAA with each one. That includes a communication API, a cloud host, an AI or transcription service, or a support tool that can see patient data.

The two directions have to line up. Whatever you promise your customers, your subcontractors’ agreements must let you deliver. If a hospital requires incident notification within 48 hours, but your vendor’s BAA permits a longer reporting window, you may be unable to meet your customer’s deadline.

Take a telehealth app built on a communication API and hosted in the cloud. The app’s vendor signs a BAA with each clinic that uses it. Underneath, it needs BAAs with the communication API provider for chat and video, the cloud provider for hosting, and any AI service that summarizes visits. If one is missing, every clinic BAA the vendor has signed rests on a gap. For the full set of requirements, see What Makes a Telehealth Platform HIPAA-Compliant?

A BAA also can’t be backdated. It must be in place before PHI reaches a vendor’s systems, including pilots and tests that use real patient data.

What a BAA Must Contain

Under 45 CFR §164.504(e), a BAA must:

• define permitted and required uses and disclosures of PHI
• prohibit any other use or disclosure
• require appropriate safeguards, including compliance with the Security Rule for electronic PHI
• require reporting of breaches of unsecured PHI and other security incidents
• require subcontractors to agree to the same restrictions
• make PHI available for patients’ access, amendment, and accounting-of-disclosures requests
• require compliance with the Privacy Rule when the business associate carries out a covered entity’s obligations
• make the business associate’s records available to HHS for compliance reviews
• set out how PHI is returned or destroyed when the contract ends
• allow termination if the business associate materially violates its obligations

A document labeled “BAA” that leaves out these provisions doesn’t satisfy HIPAA. HHS publishes sample BAA provisions that can be adapted for customer and subcontractor agreements alike.

What to Check Before You Sign a Customer’s BAA

Customers’ own BAAs often go beyond HIPAA’s minimum. Before signing, check:

• Breach and incident notice: HIPAA requires notification of a breach of unsecured PHI without unreasonable delay and no later than 60 days after discovery. Customer BAAs often set shorter deadlines and may require notice of suspected incidents before a breach determination is complete.
• Subcontractor flow-down: whether every requirement must pass to your vendors and whether their BAAs allow it.
• Audit and security review rights: what evidence you’ll need to provide, and how often.
• Indemnification and liability limits: terms HIPAA doesn’t require, but customers often add.
• Return or destruction of data: what happens to PHI, including backups, when the contract ends.

These are commercial and legal terms, so have counsel review them. HIPAA sets the floor, not the whole contract.

Your Obligations as a Business Associate

Since the 2013 Omnibus Rule, business associates have been directly liable under HIPAA, not just through their contracts. HHS’s fact sheet on business associate liability lists the provisions it can enforce against them directly, including:

• complying with the HIPAA Security Rule, nearly all of which applies to business associates
• notifying the covered entity of a breach of unsecured PHI without unreasonable delay, and no later than 60 days after discovery
• using and disclosing PHI only as the BAA and HIPAA permit, and limiting it to the minimum necessary
• signing BAAs with subcontractors that handle PHI
• cooperating with HHS investigations and compliance reviews

In practice, that means your own risk analysis, security policies, staff training, and incident response, separate from your customers’. For the controls involved, see What Are HIPAA Technical Safeguards?

What a BAA Does Not Do

A BAA is necessary, but it isn’t sufficient.

• It doesn’t certify that a vendor is HIPAA compliant.
• It doesn’t replace required technical safeguards.
• It doesn’t remove anyone’s due diligence. Your customers will review your security, and you should review your subcontractors’.

Common Misconceptions About Business Associate Agreements

“HIPAA is our customers’ responsibility, not ours.” Business associates are directly liable for core HIPAA requirements, including the Security Rule and breach notification. A customer’s compliance program doesn’t cover your systems.

“Our cloud provider’s BAA covers our whole stack.” A BAA with AWS, Google Cloud, or Azure covers the infrastructure those providers operate. It doesn’t extend to the applications, APIs, or services running on top of it. Each vendor that independently handles PHI needs its own BAA coverage.

“We don’t need a BAA until we go live.” HIPAA requires the BAA before PHI flows through a vendor’s systems. If real patient data touches a system before the BAA is signed, a violation has already occurred.

“The vendor offered us a BAA, so they must be compliant.” A signed BAA shows a vendor accepts the contractual obligation. It doesn’t show their systems implement the required safeguards.

“We have one BAA that covers all our vendors.” One vendor’s BAA doesn’t cover unrelated suppliers. Each business associate relationship needs written coverage, either through BAA provisions in the services contract or a separate agreement.

What Happens Without a BAA?

Using a vendor to handle PHI without a signed BAA is itself a HIPAA violation, even if no breach occurs, and OCR has backed that up with substantial settlements:

• North Memorial Health Care paid $1.55 million in 2016 after giving a business associate access to a database holding the PHI of nearly 290,000 patients, without a BAA in place.
• Raleigh Orthopaedic Clinic paid $750,000 in 2016 after handing X-rays and PHI for about 17,300 patients to a vendor without first signing a BAA.
• Triple-S Management paid $3.5 million in 2015 to settle violations that included disclosing PHI to a vendor without a required BAA.

OCR also acts against business associates directly. In 2019, health IT company Medical Informatics Engineering paid $100,000 after a 2015 hack exposed the PHI of about 3.5 million people; OCR found it hadn’t carried out a thorough risk analysis. Penalties depend on culpability and whether the violation was corrected.

The QuickBlox Perspective

QuickBlox provides the secure communication layer that healthtech companies build into their own products, through our HIPAA-compliant telehealth infrastructure. Most of our customers are business associates themselves, building telehealth, messaging, and AI products for hospitals and clinics. For them, the question is less “does QuickBlox sign a BAA?” than “will QuickBlox’s BAA support the BAAs I’m signing with my customers?”

QuickBlox signs a BAA with you as your subcontractor, and a single agreement covers our chat API, video infrastructure, AI messaging tools, and HIPAA-compliant hosting. That gives this part of your product downstream coverage you can point to when a hospital reviews your vendor stack. If you’re mapping BAA coverage across your own vendors, we’re happy to help.