Business associates and covered entities
HIPAA divides the healthcare data world into two roles. A covered entity is a healthcare provider that transmits health information electronically for standard transactions, a health plan, or a healthcare clearinghouse. A business associate is an outside person or organization that creates, receives, maintains, or transmits PHI while performing services for a covered entity. The test is functional, not formal: what matters is whether a vendor touches PHI, not which industry it belongs to.
The same relationship repeats one level down. When a business associate hires another company to handle PHI, such as a hosting provider that stores its backups, that company becomes a subcontractor business associate. It must be bound by a written agreement with the same restrictions, so the contract chain reaches every organization in the processing chain.
Who handles PHI in practice
Protected health information is a form of sensitive data, and it rarely stays in one system. The groups below usually sit somewhere in that chain.
| Group | Why it handles PHI |
|---|---|
| Billing and claims processing | Prepares, codes, or submits claims as part of the work |
| Cloud and hosting services | Stores electronic PHI (ePHI) in backups, email, and applications |
| IT and managed services | Consultants, helpdesk providers, and outsourced administrators with PHI system access |
| Records handling | Transcription, coding, copying, shredding, and offsite storage |
| Professional services | Attorneys, accountants, and advisers with access to patient data |
When a BAA is required
The agreement must be in place before any PHI reaches the vendor. Whenever a service involves creating, receiving, maintaining, or transmitting PHI for a covered entity, HIPAA requires satisfactory written assurances that the vendor will safeguard the data. Sharing PHI without such an agreement is a violation in itself, even if no data is ever exposed.
Some relationships fall outside the rule. A mere conduit that passes information along without accessing it, such as an internet service provider or a courier with only momentary physical possession, does not need a BAA. Neither does a workforce member, who is covered by the employer's own obligations. The test is access: once a vendor can reasonably view, use, or store PHI, a written agreement is required.
What the agreement must contain
HIPAA prescribes the minimum content of the contract. A complete BAA establishes the points below, and each one should be checked against the vendor's actual answer, not only its template.
| Requirement | What it means | What to ask the vendor |
|---|---|---|
| Permitted uses and disclosures | Only as allowed, never for the vendor's own marketing or product development | Which purposes use the data, in writing |
| Safeguards | For ePHI, Security Rule controls: access control, audit controls, transmission security | Evidence for each control, not a promise |
| Incident and breach reporting | Report without unreasonable delay, within the contract's deadline | The exact deadline and who receives the notice |
| Subcontractor control | Same restrictions, in writing, before any data is shared | A current list of subcontractors with PHI access |
| Individual rights | Provide PHI for access or amendment, and keep disclosure records | How requests are fulfilled and logged |
| Oversight and termination | Open records to regulators; return or destroy PHI where feasible | What happens to the data when the contract ends |
Liability and enforcement
Business associates once answered only to their customers. The HITECH Act of 2009 and the 2013 Omnibus Rule changed that. Today, business associates are directly liable to regulators for many HIPAA requirements, including Security Rule safeguards and breach notification. The Office for Civil Rights at the U.S. Department of Health and Human Services enforces the rules with tiered civil monetary penalties scaled to culpability. State attorneys general may also sue on behalf of their residents.
The covered entity keeps its own duties. It must obtain written assurances before any disclosure, use reasonable diligence when choosing vendors, and notify affected individuals and the regulator when a vendor's data breach occurs. In practice, regulators often cite a missing, expired, or inadequate BAA as a standalone violation, even when no data was harmed.
Checking a vendor before signing
In modern healthcare procurement, the BAA works as a gate. Where PHI is involved, a vendor that cannot sign one is excluded from consideration. Large providers often publish a standard agreement during onboarding, and healthcare customers frequently accept those terms rather than negotiate them. A signature, however, is a promise, not evidence, so the checks below come before the contract is signed.
- 1
Map the data path
List every place the vendor would store, transmit, or view PHI, including backups and support access.
- 2
Trace the subcontractors
Ask for the list of subcontractors and confirm that each one is bound by the same written restrictions.
- 3
Confirm the breach clock
Check the reporting deadline and the named contact, so the covered entity can meet its own duties.
- 4
Ask for evidence
Request independent audit reports and a completed security questionnaire before any PHI is shared.
What it looks like in Anexet
A BAA turns into daily practice through access control. In the Anexet console, an administrator sets rights per user and per group for each rule group, separately for rules and for incidents. With on-premise deployment, captured data stays in the customer's own infrastructure, and the vendor has no access to customer data.
Where to start
Start with the data a vendor would reach, not with the contract template. A BAA defines the duties on paper, while the controls behind it decide whether those duties are met. For the safeguards on the covered entity's own side of each flow, see the entry on data loss prevention (DLP).
Reassess the vendors that hold the most sensitive data periodically. A contract is signed once, but the data flows keep changing after that.
A signed BAA records what the vendor promised. Only its controls and logs show whether the promise is kept.
Anexet Team