What Is a Business Associate Agreement (BAA)?

A Business Associate Agreement (BAA) is a written contract under HIPAA between a health care provider and a vendor that handles patient information on the provider's behalf. For a health practice, it means any outside service that stores, sends or processes protected patient data has to agree in writing to safeguard it. HHS says a covered entity may disclose protected health information to a business associate only with satisfactory assurances in a contract or other written arrangement, and the BAA is that arrangement.

How a BAA works

HIPAA, the federal health privacy law, sorts the people involved into two groups. A covered entity is a health care provider, health plan or clearinghouse. A business associate is an outside person or company that does something for the covered entity that involves protected health information (PHI), meaning identifiable patient information. A solo functional medicine practice that bills insurance electronically is a covered entity. A practice that takes only cash and sends no insurance claims or other standard electronic transactions may not be a covered entity at all, so confirm your status with your compliance advisor. The company that hosts its patient portal is a business associate.

The BAA is the contract that connects them. In it, the vendor agrees to limit how it uses the information and to safeguard it. HHS describes the legal test as satisfactory assurances. Without them, the practice should not send the data.

Cloud services are the clearest case, and most modern software is a cloud service. HHS has published guidance on how HIPAA applies to cloud computing. It makes these points.

• A cloud provider that creates, receives, maintains or transmits electronic protected health information on your behalf is a business associate.
• A cloud provider that stores only encrypted data and does not hold the decryption key is still a business associate.
• A covered entity that uses a cloud provider to maintain this information without a BAA is in violation of the HIPAA Rules.
• If a business associate hires its own subcontractor to handle the data, that subcontractor is a business associate too and must sign an agreement.

HHS also explains that the vendor carries its own legal duty. Since the HITECH Act, business associates must follow the HIPAA Security Rule and can be held liable directly for violations.

Whether a given AI vendor falls under these rules depends on what data it touches. If it does not see patient information, the BAA question does not arise. If it does, the same test applies as for any other software. Data that has been properly de-identified under the Privacy Rule is treated differently by HHS, so the rules above apply to identifiable information.

The BAA question is about patient data, so it helps to separate two kinds of AI work. A large language model that drafts a blog post from public facts does not touch patient information. The same model used to summarize a chart does.

Likewise, an AI crawler that reads your public website sees only what you chose to publish. Marketing and visibility work on public content sits outside this rule, and anything that takes in patient messages, calls, photos or records sits inside it.

This applies to your marketing tests as well. When you run patient-style questions to check AI visibility, or paste page copy into a tool to check how it reads, use invented patients and public text only. Pasting patient notes into a general chat tool with no BAA is the exact failure to look for. The staff side of this, who may use which tool for what, belongs in a written AI use policy.

Scale matters too. A multi-location group may have dozens of tools spread across front desk, billing, marketing and clinical teams, each added by a different person. The risk is rarely one dramatic decision. It is an unreviewed tool that quietly became part of the workflow.

This is general information, not legal advice, so confirm your specific setup with your compliance advisor.

Example: a BAA at a health practice

This example is illustrative, not a transcript. A functional medicine clinic adds three tools in one year.

First, a front desk employee pastes a patient's lab results into a general-purpose chatbot to draft a plain-language summary. Second, a physician starts using a scribe app that records visits and writes notes. Third, the clinic's website gets a chat widget that asks visitors about their symptoms before booking.

Each tool is handling patient information for the clinic. The chatbot receives lab data tied to a person. The scribe app records voices and clinical content. The chat widget collects symptoms and contact details. None of them is marketing content. The clinic needs a signed BAA for each product before staff use it with real patient information.

The real data points are rules, and they are worth stating plainly. HHS says a covered entity using a cloud provider without a BAA is in violation. HHS says encrypted storage alone does not change a vendor's status. HHS also has guidance on online tracking technologies for websites and apps, reviewed June 26, 2024, and part of that guidance was limited by a 2024 federal court ruling (AHA v. Becerra). That is one reason to read the vendor's actual contract and not the sales page.

The fix for this clinic is small. Three emails to three vendors, three signed agreements and a one-page staff note would cover it. In practice, the answer varies by vendor and plan. One company may sign a BAA only for its enterprise tier. Another may have no BAA at all. The only way to know is to ask in writing and keep the answer.

How to check yours in 60 seconds

1. List every tool your team uses that could see patient names, symptoms, photos, voice or messages.
2. Include the quiet ones, such as email, texting, scheduling, forms, chat widgets and AI assistants.
3. For each tool, check whether you have a signed BAA on file for that specific product.
4. Mark the tools with none.
5. Mark the tools where the BAA exists but covers a different plan than the one you pay for.

The tools with no BAA and real patient data in them go to the top of your fix list.

What to do about it

1. Keep the list above as a living document with an owner.
2. Ask each vendor in writing whether it will sign a BAA, and which plan or product the BAA covers.
3. Sign and file every BAA for each tool where patient data goes.
4. Stop using any tool that touches patient data and will not sign.
5. Tell staff in writing which tools may hold patient information and which may not.
6. Ask vendors whether their own subcontractors are covered, since HHS says subcontractors handling this data must sign agreements too.
7. Review the list every quarter, since staff adopt new tools faster than policies change, and treat any health claim a tool drafts as content for a licensed clinician to check, the same standard as YMYL pages.
8. Add a BAA check to your process for adopting any new software, including AI tools, before anyone pastes real patient information into it.