When Do You Need a Business Associate Agreement? HIPAA Rules Explained

Meta description: Learn when a business associate agreement is required under HIPAA, who needs to sign one, what it must cover, and which exceptions apply.

A business associate agreement, often called a BAA, is a written contract that helps protect health information handled on behalf of a covered entity. Under HIPAA, the agreement is generally required before a covered entity lets a vendor or other outside organization access protected health information (PHI) to perform certain services. Knowing when a BAA is needed—and when an exception applies—can help organizations avoid compliance gaps, clarify security duties, and respond appropriately to incidents.

What Is a Business Associate Agreement?

A business associate agreement is a contract or other written arrangement that sets out how a business associate may use and disclose PHI, and what safeguards it must follow. It also establishes responsibilities for reporting security incidents and breaches, supporting individual rights, and returning or destroying PHI when the relationship ends, when feasible.

The agreement is required by the HIPAA Privacy Rule and Security Rule in many arrangements involving PHI. Its purpose is not simply to label a vendor as “HIPAA compliant.” Rather, it makes the parties’ permitted uses, restrictions, and responsibilities clear and enforceable. A BAA does not replace an organization’s broader HIPAA policies, risk analysis, security measures, or workforce training.

Key federal rules appear in the HIPAA regulations at 45 C.F.R. § 164.502(e) and 45 C.F.R. § 164.308(b). The U.S. Department of Health and Human Services (HHS) also explains the relationship in its sample business associate contract provisions.

When Is a Business Associate Agreement Required?

A BAA is generally required when a HIPAA covered entity engages a business associate to create, receive, maintain, or transmit PHI on the covered entity’s behalf while performing a function or service regulated by HIPAA. Covered entities include health plans, health care clearinghouses, and most health care providers that conduct certain transactions electronically.

A BAA is also generally required between a business associate and its subcontractor if the subcontractor will create, receive, maintain, or transmit PHI to help perform the business associate’s work. This requirement can continue down a chain of service providers: each party handling PHI for another business associate must have an appropriate written agreement in place.

The practical test is not whether a vendor is called a “consultant,” “technology company,” or “partner.” The important questions are what the organization does, whose behalf it acts on, and whether it handles PHI. A contract’s title does not determine whether HIPAA requires a BAA.

Common examples

• Cloud storage and hosting: A cloud service provider that stores electronic PHI for a covered entity or business associate generally needs a BAA, even if the data is encrypted and the provider does not hold the encryption key. HHS has addressed cloud service providers in its HIPAA cloud computing guidance.
• Billing and claims services: A billing company that uses patient information to submit claims or manage payments for a medical practice typically acts as a business associate.
• Electronic health record support: A vendor that can access PHI while hosting, maintaining, or troubleshooting an EHR generally needs a BAA.
• Document destruction: A company that receives records containing PHI for shredding or secure disposal generally requires a BAA.
• Outside professional services: A consultant, data analyst, or law firm may need a BAA if it performs covered functions for a regulated organization using PHI. The specific work and legal relationship matter.
• Subcontractors: A business associate that hires a cloud host, data processor, or other subcontractor to handle PHI generally must obtain a written agreement imposing applicable HIPAA protections.

Who Counts as a Business Associate?

Under HIPAA, a business associate is generally a person or organization that performs certain functions or activities for a covered entity—or provides specified services to one—and needs PHI to do so. Examples of functions include claims processing, data analysis, billing, quality assurance, and utilization review. Services can include legal, actuarial, accounting, consulting, management, administrative, accreditation, or financial services when they involve PHI.

An organization may also be a business associate if it creates, receives, maintains, or transmits PHI on behalf of a covered entity, even when its role is limited to storing data. The regulatory definition is in 45 C.F.R. § 160.103.

Business associate status depends on the actual arrangement, not just the parties’ description of it. If a vendor has no access to PHI and does not create, receive, maintain, or transmit it on the organization’s behalf, a BAA may not be required for that service. Organizations should still assess whether the vendor can access PHI through support tools, backups, metadata, or other system functions.

When Is a BAA Usually Not Required?

HIPAA includes important exceptions. A BAA is generally not required simply because an outside party encounters PHI in one of the following circumstances:

• Workforce members: Employees, volunteers, trainees, and other people whose conduct is under the covered entity’s direct control are generally treated as part of its workforce, not as business associates. The organization must still apply appropriate privacy and security controls.
• Treatment disclosures between providers: A health care provider generally does not need a BAA with another provider when disclosing PHI for treatment purposes. This exception does not mean a BAA is unnecessary for every service one provider performs for another; the role and purpose must be assessed.
• Disclosures to a health plan for payment: A covered entity generally does not need a BAA with a health plan when the plan receives PHI for payment activities, subject to the applicable HIPAA rules and limitations.
• Public authorities and certain government programs: Some disclosures to government agencies or other entities authorized by law may not create a business associate relationship. The specific statutory and regulatory conditions matter.
• Conduits: Certain transmission services that transport information without routinely accessing it, such as some telecommunications carriers or mail services, may fall within the conduit exception. This is a narrow exception, not a general exemption for technology companies.
• De-identified information: Properly de-identified information that no longer qualifies as PHI under HIPAA generally does not require a BAA solely because it is shared. HIPAA recognizes specific methods for de-identification.

