News
Aesto Health AWS Breach Hits HHS Portal at 9.54 Million Patients Across 30 Provider Clients, Including Everside Health · Data BreachTheGentlemen Ransomware Group Threatens Nutex Health's 27-Hospital Network; Class Action Filed Days After SEC Disclosure · Data BreachOCR Settles with California Eye Care Provider Azul Vision for Failure to Provide Timely Patient Record Access — 55th Right of Access Enforcement Action · OCR EnforcementShinyHunters Claims Leak of 7.1 Million Baxter International Salesforce Records Including Patient PII · Data BreachCareCloud EHR Vendor Breach Exposes Medical and Financial Data of 345,000 Patients · Data BreachOptalis Management Solutions and Other HIPAA-Regulated Entities Disclose Patient Data Breaches Affecting Thousands · Data BreachFive Small Healthcare Organizations Disclose Patient Data Breaches: Family Medical Associates of Raleigh, Arkansas Oral & Maxillofacial Surgeons, Alpine Agency of the Midlands, Princeton Family Eye Care, and Others · Data BreachAesto Health AWS Breach Hits HHS Portal at 9.54 Million Patients Across 30 Provider Clients, Including Everside Health · Data BreachTheGentlemen Ransomware Group Threatens Nutex Health's 27-Hospital Network; Class Action Filed Days After SEC Disclosure · Data BreachOCR Settles with California Eye Care Provider Azul Vision for Failure to Provide Timely Patient Record Access — 55th Right of Access Enforcement Action · OCR EnforcementShinyHunters Claims Leak of 7.1 Million Baxter International Salesforce Records Including Patient PII · Data BreachCareCloud EHR Vendor Breach Exposes Medical and Financial Data of 345,000 Patients · Data BreachOptalis Management Solutions and Other HIPAA-Regulated Entities Disclose Patient Data Breaches Affecting Thousands · Data BreachFive Small Healthcare Organizations Disclose Patient Data Breaches: Family Medical Associates of Raleigh, Arkansas Oral & Maxillofacial Surgeons, Alpine Agency of the Midlands, Princeton Family Eye Care, and Others · Data Breach
Beginnerpractice managervendorfront desk

Do we need to sign anything? Business Associate Agreements explained simply

A plain-English look at BAAs, the contracts you need with vendors that touch patient information.

TL;DR

A BAA is a contract that says how a vendor will protect patient information when they work on your behalf. If they handle PHI for you, you almost always need one before the work starts.

Updated 2026-04-21

A Business Associate Agreement (BAA) sounds formal, but think of it as a safety contract: "We are trusting you with patient information, here is how you must protect it, what happens in a breach, and how we end the relationship if needed."

Who needs a BAA?

If a company creates, receives, maintains, or transmits patient information for your practice, not just sells you paperclips, you probably need a BAA.

Common examples: EHR hosting, billing services, cloud storage, IT support with server access, email services that see message content, and many telehealth platforms.

What if we skip it?

You can be out of compliance even if the vendor is great. Regulators expect paperwork that matches reality. Patients also lose clarity about who is responsible if data is mishandled.

How do you get one?

Ask the vendor. Serious healthcare vendors expect this question. They often have a standard BAA ready to sign. Read it, or have counsel read the first one, and keep a copy where you can find it.

Does the vendor's "HIPAA compliant" badge replace a BAA?

No. A badge might describe their controls, but your practice still needs the contract that spells out legal duties.

Want a deeper dive?

Our intelligence article walks through BAAs in more detail for teams negotiating terms: What is a BAA?

Keep reading

Next in your reading path → What HIPAA training does our staff actually need?

Not legal advice. Educational overview only; consult qualified counsel for your situation.