Monsters Ate My BAA: Who Needs a Business Associate Agreement?

Ten vendors stand on the street, and breach monsters walk in from both ends. Each monster heads for the nearest vendor you have not dealt with yet. Your job is to reach every vendor first and make the call: does this vendor need a business associate agreement, or not?

• Move with the arrow keys. On a phone, use the on-screen buttons.
• Talk: press Space next to a vendor. Then press Left for "needs a BAA" or Right for "no BAA." The monsters wait while you think.
• Defend: Space also squirts safeguards at the monsters. Two hits stop one.
• Score: a right call earns 500 points, a wrong call costs 200, each monster stopped adds 100, and each heart you still have at the end adds 250. You start with four hearts.
• Lose a vendor: if a monster reaches a vendor before you do, that vendor counts as missed.
• Win: decide all ten. Eight or more right calls and the street is covered. Every answer shows the reason and the rule it comes from.

The game is built on one question every practice has to answer for each outside company it works with: does this vendor create, receive, maintain, or transmit PHI for us? If yes, a signed BAA has to be in place before the vendor touches that data. The ten vendors in the game, and the right call for each:

• Billing service: needs a BAA. Billing on your behalf with PHI is named in the definition.
• Cloud backup: needs a BAA. It maintains your PHI for you.
• Accountant: needs a BAA when the work involves PHI from you.
• Law firm: needs a BAA when the legal work involves PHI from you.
• IT consultant: needs a BAA when the work involves access to PHI.
• E-prescribing gateway: needs a BAA. It is named outright in the rule.
• Health information exchange: needs a BAA. Health Information Organizations are named outright.
• Referral specialist: no BAA. A provider getting PHI to treat your patient is not a business associate.
• Lab (for treatment): no BAA, for the same treatment reason.
• Your front desk: no BAA. Your own workforce members are not business associates.

The pattern to remember: outside companies doing work for you with your patients' data need a BAA; other providers treating the patient, and your own staff, do not.

Every call in the game comes from the definition of business associate in the HIPAA rules. The core of it reads:

"business associate means, with respect to a covered entity, a person who: (i) On behalf of such covered entity ... but other than in the capacity of a member of the workforce of such covered entity or arrangement, creates, receives, maintains, or transmits protected health information for a function or activity regulated by this subchapter, including claims processing or administration, ... billing, benefit management, practice management, and repricing"45 CFR 160.103, definition of business associate, paragraph (1)(i)

• A business associate handles PHI on your behalf: a billing service, a cloud backup provider, an accountant, a law firm or an IT consultant (45 CFR 160.103).
• Some are named outright, such as health information exchanges and e-prescribing gateways.
• Not business associates: another provider who gets PHI to treat your patient, and your own staff.
• Every BAA has to say what the vendor may do with PHI, require safeguards and breach reporting, and pass the same terms to subcontractors (45 CFR 164.504(e)(2)).

Read the rule and the official guidance: 45 CFR 160.103 on eCFR, 45 CFR 164.504(e) on eCFR, HHS guidance on business associates, and HHS HIPAA for Professionals.

Knowing who needs a BAA is half the job; the other half is signing one that says the right things. Get the free One Guy Consulting business associate agreement template. Under 45 CFR 164.504(e)(2), every BAA has to cover:

• What the vendor may and may not do with PHI
• Safeguards (the Security Rule for electronic PHI)
• Reporting misuse and breaches to you
• Subcontractors agreeing to the same terms
• Help with patient access, amendment, and accounting of disclosures
• Opening its books to HHS
• Returning or destroying PHI at the end
• Your right to terminate for a violation

From a real engagement

One practice had trained staff and engaged leadership, yet a vendor review found several companies touching PHI with no BAA in place; some agreements could not be found and others were never signed. The practice built a full vendor list, sorted each vendor by how much PHI it could reach, got every missing BAA signed, and set up a vendor review it can run again. Shared anonymously; read the full case study.

For full vendor guidance, read the BAA FAQ or the Vendor Management page on this site.

Who needs a Business Associate Agreement (BAA)?

Vendors that handle PHI on your behalf, such as billing services, cloud backups, accountants, law firms, and IT consultants (45 CFR 160.103).

Is my staff a business associate?

No. Your own staff providing treatment are not business associates.

What must every BAA include?

Every BAA must specify permitted uses of PHI, require safeguards and breach reporting, and flow the same terms to subcontractors (45 CFR 164.504(e)(2)).