Does HIPAA Require a BAA? (w/Examples) + FAQs

Yes. HIPAA requires a written Business Associate Agreement (BAA) whenever a covered entity, or another business associate, shares Protected Health Information (PHI) with a third party that creates, receives, maintains, or transmits PHI on its behalf. The rule comes from the HIPAA Privacy Rule at 45 CFR § 164.502(e) and the matching Security Rule at 45 CFR § 164.308(b), and the consequence of skipping one is a direct violation that can trigger civil penalties up to $2,134,831 per identical violation per year under the 2024 HHS penalty adjustment.

The problem is simple to describe and expensive to ignore. Vendors, contractors, and cloud services touch patient data every day, and without a signed BAA the covered entity is the only party on the hook for the breach. The HITECH Act of 2009 and the HIPAA Omnibus Rule of 2013 changed that by making business associates directly liable, but the written contract is still the linchpin that ties the whole chain together.

According to the HHS Office for Civil Rights breach portal, more than 133 million individuals were affected by reported healthcare breaches in 2023 alone, and a large share of those incidents traced back to business associates who lacked proper agreements or safeguards.

Here is what this article will unpack for you:

• 📜 When a BAA is legally required and when it is not
• 🏥 Who counts as a covered entity versus a business associate versus a subcontractor
• ⚖️ The federal rules, state overlays, and OCR enforcement cases that shape BAA duties
• 🧾 The exact clauses every BAA must contain under 45 CFR § 164.504(e)
• 🛡️ The most common mistakes, pitfalls, and misconceptions that lead to six- and seven-figure fines

The Short Answer: When HIPAA Requires a BAA

HIPAA requires a BAA any time a covered entity hands off PHI to an outside person or company that performs a function on behalf of the covered entity. The rule sits inside the Privacy Rule’s contract requirement at § 164.502(e)(1), and it applies whether the PHI is paper, electronic, or spoken over the phone. The written agreement must exist before the PHI is shared, not after.

The plain-English version is this. If you are a doctor, hospital, health plan, or healthcare clearinghouse, and you pay a vendor to help you run your operation in a way that exposes patient data, you must get that vendor to sign a BAA. The consequence of skipping it is that the OCR treats the disclosure itself as an impermissible use of PHI, which is a separate violation on top of any breach that follows.

A real example makes this clear. Dr. Rivera runs a small cardiology clinic in Austin and hires a third-party billing company to submit claims to insurers. The billing company sees names, diagnoses, and claim codes every day. Dr. Rivera must sign a BAA with that billing company before sending the first file, or she is in violation the moment the data moves.

A common misconception is that a verbal promise or a generic confidentiality clause inside a service agreement is enough. It is not. The Office for Civil Rights guidance on business associate contracts makes clear that the specific provisions listed in 45 CFR § 164.504(e) must appear in writing, either as a standalone BAA or as a clearly labeled addendum.

The other piece people forget is the downstream rule. A business associate that hires its own subcontractor to handle PHI must sign a BAA with that subcontractor, and the subcontractor must flow the same obligations down to anyone it hires. This chain is the backbone of the Omnibus Rule’s expansion of liability, and it is why a cloud provider three layers deep can still end up on an OCR settlement list.

Who Is a Covered Entity vs. a Business Associate

To know whether you need a BAA, you first have to know which side of the line you are on. HIPAA puts every player into one of three buckets, and each bucket has different duties.

Covered Entities

A covered entity is defined in 45 CFR § 160.103 as one of three things: a health plan, a healthcare clearinghouse, or a healthcare provider that transmits any health information electronically in connection with a HIPAA-standard transaction. That last phrase matters because a cash-only provider who never bills insurance electronically may fall outside HIPAA entirely.

Hospitals, physician practices, dental offices, pharmacies, and Medicare Advantage plans are the most common examples. Each has a duty to protect PHI, to provide patients with a Notice of Privacy Practices, and to sign BAAs with every vendor that touches PHI.

The consequence of misclassifying yourself is severe. If a provider assumes HIPAA does not apply and later adds electronic claims, every unsigned vendor relationship becomes a retroactive problem. A common misconception is that small practices are exempt; they are not.

Business Associates

A business associate is a person or entity that, on behalf of a covered entity, creates, receives, maintains, or transmits PHI for a covered function. The definition in 45 CFR § 160.103 is broad on purpose. It captures billing firms, IT managed service providers, cloud hosts, law firms doing claims work, accountants auditing records, transcription services, and shredding companies.