HHS describes the conduit exception and business associate definition in its guidance for covered entities and related materials. Because the boundaries can be fact-specific, organizations should not assume a vendor is a conduit merely because it transmits data, or that a data set is de-identified merely because direct identifiers were removed.

Does Every Vendor That Touches Health Data Need a BAA?

No. The fact that a company works with a health care organization or encounters information related to a patient does not automatically make it a business associate. HIPAA applies to PHI handled by regulated entities and their business associates in defined circumstances. The organization should determine whether the information is PHI, whether the vendor is acting on its behalf, and whether the vendor creates, receives, maintains, or transmits that PHI.

For example, a vendor providing general office supplies without access to PHI ordinarily does not need a BAA. A software provider that stores patient records for a clinic may need one, even if the clinic controls user access. A service provider that only transmits encrypted data may still need a BAA if it maintains the information; encryption alone does not necessarily remove the data from HIPAA’s scope.

Organizations should also distinguish HIPAA’s BAA requirement from other privacy or security obligations. State health privacy laws, consumer protection rules, contracts, and industry requirements may apply even when HIPAA does not require a BAA.

What Must a Business Associate Agreement Include?

HIPAA specifies core provisions for business associate contracts. An agreement should be tailored to the services and risks involved, rather than copied without review. Under 45 C.F.R. § 164.504(e), required terms generally address the following:

• Permitted and required uses and disclosures of PHI, including limits on uses beyond the agreement.
• A prohibition on using or disclosing PHI in ways that would violate HIPAA if done by the covered entity, except where the agreement or law permits it.
• Appropriate safeguards to prevent unauthorized use or disclosure, including compliance with applicable Security Rule requirements for electronic PHI.
• Reporting obligations for impermissible uses or disclosures, security incidents, and breaches of unsecured PHI, with the details and timing addressed in the agreement.
• Requirements for subcontractors that handle PHI to accept written protections consistent with those imposed on the business associate.
• Support for access, amendment, and accounting-of-disclosures obligations when those duties apply to the business associate’s work.
• Access for HHS to relevant internal practices, books, and records for compliance review, as required by law.
• Return or destruction of PHI when the arrangement ends, if feasible, and continued protections when return or destruction is not feasible.
• Termination rights if the covered entity learns of a material breach and the business associate does not appropriately address it.

Contracts often add practical details: which systems contain PHI, approved locations for processing, security standards, incident contacts, audit cooperation, insurance, data retention, and how quickly each party must notify the other of a suspected incident. These additions can make the relationship more workable, but they should not conflict with HIPAA’s requirements.

When Should the Agreement Be Signed?

The BAA should be in place before the business associate receives or accesses PHI for the covered service. Waiting until after onboarding, a security incident, or a compliance review creates avoidable risk. Procurement and privacy processes should identify PHI handling early, before the vendor receives production data or administrative access.

Existing arrangements may need review when services change. A vendor that originally handled only non-sensitive technical support might later host patient data, add analytics, or use a subcontractor. Those changes can affect business associate status and contract obligations. Organizations should reassess the agreement whenever the scope, data, systems, or subcontracting chain changes.

A BAA is not a substitute for checking whether a vendor is suitable. The covered entity remains responsible for its own HIPAA compliance, including selecting appropriate service providers, limiting access, conducting required risk analysis, and monitoring the arrangement. A signed agreement cannot make an insecure service or unlawful data use acceptable.

How to Decide Whether a BAA Is Needed

A consistent review process helps organizations make defensible decisions and avoid both missing required agreements and demanding them where HIPAA does not apply.

1. Identify the data. Determine whether the information is PHI, including whether it identifies an individual and relates to health, health care, or payment for care.
2. Map the vendor’s role. Ask whether the vendor performs a covered function or service on behalf of the organization, or handles PHI on behalf of another business associate.
3. Check actual access. Review storage, backups, support access, logs, integrations, and subcontractors—not only the product’s advertised features.
4. Review exceptions carefully. Confirm whether the arrangement truly fits an exception, such as workforce status, treatment disclosure, or the narrow conduit category.
5. Document the decision. Record the facts, rationale, responsible reviewer, and any safeguards or contract terms required.
6. Put the agreement in place before access. Verify that the BAA matches the services and covers applicable subcontractors.
7. Reassess periodically. Review the relationship after material changes and as part of vendor risk management.

Common BAA Mistakes to Avoid

• Assuming a signed BAA guarantees compliance: Both parties still have separate HIPAA duties and must follow the agreement in practice.
• Using a generic contract without checking its terms: The document may omit required provisions or fail to reflect the service’s actual data flows.
• Overlooking subcontractors: A business associate must ensure that relevant subcontractors agree in writing to appropriate PHI protections.
• Delaying signature until after access begins: The agreement should be established before PHI is disclosed or made accessible for the service.
• Treating encryption as an automatic exemption: A provider that maintains encrypted PHI may still be a business associate even without the decryption key.
• Failing to revisit the arrangement: New features, integrations, analytics, or support access may change the vendor’s role.

For complicated arrangements, organizations can consult qualified privacy counsel or a HIPAA compliance professional. The decision should be based on the HIPAA regulations, current HHS guidance, the actual flow of information, and any additional state or contractual requirements.