HIPAA Business Associate Agreement Guide
If you build SaaS for healthcare, the BAA conversation comes up constantly. From enterprise customers requiring one before signing, to your own vendors asking you to sign theirs, BAAs sit at the center of HIPAA compliance for most SaaS companies.
This guide covers what a BAA is, when one is required, what it must contain, and how to manage your BAA obligations without letting them become a bottleneck.
What a BAA Is and Why It Exists
HIPAA defines two categories of entities: covered entities (healthcare providers, health plans, clearinghouses) and business associates (vendors who handle PHI on behalf of covered entities). A business associate agreement is the contract that governs the relationship.
The BAA does three things:
- Defines the permitted uses of PHI by the business associate
- Establishes the security and privacy obligations the business associate must meet
- Sets out breach notification obligations and what happens to PHI at contract termination
Without a BAA in place, the business associate relationship is legally undefined. The covered entity faces regulatory exposure, and the business associate operates outside the HIPAA framework even if they have excellent security practices.
Who Needs a BAA
You need a BAA with every vendor that creates, receives, maintains, or transmits PHI on your behalf. The scope is broader than most teams initially map.
Definitely need BAAs:
- Cloud infrastructure providers (AWS, GCP, Azure). This applies if PHI is stored or processed on their infrastructure.
- Database-as-a-service providers
- Email delivery services used to send PHI
- Backup and storage services
- Analytics platforms that receive data including PHI
- EHR integration vendors
- Any subcontractor who accesses your systems and may encounter PHI
May need BAAs (depends on data access):
- Customer support platforms
- Error monitoring tools
- Application performance monitoring tools
- Log management services
Generally do not need BAAs:
- Courier or postal services
- Conduit services that only transport encrypted PHI without accessing it
- Financial institutions processing payment information only
When in doubt, map the data flow. If PHI can reach the vendor's systems, even incidentally, a BAA is safer than not having one.
What a HIPAA BAA Must Contain
HHS specifies required elements for BAAs. A BAA without these elements does not satisfy HIPAA.
Required provisions:
- Permitted uses and disclosures of PHI by the business associate
- Prohibition on using or disclosing PHI other than as permitted by the agreement or required by law
- Obligation to implement appropriate safeguards to prevent unauthorized use or disclosure
- Obligation to report breaches, security incidents, and unauthorized disclosures to the covered entity
- Obligation to ensure any subcontractors also have BAAs and meet the same obligations
- Access rights: obligation to provide PHI to the covered entity when requested for subject access
- Amendment rights: obligation to amend PHI in accordance with HIPAA
- Accounting of disclosures: obligation to track disclosures as required
- Obligation to return or destroy PHI at contract termination
Common optional but recommended provisions:
- Specific encryption requirements and key management standards
- Incident response timeline requirements (faster than HIPAA's 60-day minimum)
- Audit rights allowing the covered entity to verify compliance
- Cyber liability insurance requirements
- Indemnification provisions
Common BAA Mistakes SaaS Companies Make
Treating the BAA as a checkbox
Signing a BAA with a vendor does not transfer your liability. If the vendor has a breach and they were not actually implementing the required safeguards, you still face OCR scrutiny. BAAs work best when paired with vendor security assessments.
Missing subcontractors
Your cloud provider may have a BAA with you. But if your cloud provider uses subcontractors who handle your data (database management services, support vendors), those subcontractors are also business associates. Your cloud provider's BAA should flow down these obligations. Verify that it does.
No termination process for PHI
Every BAA must specify what happens to PHI when the relationship ends. "Return or destroy within 30 days of termination" is common. Make sure you have a process to fulfill this and document when you do. Terminating a vendor relationship without addressing PHI is a compliance gap.
No BAA tracking system
Companies that manage a dozen or more vendor BAAs often lose track of which BAAs are current, which have expired, and which vendors have changed their terms. A BAA registry with expiration dates and renewal reminders is table stakes for any company with meaningful HIPAA obligations.
Managing Incoming BAA Requests from Enterprise Customers
If you sell to covered entities, they will ask you to sign their BAA before they can use your product with PHI. Expect this request from every healthcare enterprise buyer.
Having a pre-signed version of your own BAA ready to send speeds up deals. Many legal teams will accept a standard BAA rather than negotiating bespoke terms, especially if yours is clearly based on the HHS model language.
Key terms that enterprise buyers often try to modify:
- Breach notification timeline (they want faster than your standard 60 days)
- Indemnification scope
- Audit rights
- Encryption standards
Decide in advance which of these you will negotiate on and which are fixed. This prevents deals from stalling on BAA negotiation.
Tracking BAA status across every subprocessor and catching renewals before obligations lapse is the kind of recurring vendor work a fractional CISO owns for you. Book a call to walk through your subprocessor list.
Related reading
Want a security leader to run this?
Xorabyte is a fractional CISO for startups who can review your cloud for the gaps found first, so a blocked deal or an audit stops being your problem to carry alone. Book a call and you will leave with a clear path, not a sales pitch.