After HITECH, business associates are directly liable for Security Rule compliance, the breach notification requirement, and the use-or-disclosure limits in their BAA. Marcus Lee, who runs a medical transcription startup, learned this when OCR pursued him personally for a breach even though his hospital client never reported it.

A misconception is that “we never look at the data” is a defense. It is not. Mere access or the ability to access PHI triggers business associate status, which is why cloud storage providers are almost always business associates.

Subcontractors

A subcontractor is a business associate of a business associate. The Omnibus Rule made this explicit in 2013, and it means the BAA chain must reach every layer that touches PHI.

If Bright Billing LLC hires CloudNine Hosting to store claim files, Bright Billing must sign a BAA with CloudNine even though CloudNine never speaks to the original hospital. The consequence of missing this step is that Bright Billing is in breach of its own upstream BAA and of the Privacy Rule at the same time.

A common misconception is that the covered entity must sign the downstream BAA too. It should not, and it usually cannot, because the covered entity has no contract with the subcontractor. The duty sits with the middle layer.

The Federal Rules That Create the BAA Duty

The BAA requirement does not come from one rule. It comes from several interlocking rules inside the HIPAA regulations, and each one adds a different piece of the puzzle.

The Privacy Rule

The Privacy Rule at 45 CFR § 164.502(e) is the source of the contract itself. It says a covered entity may disclose PHI to a business associate only if it gets “satisfactory assurances” that the business associate will safeguard the information, and those assurances must be in writing.

The plain-English meaning is that the BAA is the written receipt that proves you got the promise. The consequence of not having one is that every disclosure is treated as an impermissible use under § 164.502(a), which is itself a violation subject to penalties.

North Memorial Health Care of Minnesota paid $1.55 million in a 2016 OCR settlement after it gave PHI to a vendor without a BAA in place. A common misconception is that a stalled or draft BAA is “close enough.” It is not, and OCR treats the gap as a bright-line failure.

The Security Rule

The Security Rule at 45 CFR § 164.308(b) requires the same written contract for electronic PHI and adds the duty to obtain assurances that the business associate will implement administrative, physical, and technical safeguards.

The consequence of skipping this is a Security Rule violation that stacks on top of any Privacy Rule violation. Raleigh Orthopaedic paid $750,000 in a 2016 settlement after handing X-ray films to a vendor without a BAA, and OCR charged both rules.

A common misconception is that encryption alone satisfies the Security Rule without a BAA. It does not. Encryption reduces breach risk, but the contract is still required.

The Breach Notification Rule

The Breach Notification Rule at 45 CFR § 164.410 requires business associates to notify the covered entity of any breach of unsecured PHI without unreasonable delay, and in no case later than 60 days after discovery.

The BAA is the vehicle that locks in the timeline, the content of the notice, and which party files with OCR. The consequence of a missing or vague BAA is that the covered entity may not learn of a breach in time to meet its own 60-day clock, which is itself a violation.

A common misconception is that the 60-day window starts when the business associate confirms the breach. It starts on discovery, including constructive discovery by an employee acting within the scope of work.

The Enforcement Rule

The Enforcement Rule at 45 CFR Part 160, Subpart D sets the civil money penalty tiers. The 2024 inflation adjustment raised the top tier to $2,134,831 per identical violation per calendar year.

The four tiers are “did not know,” “reasonable cause,” “willful neglect-corrected,” and “willful neglect-not corrected.” Missing BAAs almost always fall into one of the willful-neglect tiers because OCR treats the duty as well-known.

A common misconception is that a first-time offense gets a free pass. It does not, though OCR has discretion to reduce penalties in the lower tiers.

What a BAA Must Contain Under 45 CFR § 164.504(e)

Every BAA must include a specific set of clauses. The list sits in 45 CFR § 164.504(e)(2), and OCR publishes sample BAA provisions that track the rule almost word for word.

The required elements include a description of the permitted uses and disclosures of PHI, a prohibition on any use or disclosure not permitted by the contract or by law, and a duty to use appropriate safeguards. The BAA must also require the business associate to report any unauthorized use or disclosure, to ensure any subcontractor agrees to the same restrictions, to make PHI available for patient access requests under § 164.524, and to return or destroy PHI at the end of the contract.

