Which party requires a BAA with a covered entity to handle PHI?

Editorial team InsuredAndMore.com Published on October 27, 2026

A Business Associate (BA) is the party required to sign a Business Associate Agreement (BAA) with a covered entity to handle Protected Health Information (PHI).

Under HIPAA guidelines, a business associate is any outside individual, vendor, or third-party organization that creates, receives, maintains, or transmits PHI while performing services or functions on behalf of a covered entity.

Common examples of business associates that require a BAA include:

IT providers and cloud storage platforms (e.g., AWS, Google Cloud, Microsoft Azure)
Third-party billing companies and claims processors
Electronic Health Record (EHR) vendors
Medical transcriptionists or document shredding services
Legal, accounting, or consulting firms that require health data to perform their work

Parties that do NOT require a BAA with a covered entity:

The Covered Entity's own workforce: Regular employees, volunteers, and trainees under the direct control of the covered entity do not need a BAA.
Treating healthcare providers: A BAA is not required when a doctor or hospital shares PHI with another healthcare provider solely for treating a patient.
Mere data conduits: Services that simply transport data without routinely accessing or storing it (like the US Postal Service, UPS, or basic internet service providers) are exempt.
Subcontractors: If a business associate hires their own third-party vendor (a subcontractor) to help handle the PHI, the business associate must sign a BAA with that subcontractor. The covered entity does not sign a BAA directly with the subcontractor.

Who requires a BAA?

A Business Associate Agreement (BAA) is required by HIPAA whenever a healthcare Covered Entity shares or gives a vendor access to Protected Health Information (PHI) to perform a service on its behalf.

Covered Entities

Healthcare providers: Doctors, clinics, hospitals, and pharmacies that transmit health data electronically.
Health plans: Health insurance companies, HMOs, and company-sponsored health plans.
Healthcare clearinghouses: Entities that process nonstandard health data into standard data.

Business Associates (Vendors and Partners)

IT and cloud providers: Web hosting services, data storage, and cloud vendors.
Administrative services: Medical billing companies, accountants, and legal consultants.
Support services: Practice management companies, shredding services (if handling intact records), and consultants.

Subcontractors

Downstream vendors: Any third party hired by a Business Associate that handles or accesses PHI must also sign a subcontractor BAA.

Who Does NOT Need a BAA?

Employees and internal workforce members: Direct staff under the employer's direct control do not need a BAA.
Other treating providers: Disclosures between doctors for direct patient treatment do not require a BAA.
Mere data conduits: Internet service providers or postal carriers that just transmit data without access or storage.

Who are the covered entities that must comply with HIPAA?

Covered entities that must comply with the Health Insurance Portability and Accountability Act (HIPAA) include health plans, health care clearinghouses, and health care providers who transmit health information electronically.

Main Categories of Covered Entities

Health Care Providers: Doctors, clinics, hospitals, psychologists, dentists, chiropractors, nursing homes, and pharmacies that conduct standard electronic transactions like electronic billing or claims.
Health Plans: Health insurance companies, health maintenance organizations (HMOs), employer-sponsored group health plans, and government programs that pay for health care, such as Medicare and Medicaid.
Health Care Clearinghouses: Entities that process nonstandard health information into standard data formats, or vice versa, on behalf of other organizations (such as billing services or data processors).

Business Associates

In addition to covered entities, business associates (such as third-party vendors, cloud storage providers, and billing companies that handle protected health information) must also comply with key parts of HIPAA regulations under a written contract.

When can covered entities use PHI?

Covered entities can use or disclose Protected Health Information (PHI) without patient authorization for treatment, payment, healthcare operations, and 12 specific national priority public interest purposes.

Under the US Law on PHI Uses and Disclosures and the HIPAA Privacy Rule Summary, covered entities (such as healthcare providers, health plans, and clearinghouses) are bound by a general rule: do not use or disclose PHI unless an exception applies.

