What Is a Business Associate Agreement? What Every Practice Needs Before Hiring Remote Staff
A business associate agreement is the HIPAA contract you need before any outside partner touches patient data. Here's who needs one, what it must include, and how it applies to remote staff.
If an outside company's staff can see your patients' PHI, sign a BAA before they get access. Sharing PHI without one is a HIPAA violation, even if nothing goes wrong.
In this article
A business associate agreement (BAA) is a written contract between a HIPAA-covered practice and an outside person or company that handles its patients' protected health information (PHI). It spells out how that partner can use the data, how they'll protect it, and what happens if something goes wrong. HIPAA requires one before you share PHI with a business associate.
If your practice uses a billing service, an answering service, a cloud EHR or remote staff from an outside company, you almost certainly need BAAs. Here's what they are, who needs one, what they must say, and what's at stake if you skip them.
This article is general information, not legal advice. Have your attorney review any BAA you sign.
Who is a business associate under HIPAA?
HHS defines a business associate as a person or organization, other than a member of your own workforce, that performs functions or services for you that involve access to PHI. A subcontractor that handles PHI for one of your business associates is a business associate too.
Common business associates for a medical or dental practice:
Billing and coding companies
Staffing companies that provide remote medical staff
Answering services and call centers
Cloud EHR, practice management and scheduling software vendors
IT support and data backup providers
Transcription and scribe services
Consultants, auditors and attorneys who see patient records
Your own employees aren't business associates. They're your workforce, and HIPAA covers them through your own policies and training.
What a business associate agreement must include
HHS lists ten things a BAA has to do. The agreement must:
Spell out how the business associate is allowed to use and disclose PHI.
Prohibit any other use or disclosure beyond what the contract or the law allows.
Require appropriate safeguards, including HIPAA Security Rule compliance for electronic PHI.
Require the business associate to report any improper use or disclosure, including breaches of unsecured PHI.
Require help with patients' requests to access, amend or get an accounting of their PHI.
Require Privacy Rule compliance for any of your HIPAA duties the business associate carries out.
Make the business associate's records available to HHS for compliance reviews.
Require PHI to be returned or destroyed when the contract ends, where feasible.
Require subcontractors who handle PHI to agree to the same restrictions.
Let you end the contract if the business associate violates a material term.
HHS publishes sample BAA language, but it notes that the samples alone may not make a binding contract under your state's law. That's another reason to have counsel review yours.
What happens if you don't have one
The practice pays, even when the partner made the mistake. In 2016, North Memorial Health Care in Minnesota agreed to a $1.55 million HHS settlement. An employee of its revenue cycle vendor, Accretive Health, had an unencrypted laptop with patient data stolen from their car. HHS found that North Memorial had never signed a BAA with Accretive, and had never done an accurate risk analysis that would have caught the gap.
The lesson for a small practice: the contract is part of the protection. Without it, you've shared PHI in a way HIPAA doesn't allow, no matter how trustworthy the partner is.
BAAs and remote staff: 5 questions to ask before anyone logs in
Remote staff can be every bit as safe as in-office staff, as long as the paperwork and the safeguards come first. Before a remote team member gets access to your EHR, ask the staffing provider:
Will you sign a BAA with us before access is granted?
Do your BAAs with your own subcontractors carry the same terms?
Are devices encrypted, and can they be wiped remotely if lost?
Do logins use multi-factor authentication, with access limited to what each role needs?
How quickly will you tell us about a suspected breach?
A provider of remote medical staff should answer all five without hesitating. If they can't, keep looking.
Frequently asked questions
Do I need a BAA with a remote staffing company?
In most setups, yes. If the company's staff access your patients' PHI while working for you, the company is your business associate.
Is a BAA the same as a confidentiality agreement or NDA?
No. An NDA protects business information. A BAA covers HIPAA's specific requirements for PHI, including breach reporting, safeguards and returning data when the contract ends.
Who is not a business associate?
Members of your own workforce. The term also doesn't cover a vendor that never creates, receives, keeps or sends PHI for you.
Does the business associate have HIPAA obligations too?
Yes. Business associates must comply with the HIPAA Security Rule and can be held liable directly, in addition to what the BAA requires.
Outsentia Health signs a BAA before any team member touches patient data, and builds the same safeguards into every placement. See how a HIPAA-compliant virtual assistant setup works in practice.
Sources
HHS, Business Associate Contracts: sample provisions: the business associate definition and the 10 required provisions.
Bricker Graydon, "PHI Stolen from Business Associate, but Hospital Pays $1.55 Million" (March 17, 2016): North Memorial settlement details.
Christian Beem is the co-founder of Outsentia Health, which places certified remote healthcare staff with US medical and dental practices. Christian writes about practice operations, revenue cycle and HIPAA-safe remote staffing.