A business associate agreement (BAA) is a written contract between a HIPAA covered entity, such as a medical practice that bills insurance electronically, and a vendor that creates, receives, keeps or sends patient health information on the practice’s behalf. It spells out what the vendor may do with that information, how it must protect it, and what it must report. Your CRM, texting tool, answering service and online forms usually need one; a vendor that never touches patient information usually doesn’t.
Brand Lift 360 configures and manages KloudMD, the HIPAA-compliant CRM and patient follow-up platform for medical practices, and a BAA is signed for covered services. This guide explains which of your vendors should sign one, what the contract has to say, and what it can’t do for you. It is general information, not legal advice: rules depend on your situation, so check the details with your own counsel.
Who Needs a Business Associate Agreement?
HIPAA is the federal law that protects patient health information. Its privacy and security rules apply to covered entities, and a covered entity is the party that must have a BAA in place with its vendors.
According to the U.S. Department of Health and Human Services (HHS), there are three kinds of covered entity:
- Health care providers, such as doctors, clinics, psychologists, dentists and chiropractors, but only if they transmit health information electronically in connection with a transaction HHS has set a standard for, such as an insurance claim.
- Health plans, such as insurers, HMOs and government programs like Medicare and Medicaid.
- Health care clearinghouses, which convert nonstandard health information into a standard format.
That provider condition matters. A practice that bills insurance electronically is generally covered. A cash-pay practice, such as some med spas and cosmetic practices, may not be. Whether your practice is a covered entity is a question for your counsel, not your marketing agency.
HHS says a covered entity must have a written business associate contract or other arrangement with each business associate. Business associates are also directly liable for complying with certain parts of the HIPAA Rules, so the duty runs both ways.
Vendors That Are Usually Business Associates
A business associate is a person or company that performs a function or service for you that involves protected health information. Protected health information (PHI) is health information that can identify a patient. In practice, a name or phone number tied to a visit or a treatment question is the kind of detail to treat as PHI.
HHS gives examples such as a cloud service provider that creates, receives, maintains or transmits electronic PHI, and a transcription vendor working for a physician. In a practice’s day-to-day tools, these usually fall in the same group:
- CRM. A CRM (customer relationship management system) keeps track of every person who contacts you and what happens next. Names, phone numbers and the treatment someone asked about are PHI once they are tied to your practice.
- Texting and email platforms that send appointment reminders, rebooking messages or replies to patients.
- Answering services and AI receptionists that take calls, record who called and why, or book appointments.
- Online form tools that collect intake details, appointment requests or medical history from your website.
- Hosting and cloud storage that store patient information, including a website server that keeps form submissions.
- Some marketing agencies. An agency that works inside your CRM, follows up on patient inquiries, or sends campaigns to your patient list is handling PHI for you. An agency that only runs ads and builds pages, and never sees patient data, may not be.
Website tracking deserves its own mention. A tracking technology is code on a website, such as an analytics tag or ad pixel, that collects information about visitors. HHS guidance on online tracking says regulated entities must ensure tracking technology vendors have signed a BAA before PHI is disclosed to them. In June 2024 a federal court vacated part of that guidance, the part about tracking on public web pages where visitors don’t log in, and HHS says it is evaluating next steps. The rest of the guidance, including tracking on pages where patients log in, still appears on the HHS page, so ask your counsel how it applies to your site.
Business associates often rely on vendors of their own. HHS calls these subcontractors: a company that handles PHI for a business associate. A business associate must have its own BAA with each subcontractor before sharing PHI, and HHS says every downstream subcontractor is also a business associate.
Which Vendors Don’t Need a BAA?
Not every vendor that comes near patient information is a business associate. HHS lists several exceptions:
- Conduits. A conduit is a service that only carries information from one place to another without storing or reading it. HHS names the U.S. Postal Service as an example.
- Incidental access. HHS says janitorial and electrical workers whose access to PHI is only incidental are not business associates.
- Treatment disclosures. Sharing information with another provider to treat a patient, such as sending a referral to a specialist, doesn’t make that provider your business associate.
Vendors whose work never touches patient information usually don’t need one either: a print shop producing brochures, a photographer shooting your office, or a designer working on your logo. A tool that started as a simple website plugin can become a business associate the day it begins storing patient form submissions.
What Goes in a Business Associate Agreement
HHS publishes sample business associate agreement provisions. Its own page says the sample is only sample language, isn’t required for compliance, may not be enough to form a binding contract under state law, and doesn’t replace consulting a lawyer. Even so, it shows what a BAA is expected to cover:
| Provision | What it means in plain English |
|---|---|
| Permitted uses and disclosures | The vendor may use or share PHI only for the services it provides you, or as the law requires |
| Safeguards | The vendor must protect PHI and follow the HIPAA Security Rule for electronic PHI, the part of HIPAA that sets standards for protecting data held in electronic form |
| Reporting | The vendor must tell you about any use or disclosure the agreement doesn’t allow, including breaches of unsecured PHI |
| Subcontractors | Any company the vendor uses that handles your PHI must agree to the same restrictions |
| Patient rights | The vendor must help you give patients access to their records, make amendments and account for disclosures |
| Return or destruction | When the agreement ends, the vendor returns or destroys your PHI and keeps no copies |
| Termination | You may end the agreement if the vendor violates a material term |
When a vendor sends you its own BAA, check two more things: which of its products or services the BAA actually covers, and what happens to your data if you leave. Many vendors sign for some plans or features and not others.