Permitted Uses Without Authorization

Treatment, Payment, and Operations (TPO): Coordinating care, billing insurers, and managing daily business tasks.
The Individual: Disclosing the data directly to the patient upon request.
Required by Law: Complying with statutes, regulations, or court orders.

The 12 National Priority Public Interest Purposes

Covered entities may share PHI without permission for specific public and legal needs:

Public Health Activities: Reporting diseases, injuries, or FDA-regulated product tracking.
Victims of Abuse or Neglect: Reporting to authorized government authorities.
Health Oversight Activities: Audits, civil investigations, or inspections.
Judicial and Administrative Proceedings: Responding to court orders or lawful subpoenas.
Law Enforcement Purposes: Identifying suspects, locating missing persons, or reporting crimes under strict limits.
Decedents and Organ Donation: Sharing information with coroners, medical examiners, or organ procurement organizations.
Research: Activities approved by an Institutional Review Board (IRB) or Privacy Board waiver.
Averting Serious Threat to Health or Safety: Preventing a serious and imminent threat to a person or the public.
Specialized Government Functions: Military, national security, or correctional facility needs.
Workers' Compensation: Complying with injury compensation laws.
Compliance Investigations: Disclosures made to the Department of Health and Human Services (HHS) for enforcement.

Who must comply with HIPAA regulations regarding PHI?

Organizations required to comply with the HIPAA Privacy Rule are known as covered entities and their business associates.

Covered Entities

The rule applies directly to three main groups that handle or transmit health information:

Health Plans: Individual and group plans that provide or pay for medical care, including health insurance companies, HMOs, company health plans, and government programs like Medicare and Medicaid.
Health Care Providers: Doctors, clinics, hospitals, psychologists, dentists, chiropractors, nursing homes, and pharmacies that transmit any health information electronically for standard transactions (such as electronic billing or insurance claims).
Health Care Clearinghouses: Entities that process nonstandard health data received from another entity into a standard electronic format (or vice versa).

Business Associates

A business associate is a person or organization (other than a member of a covered entity's workforce) that performs services or functions involving access to protected health information on behalf of a covered entity. Examples include:

Billing companies and claims processors
Cloud storage and electronic health record (EHR) vendors
IT contractors, legal counsel, and accountants
Document shredding and data destruction services

For official guidelines and definitions, visit the U.S. Department of Health and Human Services (HHS).

What Exactly Is a BAA (Business Associate Agreement)? - BAAs Explained

9 related questions found

Who requires a BAA with a covered entity to handle PHI?

A Business Associate (BA) is the party required to sign a Business Associate Agreement (BAA) with a covered entity to handle Protected Health Information (PHI).

Common examples of business associates that require a BAA include:

IT providers and cloud storage platforms (e.g., AWS, Google Cloud, Microsoft Azure)
Third-party billing companies and claims processors
Electronic Health Record (EHR) vendors
Medical transcriptionists or document shredding services
Legal, accounting, or consulting firms that require health data to perform their work

Parties that do NOT require a BAA with a covered entity:

The Covered Entity's own workforce: Regular employees, volunteers, and trainees under the direct control of the covered entity do not need a BAA.
Treating healthcare providers: A BAA is not required when a doctor or hospital shares PHI with another healthcare provider solely for treating a patient.
Mere data conduits: Services that simply transport data without routinely accessing or storing it (like the US Postal Service, UPS, or basic internet service providers) are exempt.
Subcontractors: If a business associate hires their own third-party vendor (a subcontractor) to help handle the PHI, the business associate must sign a BAA with that subcontractor. The covered entity does not sign a BAA directly with the subcontractor.

Which of the following requires a BAA?

A HIPAA Business Associate Agreement (BAA) is required whenever a covered entity shares, or allows a third-party vendor to create, receive, maintain, or transmit Protected Health Information (PHI) on its behalf.

When a BAA is Required

You must sign a BAA before any PHI is disclosed or handled in scenarios such as:

Cloud Storage & IT Services: Using cloud providers, data centers, or software-as-a-service (SaaS) tools that store or process patient data.
Billing & Practice Management: Working with outside medical billing companies, claims processors, or collection agencies.
Consultants & Legal Counsel: Hiring external legal, accounting, or consulting firms that require regular access to PHI to perform their jobs.
Subcontractors: When a business associate passes PHI to a downstream subcontractor for work related to a covered entity.

