Will you sign a Business Associate Agreement?

Under HIPAA, any vendor that creates, receives, maintains, or transmits protected health information on your behalf is a business associate, and that includes an IT provider with administrative access to the systems your patient data lives on. A signed BAA is required, not a courtesy, and it has to be in place before access is granted rather than added later.

We sign one with every covered entity we work with, and we can provide our standard agreement for your review or work from yours. It defines what we may access, our safeguards, our breach notification obligations to you and the timeline for them, and what happens to any of your data in our possession when the relationship ends.

Two things worth knowing. A BAA does not transfer your liability. You remain the covered entity and the obligation stays yours, which is why the quality of the underlying work matters more than the paperwork. And you need BAAs with your other vendors too, not only with us: your practice software vendor, your imaging cloud, your patient communication platform, your backup provider, your shredding company. We will help you inventory who needs one, because most practices have gaps there.