BAA Checklist: Vendors to Ask
“Usually” means it depends on what the vendor handles for you, so the question in the last column matters.
| Vendor | BAA usually needed? | What to ask |
|---|---|---|
| CRM | Yes | Will you sign a BAA, and does it cover every feature we use? |
| Texting or email platform | Yes, if it messages patients | Is the BAA available on our plan? |
| Answering service or AI receptionist | Yes | Where are call recordings and notes stored, and who can see them? |
| Website form tool | Yes, if forms collect patient details | Are submissions stored, and are they covered by the BAA? |
| Website hosting | If it stores PHI | Does our site keep form entries on the server? |
| Marketing agency | If it handles patient data | Will you access our CRM, patient lists or inquiries? |
| Analytics and ad tracking | Ask your counsel | What data do your tags collect on our booking and form pages? |
| Mail carrier | No (conduit) | None needed |
| Cleaning or maintenance crew | No (incidental access) | None needed, but keep records out of sight |
Does a BAA Make a Tool HIPAA Compliant?
No. A BAA is a promise about how a vendor will handle patient information. It doesn’t configure the tool, train your staff or decide what goes into a message. A practice can have a signed BAA and still expose PHI by:
- Putting a treatment name or diagnosis in a text that anyone holding the phone can read.
- Sharing one login among the whole front desk, so no one can tell who opened what.
- Using a feature or add-on the BAA doesn’t cover.
- Exporting patient lists into a spreadsheet or ad platform that has no BAA.
- Letting staff text patients from personal phones instead of the covered platform.
Compliance comes from the contract plus the setup plus how your team works every day. That is why we configure and manage KloudMD for practices rather than handing over a login; the setup is part of the job. For how these rules shape ads, email and reviews, read our guide to HIPAA-compliant marketing, and for website intake, see HIPAA-compliant forms for medical websites.
KloudMD is included in both of our managed marketing plans, Growth from $1,499 a month and Authority from $2,999 a month. If you only need missed and after-hours calls answered, the AI Voice Starter is $499 a month per location.
Common Questions About Business Associate Agreements
Is a business associate agreement required by law?
If your practice is a HIPAA covered entity, yes. HHS says a covered entity must have a written business associate contract or other arrangement with each vendor that creates, receives, maintains or transmits protected health information on its behalf.
Does my marketing agency need to sign a BAA?
It depends on what the agency handles. An agency that works in your CRM, follows up on patient inquiries or emails your patient list is handling PHI and should sign one. An agency that never sees patient information may not need to.
My practice is cash-pay. Do I still need BAAs?
Maybe not. HHS says a health care provider is a covered entity only if it transmits health information electronically in connection with certain standard transactions, such as insurance claims. Many cash-pay practices ask for BAAs anyway. Confirm your status with your counsel.
If a vendor signs a BAA, is its tool HIPAA compliant?
Not by itself. The BAA sets the vendor’s duties, but compliance also depends on how the tool is set up, which features you use, who can log in and what your staff put in messages.
Can I use the HHS sample BAA?
You can start from it, but HHS says the sample provisions are only sample language, may not be enough to form a binding contract under state law, and do not replace consulting a lawyer.
What to Do This Week
List every tool and vendor that touches a patient’s name, phone number, email or reason for contacting you: phone system, answering service, CRM, texting, email, website forms, hosting, booking, reviews and your marketing agency. Next to each, write whether you have a signed BAA, the date it was signed and which services it covers. Any blank line is your first call. Then check one thing in each tool: that every staff member has their own login. For the bigger picture on following up with every inquiry, read Lead Follow-Up for Medical Practices: How Fast Is Fast Enough?
Sources
- U.S. Department of Health and Human Services, “Business Associates”, content last reviewed October 21, 2026, accessed October 29, 2026. Source for the definition of a business associate, HHS examples, the conduit and incidental-access exceptions, subcontractors and direct liability.
- U.S. Department of Health and Human Services, “Covered Entities and Business Associates”, content last reviewed August 21, 2024, accessed October 29, 2026. Source for the three kinds of covered entity, the electronic-transaction condition for providers, and the written contract requirement.
- U.S. Department of Health and Human Services, “Sample Business Associate Agreement Provisions”, content last reviewed June 16, 2017, accessed October 29, 2026. Source for the provisions table and the disclaimer that the sample doesn’t replace a lawyer.
- U.S. Department of Health and Human Services, “Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates”, content last reviewed June 26, 2024, accessed October 29, 2026. Source for BAAs with tracking technology vendors and the June 20, 2024 court ruling that vacated part of the guidance.
- Brand Lift 360, Healthcare CRM for Medical Practices, accessed October 29, 2026. Source for KloudMD, plan inclusion and the BAA for covered services.