When a BAA is NOT Required

You do not need a BAA in specific situations:

Treatment Disclosures: When a healthcare provider shares PHI with another provider or health plan for direct patient treatment purposes.
Conduit Services: When using simple transmission-only services like the U.S. Postal Service or private couriers that do not routinely access the data.
Incidental Contact: With service providers (like electricians or janitors) who do not need access to PHI and whose contact with it is purely accidental.
Covered Entity Operations: Sharing data between two separate covered entities for specific joint healthcare operations.

You can review formal guidance and examples directly from the Department of Health and Human Services.

What should you do as a covered entity to protect PHI?

As a covered entity, you must implement administrative, physical, and technical safeguards under the HHS HIPAA Rules to protect Protected Health Information (PHI).

Core Safeguards and Actions

Administrative Safeguards: Conduct regular risk assessments, assign a privacy and security official, train your workforce, and limit data access based on the "minimum necessary" standard.
Physical Safeguards: Control physical access to systems and equipment containing electronic PHI (ePHI), secure workstation use, and properly shred or dispose of physical records.
Technical Safeguards: Implement access controls (such as unique user IDs and strong passwords), use encryption, and establish audit controls to track activity in electronic systems.
Business Associate Agreements: Establish written contracts with any third-party vendors or partners who handle PHI on your behalf to ensure they also comply with HIPAA standards.
Policies and Procedures: Maintain written documentation of your privacy practices, respond immediately to security incidents, and enforce disciplinary sanctions for violations.

Who is not a HIPAA covered entity?

An organization is not a HIPAA-covered entity if it is not a health care provider conducting standard electronic transactions, a health plan, or a health care clearinghouse.

According to guidelines from the Department of Health and Human Services, HIPAA rules apply strictly to covered entities and their business associates. Many organizations that handle health-related information fall outside this definition.

Common Non-Covered Entities

Employers: General human resources records, sick leave notes, and drug tests are excluded, unless the employer operates a self-funded group health plan (and even then, only the plan itself is covered).
Schools and Universities: Student health and educational records are governed by the Family Educational Rights and Privacy Act (FERPA) rather than HIPAA.
Life and Disability Insurers: Companies underwriting life, auto, liability, or disability insurance are not health plans under HIPAA.
Consumer Wellness Apps: Standalone fitness trackers, nutrition logs, and mood apps that collect user data directly do not qualify as covered entities.
Law Enforcement and Gyms: Police agencies, fitness clubs, and community groups are exempt unless they provide medical care and bill insurance.

Note: Even if an organization is not a covered entity, it may still be regulated by state privacy laws or the Federal Trade Commission's Health Breach Notification Rule.

Which segments of an organization are considered covered under HIPAA?

Under HIPAA, the segments of an organization considered covered are only those that create, receive, maintain, or transmit Protected Health Information (PHI), or that fall under specific legal definitions. You can learn more about these guidelines via the U.S. Department of Health and Human Services.

Core Covered Groups

Healthcare Providers: Doctors, clinics, hospitals, pharmacies, and psychologists who transmit health data electronically for standard transactions like billing.
Health Plans: Health insurance companies, HMOs, company group health plans, and government programs like Medicare.
Healthcare Clearinghouses: Entities that translate nonstandard health data into standard electronic formats.

Organizational Segments and Hybrid Entities

Handling PHI: Specific departments that manage patient records, billing, or direct care are directly bound by HIPAA rules.
Hybrid Structures: If an organization performs both covered and non-covered functions (like a university with a medical center and general campus), it may designate itself as a hybrid entity. In this structure, only the health care component and its supporting segments are legally covered under HIPAA.
Business Associates: External or internal auxiliary units (like IT, legal, or accounting) that touch PHI are bound as business associates via contract.