HIPAA BAAs: What Your Practice Must Know in 2026

Your EHR vendor suffers a data breach. Patient records from 3,000 visits are exposed — names, diagnoses, Social Security numbers. The vendor's security was weak, but your practice is named in the breach notification. The OCR investigation lands on your desk.

First question the investigator asks: "Can I see your Business Associate Agreement with this vendor?"

If you do not have one — or if it is outdated, incomplete, or missing key provisions — your practice is liable. Not the vendor. You. That is the reality of HIPAA's Business Associate Agreement requirement, and it catches small practices off guard every year.

What Is a Business Associate Agreement?

A Business Associate Agreement (BAA) is a legal contract between your practice (the "covered entity") and any company that creates, receives, stores, or transmits protected health information (PHI) on your behalf. HIPAA requires this contract before you share any patient data with that company.

The BAA does three critical things:

• Defines what PHI the vendor can access and exactly how they can use it
• Requires the vendor to protect PHI with specific administrative, physical, and technical safeguards
• Makes the vendor legally liable for breaches on their end — and obligates them to notify you within a defined timeframe

Without a BAA, your vendor has no legal obligation to protect patient data under HIPAA. And if they mishandle it, the penalties fall on your practice for sharing PHI without a proper agreement.

Who Counts as a Business Associate?

This is where most practices undercount. A business associate is any person or organization — other than your own workforce — that performs a function involving PHI. The list is longer than you think:

Technology vendors:

• EHR/EMR providers (Epic, athenahealth, eClinicalWorks, DrChrono)
• Cloud hosting providers (AWS, Azure, Google Cloud) if they store PHI
• Email providers (Microsoft 365, Google Workspace, Paubox)
• Practice management software
• Telehealth platforms
• Patient scheduling tools
• AI receptionist services
• Backup and disaster recovery providers

Service providers:

• Medical billing companies
• Medical transcription services
• IT support and managed IT providers
• Answering services
• Shredding and document destruction companies
• Accounting firms (if they access billing records with PHI)
• Law firms (if they access PHI for legal matters)
• Consultants who perform HIPAA risk assessments

Often overlooked:

• Cloud fax services
• Patient survey platforms
• Website hosting providers (if patient forms collect PHI)
• Data analytics companies
• Collection agencies

A 10-provider practice typically has 15 to 25 business associates. A 2023 KLAS Research survey found that the average healthcare organization manages 1,320 vendor relationships — but most small practices have no formal inventory.

What a BAA Must Include

HIPAA specifies required provisions. A BAA that is missing any of these is not compliant — even if both parties signed it:

1. Permitted uses and disclosures. The BAA must specify exactly what the business associate can do with PHI. Vague language like "for business purposes" is not sufficient. The agreement should list the specific functions the vendor performs and limit PHI use to those functions.

2. Safeguard requirements. The vendor must agree to implement administrative, physical, and technical safeguards that "reasonably and appropriately" protect PHI. This includes multi-factor authentication, encryption, access controls, and audit logging.

3. Breach notification obligations. The BAA must require the vendor to notify your practice of any breach of unsecured PHI "without unreasonable delay" — and no later than 60 days after discovery. Best practice: negotiate for 30 days or fewer.

4. Subcontractor requirements. If your vendor uses subcontractors who access PHI (and they almost certainly do), the BAA must require the vendor to have BAAs with those subcontractors. This creates a chain of accountability.

5. Individual rights support. The vendor must make PHI available to your practice so you can fulfill patient access requests. Under HIPAA, patients have the right to access their records within 30 days — your vendor cannot be the bottleneck.

6. Audit and accounting rights. Your practice must be able to request that the vendor make its internal practices and records available to HHS for compliance audits. The BAA should also require the vendor to provide an accounting of disclosures.

7. Return or destruction of PHI. When the contract ends, the vendor must return or destroy all PHI. If destruction is not feasible (e.g., backup tapes), the BAA must extend protections to retained data indefinitely.

8. Termination provisions. The BAA must allow your practice to terminate the agreement if the vendor violates a material term. This is your enforcement mechanism.

The 2026 HIPAA Security Rule and BAAs

The proposed 2026 HIPAA Security Rule update includes changes that directly affect BAAs:

Mandatory technology asset inventory. Business associates will be required to maintain a complete inventory of all technology assets that store or transmit PHI — and provide this inventory to covered entities upon request. Your vendors will need to document every server, database, application, and device that touches your patient data.

72-hour notification for security incidents. The proposed rule tightens the breach notification window. Business associates would need to notify covered entities within 24 hours of activating their contingency plan — and restore critical systems within 72 hours. Current BAAs with 60-day notification windows will need to be updated.

Annual compliance verification. Business associates would be required to verify their compliance with HIPAA security requirements at least annually — and provide written verification to covered entities. This means your vendors will need to prove their compliance to you every year, not just promise it at contract signing.

Encryption becomes mandatory. The proposed rule eliminates the "addressable" classification for encryption. All PHI must be encrypted at rest and in transit — no exceptions. BAAs should already require encryption, but this closes the loophole that allowed vendors to document why they chose not to encrypt.

