Is a BAA required between two covered entities?

Two covered entities do not need a Business Associate Agreement (BAA) when sharing Protected Health Information (PHI) for treatment, payment, or healthcare operations in their primary roles.

When a BAA is NOT Required

• Treatment: Sharing patient charts or referring a patient to a specialist.
• Payment: Coordinating billing or claims with an insurance plan.
• Healthcare Operations: Managing quality assessment or case coordination between two providers.
• According to the HHS Guidance on Business Associates, direct patient care coordination is exempt from BAA requirements.

When a BAA IS Required Between Covered Entities

• Acting as a Vendor: If one covered entity performs a non-treatment/non-operations service on behalf of another covered entity (such as providing third-party data processing, management, or IT hosting services), a BAA is required. One covered entity can act as a business associate to another.

Yes, HIPAA requirements apply directly and strictly to Covered Entities.

Who are Covered Entities?

HIPAA rules apply to three specific groups that handle protected health information:

• Healthcare Providers: Doctors, clinics, dentists, pharmacies, and psychologists who transmit health information electronically in standard transactions.
• Health Plans: Health insurance companies, HMOs, company health plans, Medicare, and Medicaid.
• Healthcare Clearinghouses: Entities that process non-standard health data into a standard electronic format (or the reverse).

Main HIPAA Rules for Covered Entities

If an organization is a covered entity, it must follow three core federal standards:

• Privacy Rule: Controls how Protected Health Information (PHI) is used and shared, giving patients rights over their medical records.
• Security Rule: Requires technical, physical, and administrative safeguards to protect electronic health data.
• Breach Notification Rule: Demands prompt reporting of data leaks to affected individuals and the government.

A Business Associate Agreement (BAA) is legally required whenever a HIPAA-covered entity shares or gives a vendor access to Protected Health Information (PHI).

Covered Entities

You need a BAA if you are a HIPAA-covered entity that hires an outside party to handle data. Covered entities include:

• Healthcare providers (doctors, dentists, clinics, hospitals)
• Health plans (health insurance companies, HMOs)
• Healthcare clearinghouses

Business Associates (Vendors and Partners)

Any outside person or company that creates, receives, maintains, or transmits PHI on behalf of a covered entity needs to sign a BAA. Common examples include:

• Medical billing and coding companies
• Cloud hosting and data storage providers (like AWS or Dropbox)
• IT support and software vendors
• Lawyers, accountants, and consultants who access patient data
• Answering services and communication platforms

Subcontractors

• Downstream vendors: If a business associate hires another company to help perform services and that company touches PHI, a BAA is required between the business associate and the subcontractor.

Who Does NOT Need a BAA?

• Internal employees: Members of a covered entity's own workforce do not need a BAA.
• Conduits: Pure data transmitters (like the US Postal Service or standard internet service providers) that do not store the data do not need a BAA.
• Incidental contact: Workers like janitorial or cleaning services that might occasionally see data but do not handle or store PHI as part of their job duties.

Common Business Associate Agreement (BAA) mistakes include failing to execute the agreement before sharing protected health information, using outdated template language, and ignoring subcontractor compliance.

A Business Associate Agreement is a legally binding contract required by HIPAA between a healthcare covered entity and a vendor that handles protected health information (PHI).

Critical BAA Mistakes

• Operating Without a Signed BAA: Sharing or allowing a vendor to access PHI before a BAA is fully executed is an immediate standalone HIPAA violation, even if no data breach ever occurs.
• Using Outdated or Generic Templates: Relying on old or generic contract templates that do not reflect current HIPAA Omnibus Rule standards or modern cloud infrastructure creates major legal blind spots.
• Ignoring Subcontractor Oversight: Failing to require your vendors to secure matching BAAs from their own subcontractors leaves your organization exposed to third-party compliance gaps.
• Accepting Vendor-Provided BAAs Blindly: Signing a vendor's standard template without legal review often means agreeing to unfavorable terms, such as improper indemnification clauses that flip breach liabilities back onto your practice.
• Mismatched Scope and Features: Assuming a broad BAA covers every product tool when the agreement explicitly excludes auxiliary features like artificial intelligence assistants, free trials, or sandbox testing environments.
• Vague Breach Notification Timelines: Leaving breach reporting windows undefined or extending them past legal expectations delays emergency response and violates compliance requirements.

You can review a comprehensive overview of requirements on the OGC Business Associate Agreement Guide.

Yes, business associates are required to notify covered entities if a breach of unsecured protected health information (PHI) occurs.

Under the HIPAA Breach Notification Rule, business associates must follow specific guidelines when a data breach happens:

Notification Timeline

• Without unreasonable delay: Notice must be sent as soon as possible.
• Maximum 60 days: The notification must be provided no later than 60 calendar days after discovering the breach.
• Date of discovery: A breach is considered discovered on the first day the business associate knew about it, or should have known about it through reasonable diligence.

Required Information

To the extent possible, the business associate must provide the covered entity with:

• The identity of each individual whose unsecured PHI was breached or suspected of being breached.
• Any other available details the covered entity needs to include in its own notifications to the affected individuals, the government, or the media.

(Note: While the business associate must alert the covered entity, the responsibility for notifying the affected individuals, the U.S. Department of Health & Human Services, and sometimes the media typically falls on the covered entity itself, unless specified otherwise or if the business associate acts as an agent.)

You can review the official requirements directly on the HHS Breach Notification Rule Guide.