The consequence of a missing clause is that the BAA is defective on its face. Advanced Care Hospitalists paid $500,000 in a 2018 OCR settlement after relying on a vendor with no valid BAA, and OCR cited the missing contract as the core failure.

A common misconception is that one BAA template fits every vendor. It does not. A cloud host’s BAA needs different security language than a shredding company’s BAA, and a law firm’s BAA needs litigation-specific carve-outs.

Permitted Uses and Disclosures

The BAA must list exactly what the business associate may do with the PHI. Vague language like “for any lawful purpose” fails the minimum necessary standard at § 164.502(b).

Sarah Patel, a compliance officer at a mid-size hospital, learned this when an auditor flagged a BAA that let a vendor use PHI “as needed.” She had to amend every BAA in her portfolio within 90 days.

Safeguards and Reporting

The BAA must require the business associate to use appropriate safeguards and to report breaches and security incidents. The Security Rule sets the floor, but the BAA can set tighter timelines, for example a 10-day breach notice instead of 60.

The consequence of skipping the safeguards clause is direct Security Rule liability for the covered entity even if the breach happened on the vendor’s systems.

Termination Rights

The BAA must give the covered entity the right to terminate if the business associate violates a material term. § 164.504(e)(2)(iii) even says the covered entity must terminate if feasible, or report to HHS if not.

A common misconception is that termination is optional. It is not when the breach is material and cure is not feasible.

When a BAA Is Not Required

Not every PHI disclosure needs a BAA. The Privacy Rule carves out several situations where the duty does not apply, and knowing these carve-outs saves time and paperwork.

The Treatment Exception

Disclosures between providers for treatment purposes do not require a BAA. § 164.502(e)(1)(ii) says a provider sharing PHI with another provider for the treatment of the patient is not creating a business associate relationship.

Dr. Chen, a primary care physician, refers a patient to Dr. Novak, a cardiologist, and sends the chart. No BAA is required because both are covered entities acting as providers. The consequence of over-papering this relationship is wasted legal spend, not a violation.

A common misconception is that any provider-to-provider exchange is exempt. It is not. If Dr. Novak’s staff is also processing claims for Dr. Chen’s practice, a BAA is required for the billing work even though treatment sharing is not.

The Conduit Exception

Pure transmission services that have only transient access to PHI are not business associates. The classic examples are the U.S. Postal Service, UPS, and internet service providers that move packets without storing content.

The consequence of misapplying this exception is real. OCR has said cloud storage providers are not conduits because they maintain PHI, not merely transmit it. Phoenix Cardiac Surgery learned this when it tried to argue a cloud-based calendar was a conduit; OCR disagreed, and the practice paid $100,000 in a 2012 settlement.

A common misconception is that any vendor that does not read the data is a conduit. The test is persistence, not curiosity. If the vendor stores the PHI at rest, it is a business associate.

Workforce Members

Employees, volunteers, and trainees under the direct control of the covered entity are workforce members, not business associates. The definition in § 160.103 draws a clear line based on control, not W-2 status.

A common misconception is that a 1099 contractor is automatically a business associate. The real test is whether the person is acting under the covered entity’s direct control. A staffed-up locum tenens physician may be a workforce member, while a consulting firm of the same head count is a business associate.

Plan Sponsors

Employer plan sponsors that receive only summary health information or enrollment data are not business associates. § 164.504(f) sets up a separate regime of plan documents and certifications instead.

The consequence of forcing a BAA here is contractual confusion, because the sponsor-plan relationship is not an on-behalf-of relationship.

Researchers

Researchers who receive PHI under an authorization, a waiver of authorization, or a limited data set with a data use agreement are not business associates. The data use agreement under § 164.514(e) is a different instrument with its own rules.

Three Common BAA Scenarios

The scenarios below walk through the most frequent fact patterns and the consequences of each choice.

Scenario 1: Cloud Storage Vendor

Scenario 2: Medical Billing Company

Scenario 3: Law Firm Handling Malpractice Claims

Real OCR Enforcement Cases to Learn From

OCR’s settlement history is the best map of what not to do. Each case below turned on a missing or defective BAA.

North Memorial Health Care — $1.55 Million

North Memorial gave PHI of nearly 290,000 patients to a contractor without a BAA. The contractor later lost an unencrypted laptop. OCR charged both the missing BAA and the lack of a risk analysis, and the total payout included a three-year corrective action plan.