Even before the final rule takes effect, updating your BAAs now positions your practice ahead of enforcement.

Common BAA Mistakes That Create Liability

No BAA exists. The most common and most expensive mistake. In 2024, Inmediata Health Group paid $250,000 in a settlement where the absence of BAAs with multiple vendors was a primary finding. HHS does not accept "we forgot" or "the vendor said they were compliant" as defenses.

Using a template without customization. Generic BAA templates from the internet often miss provisions required for your specific vendor relationship. A BAA with your cloud hosting provider should include different terms than one with your billing company. The permitted uses, the types of PHI accessed, and the safeguard requirements differ for each relationship.

Not tracking BAA expiration dates. BAAs should be reviewed and renewed annually — or whenever the vendor relationship changes. A BAA signed in 2019 may not cover new services the vendor has added, new subcontractors they use, or new regulatory requirements.

Confusing a BAA with a Terms of Service. A vendor's standard terms of service are not a BAA. Even if the terms mention "HIPAA" or "security," they typically do not include the specific provisions HIPAA requires. You need a separate, signed BAA document — or the vendor must explicitly incorporate BAA terms into their service agreement with clear HIPAA-specific language.

Not verifying subcontractor BAAs. Your EHR vendor uses AWS for hosting. Your billing company uses a clearinghouse. Your email provider uses a third-party spam filter. Each of these subcontractors needs a BAA with your vendor. If they do not have one, the chain of protection breaks — and your practice is exposed.

No breach notification timeline. If your BAA does not specify a notification deadline, the vendor technically has 60 days under HIPAA's default — two full months before you even know your patients' data was exposed. Negotiate for 10 to 30 days maximum.

Penalties for BAA Violations

OCR treats missing or deficient BAAs as a risk analysis failure — one of the most frequently cited violations in enforcement actions. Recent penalties that involved BAA issues:

• North Memorial Health Care ($1.55 million): Failed to execute a BAA with a major contractor who had access to 289,904 patient records
• Care New England ($400,000): Used a business associate without a compliant BAA in place
• Raleigh Orthopaedic Clinic ($750,000): Failed to execute a BAA before sharing PHI with a vendor who experienced a breach
• Advanced Care Hospitalists ($500,000): No BAA with a medical billing company that accessed PHI for over 8,000 patients

The pattern is clear: OCR pursues practices that share PHI without proper agreements, regardless of whether a breach actually occurred. The absence of a BAA is itself a violation.

BAA Checklist for Your Practice

Use this checklist to audit your current BAA coverage:

Inventory phase (week 1):

1. List every vendor, contractor, and service provider who touches PHI
2. Include technology vendors, billing companies, IT providers, and less obvious partners (shredding, answering services, consultants)
3. Note what type of PHI each vendor accesses (demographic, clinical, billing, imaging)

Review phase (week 2):

1. For each vendor, confirm a signed BAA exists
2. Check that each BAA includes all 8 required provisions listed above
3. Verify breach notification timelines (aim for 30 days or less)
4. Confirm subcontractor provisions are included
5. Check expiration dates — flag any BAA older than 2 years for renewal

Remediation phase (week 3-4):

1. Request BAAs from vendors who do not have one on file
2. Negotiate updated terms for BAAs with weak provisions
3. Create a tracking spreadsheet with vendor name, BAA date, expiration, and renewal reminder
4. Set calendar reminders for annual BAA reviews

If a vendor refuses to sign a BAA, you have two options: find a different vendor, or stop sharing PHI with them. There is no third option under HIPAA.

How Your IT Provider Helps With BAAs

A qualified healthcare IT provider manages BAA compliance as part of their service. Here is what to expect:

Vendor inventory management. Your IT provider maintains a complete list of all technology vendors who access PHI through your systems. They know about the cloud services, integrations, and third-party tools that office managers often miss.

BAA tracking and renewal. Automated tracking of BAA status, expiration dates, and renewal cycles. You get alerts before agreements lapse — not after a breach reveals the gap.

Technical verification. Your IT provider can verify that vendors actually implement the safeguards their BAAs promise. A vendor can sign a BAA claiming they encrypt data — but are they actually doing it? Technical audits confirm compliance.

Subcontractor mapping. IT providers understand the technology supply chain. They can identify which subcontractors your vendors use and verify that BAAs exist at every level.

BAA management is one component of a comprehensive HIPAA compliance program. Combined with a current risk assessment, staff training, and technical safeguards, it forms the foundation of defensible compliance.

The Bottom Line

A BAA is not paperwork. It is your legal protection when a vendor mishandles patient data. Without one, your practice absorbs the full liability — the penalties, the breach notification costs, the legal fees, and the patient trust you spent years building.

If you have not audited your BAAs in the past 12 months, start this week. The proposed 2026 rule changes will make vendor compliance verification mandatory. Getting ahead of that requirement is cheaper than catching up under enforcement.

Book a free IT assessment and we will audit your vendor relationships, identify BAA gaps, and help you build a tracking system that keeps your practice compliant year-round. Or explore our HIPAA compliance services to see how we manage the full compliance picture for practices like yours.