Raleigh Orthopaedic Clinic — $750,000

Raleigh Orthopaedic handed 17,300 patients’ X-ray films to a vendor to harvest silver, with no BAA in place. OCR treated the entire disclosure as impermissible.

Care New England — $400,000

Care New England relied on an outdated 2005 BAA that never picked up the Omnibus Rule’s 2013 requirements. OCR made clear that stale BAAs are defective BAAs.

Advanced Care Hospitalists — $500,000

Advanced Care Hospitalists used a billing contractor with no written BAA and no verified identity. PHI of 9,000 patients showed up on a public website.

Phoenix Cardiac Surgery — $100,000

Phoenix Cardiac Surgery posted clinical and surgical appointments on a public internet calendar and lacked BAAs with its vendors. The case is cited to this day as the conduit-exception cautionary tale.

State Law Overlays That Affect BAAs

Federal HIPAA sets the floor, but many states add stricter rules that reach into the BAA itself. A smart drafter reads the state map before the federal one.

California — CMIA

The California Confidentiality of Medical Information Act (CMIA) imposes its own contract and safeguards duties on “contractors” that receive medical information. The CMIA allows private lawsuits with statutory damages of $1,000 per violation, which HIPAA does not.

Jasmine Ortiz, a compliance lead at a Los Angeles clinic, builds CMIA terms into every BAA so one document satisfies both regimes. The consequence of relying on a bare federal BAA in California is exposure to class actions.

Texas — HB 300

Texas HB 300 expands the definition of covered entity to nearly any business that handles PHI and requires specific training and breach notice rules. Texas Attorney General enforcement has produced multi-million-dollar settlements.

New York — SHIELD Act

The New York SHIELD Act adds reasonable safeguard requirements and breach notice obligations that many BAAs now reference directly. The consequence of ignoring SHIELD is dual exposure to OCR and the New York AG.

Other States

Florida’s FIPA, Illinois PIPA, and Massachusetts 201 CMR 17.00 each add layers that often force BAA amendments.

Mistakes to Avoid

1. Using one BAA template for every vendor leads to missing safeguard terms and forces audit cycles that are expensive.
2. Relying on an old pre-Omnibus BAA leaves the subcontractor flow-down clause out, which is the exact failure that sank Care New England.
3. Treating cloud vendors as conduits triggers both a missing-BAA violation and a Security Rule violation.
4. Letting the BAA lapse at contract renewal creates a gap period where every disclosure is impermissible.
5. Signing the vendor’s one-sided BAA without review often strips away breach notice timelines tighter than 60 days.
6. Forgetting the downstream BAA leaves business associates personally liable under the Omnibus Rule.
7. Ignoring state-specific clauses like CMIA contractor duties leaves statutory damages on the table for plaintiffs.
8. Failing to track BAAs in a central registry makes the OCR audit question “produce all BAAs” a nightmare.
9. Skipping a termination-for-breach clause forces the covered entity to report to HHS instead of terminating.
10. Assuming email encryption substitutes for a BAA confuses safeguards with contracts.

Do’s and Don’ts

Do’s

• Do inventory every vendor that touches PHI before you start drafting, because missed vendors equal missed BAAs.
• Do use the HHS sample BAA provisions as a starting floor, then tailor upward.
• Do require breach notice within 10 or 15 days, not the full 60, so your own clock does not run out.
• Do include a right to audit or request a SOC 2 Type II report, because trust without verification is a gamble.
• Do confirm the vendor carries cyber liability insurance, because penalties without insurance crush small vendors.

Don’ts

• Don’t let sales teams sign vendor contracts before compliance review, because once the ink is dry the leverage is gone.
• Don’t accept “confidentiality clause” language in a master services agreement as a BAA substitute, because it almost never tracks § 164.504(e).
• Don’t forget to update BAAs after the Omnibus Rule, because pre-2013 templates miss mandatory clauses.
• Don’t ignore subcontractors, because every layer downstream needs its own BAA.
• Don’t treat the BAA as a one-time exercise, because vendors change services, scopes, and owners.

Pros and Cons of Signing a Robust BAA

Pros

• Liability clarity, because the BAA spells out who reports, who pays, and who cures each kind of incident.
• Faster breach response, because pre-agreed timelines beat last-minute negotiation during a crisis.
• Audit readiness, because OCR’s first document request in an audit is “produce your BAAs.”
• Insurance alignment, because cyber carriers often require documented BAAs as a condition of coverage.
• Patient trust, because BAAs demonstrate that third-party access is controlled and contractual.

Cons

• Up-front cost, because good BAA drafting takes legal hours that small practices may not have.
• Vendor friction, because some vendors refuse to sign or demand indemnity caps that shift risk back.
• Ongoing maintenance, because BAAs must be updated whenever the services, the law, or the vendor changes.
• False comfort, because a signed BAA does not substitute for actual security controls.
• Over-papering, because pushing BAAs on treatment providers or true conduits wastes time and creates confusion.

Processes and Forms: From Identification to Signature

The BAA workflow is a five-step process, and each step has choices with real consequences.

Step 1: Identify the Vendor Relationship

Map the data flow first. Ask who creates, receives, maintains, or transmits PHI on behalf of your organization. The consequence of a missed vendor is a missing BAA, which is the single most common OCR finding.

Step 2: Classify the Relationship

Decide whether the vendor is a business associate, a workforce member, a conduit, or outside HIPAA entirely. The OCR guidance on business associates gives examples for each. Misclassification is the root cause of most Phoenix-style cases.

Step 3: Draft or Negotiate the BAA

Start from a vetted template that covers every clause in § 164.504(e)(2). Add state-specific clauses for CMIA, HB 300, SHIELD, and any other state where you operate. The consequence of a clause-by-clause gap is an unenforceable BAA on the exact issue you care about most.

Step 4: Execute and Store

Get wet or e-signatures on both sides, date the document, and store it in a central BAA registry. The consequence of a lost BAA is the same as no BAA at all during an audit.

Step 5: Monitor and Renew

Review BAAs on a calendar, for example every two years or at contract renewal. Update them after any regulatory change, service change, or ownership change. The consequence of neglect is a Care New England-style stale-BAA finding.

How Penalties Stack Up

The four-tier penalty structure under the Enforcement Rule and the 2024 inflation adjustment looks like this.

OCR’s enforcement discretion means BAAs can move a case from tier three to tier two, which often saves six or seven figures.

Frequently Asked Questions

Does every vendor need a BAA?

No. Only vendors that create, receive, maintain, or transmit PHI on behalf of a covered entity or business associate need a BAA; pure conduits, workforce members, and treatment-only provider exchanges are outside the rule.

Can a verbal agreement substitute for a BAA?

No. The Privacy Rule requires written satisfactory assurances, and OCR has fined covered entities that relied on handshakes or informal promises.

Is a cloud storage provider a business associate?

Yes. OCR’s cloud computing guidance says storage of PHI, even encrypted PHI the vendor cannot read, creates a business associate relationship requiring a BAA.

Does a BAA make me immune from HIPAA liability?

No. A BAA allocates duties and can shift some liability, but the covered entity remains responsible for its own compliance and for choosing competent business associates.

Can a business associate use PHI for its own marketing?

No. The BAA and § 164.504(e) prohibit any use not authorized in the contract, and marketing is almost never authorized.

Is an AI vendor a business associate?

Yes. If the AI vendor processes PHI on behalf of a covered entity, it is a business associate, and OCR has signaled this in recent cybersecurity guidance.

Does a BAA need to be renewed every year?

No. HIPAA does not set a fixed renewal clock, but best practice is to review BAAs at each contract renewal or after any regulatory or service change.

Can I use one master BAA across all vendors?

No. A master template is fine, but each BAA should be tailored to the specific services, data, and state law exposure of the vendor.

Do small practices really get audited?

Yes. OCR’s audit program reaches practices of all sizes, and the 2016 audits included solo practitioners.

Is a data use agreement the same as a BAA?

No. A data use agreement under § 164.514(e) covers limited data sets for research or public health and is a separate instrument from a BAA.

Must a subcontractor sign a BAA with the original covered entity?

No. The subcontractor signs with the business associate above it, and the chain of obligations flows down without a direct contract with the covered entity.

Can a covered entity terminate a BAA at will?

Yes. Most BAAs include both material-breach termination rights and convenience termination rights, and § 164.504(e)(2)(iii) requires termination for material breach that cannot be cured.