A patient's digital intake answers can pass through a form tool, cloud hosting service, and email system before a clinician reads them, raising a business associate agreement question for every outside company that handles that information. The answer depends on what each vendor does with protected health information (PHI), not simply whether it describes itself as healthcare software.
A business associate agreement (BAA) is a contract required under HIPAA between a covered entity and a business associate, meaning a person or organization outside its workforce that performs certain functions involving PHI on its behalf. It establishes how that information may be used, disclosed, and protected. For telehealth operators, the practical task is to distinguish vendors that need an agreement from those that don't, and to understand what happens when those vendors hire subcontractors. Vendors that handle PHI on the operator's behalf sign one, such as cloud hosts, EHR and practice software, communication tools, tracking vendors that receive PHI, and advisers with access to patient records. Other treating providers, true conduits, the operator's own workforce, and services with only incidental access do not.
Vendors That Need One
A telehealth business may use several outside services to deliver a single patient encounter. Some collect medical information directly, while others store, process, or transmit it behind the scenes.
Under HHS guidance on business associates, an outside organization generally qualifies as a business associate when it creates, receives, maintains, or transmits PHI on behalf of a covered entity while performing covered functions or services.
That means the vendor's role matters more than its name or product category.
Cloud Hosting and Storage
Cloud infrastructure may store patient questionnaires, clinical records, images, appointment information, and other electronic protected health information (ePHI).
HHS specifically identifies cloud service providers that create, receive, maintain, or transmit ePHI for covered entities or business associates as examples of business associates.
A provider does not necessarily need to open patient files to qualify routinely. Maintaining electronic health information for another healthcare organization can establish the relevant relationship on its own.
For a telehealth brand, this makes it important to review cloud storage and hosting arrangements before uploading patient information.
The business should identify who provides the infrastructure, which information it handles, and whether the necessary agreement covers those services.
EHR and Practice Software
Electronic health record vendors and practice management software providers may handle PHI throughout the patient journey.
A clinical platform might maintain encounter notes, medication information, test results, patient messages, or treatment documentation. An administrative system may manage patient scheduling and billing information connected to healthcare services.
HHS lists EHR vendors and managed services providers among examples of business associates when their work involves creating, receiving, maintaining, or transmitting ePHI.
The same analysis applies to practice software that handles patient information through customer relationship management or operational workflows.
A vendor does not avoid business associate status merely because its product is marketed as an administrative tool rather than a clinical application.
For example, a customer support system that stores patient messages about prescriptions may handle information that requires HIPAA protection, even though customer support itself is not a medical treatment.
Email, Messaging, and Video
Communication platforms can become business associates when they handle PHI on behalf of a healthcare organization.
A clinical email service may store messages containing treatment questions, test results, or patient records. A messaging application may maintain conversations between clinicians and patients, while a video service may transmit information during remote consultations.
The relevant questions concern what information the service processes, whether the vendor is acting on behalf of the organization, and whether an applicable business associate agreement is in place.
Choosing a video platform therefore requires more than checking whether meetings are encrypted.
A secure feature does not replace the contractual requirements that apply when the provider qualifies as a business associate.
The organization should also consider whether connected services, such as transcription tools or meeting assistants, separately receive patient information.
Tracking and Analytics
Website analytics and advertising technologies require particular attention because they can collect information automatically.
A telehealth website may use tracking tags to measure visitor activity, advertising performance, or conversions. Depending on the page, event, and information transmitted, those tools may disclose PHI to outside providers.
HHS's guidance on online tracking technologies explains that regulated entities must have appropriate business associate arrangements with tracking vendors when those vendors receive PHI in a business associate capacity.
However, not every analytics interaction automatically involves PHI. In June 2024, a federal court vacated part of OCR's guidance concerning an IP address associated with a visit to an unauthenticated public webpage about healthcare. OCR withdrew its appeal in August 2024, so that ruling stands.
The practical distinction is whether the technology actually handles PHI under the applicable rules.
For telehealth operators, this requires examining the information sent from logged-in portals, questionnaires, appointment flows, and other pages rather than assuming every tracking script performs the same function.
Platform settings belong in that review as well. Bask Health's integrations page lists analytics connections such as Google Analytics and Segment, so a brand using them should map which connections receive patient data and which agreements cover them.
A BAA also does not independently authorize a disclosure that HIPAA otherwise prohibits. HHS also notes that a vendor meeting the business associate definition is a business associate whether or not a BAA is in place, and that signing a BAA does not by itself make a vendor one.
Consultants, Accountants, and Lawyers
Business associates are not limited to software companies.
HHS identifies accounting firms, attorneys, and consultants as possible business associates when the services they provide involve access to PHI.
For example, an accounting firm reviewing patient-level healthcare information may have a different relationship than an accountant who receives only ordinary aggregated financial reports without PHI.
Similarly, a consultant evaluating identifiable medical records may need an appropriate agreement, while a consultant working exclusively with information that is not PHI may not.
The deciding factor is the service performed and the information involved.
That is why a telehealth operator should review outside professional services alongside technology contracts, rather than treating its software subscriptions as the complete vendor inventory.
Parties That Don't Need One
HIPAA does not require a BAA with everyone who encounters patient information.
Some disclosures are permitted for treatment without a business associate relationship, while other parties are excluded because of how they work or the limited nature of their access.
Understanding these exceptions helps healthcare businesses avoid unnecessary agreements without overlooking relationships that do require them.
Other Providers Treating the Patient
HIPAA generally permits a covered entity to disclose PHI to another healthcare provider for treatment without entering into a BAA with that treating provider.
HHS gives the example of a hospital sending a patient's medical chart to a specialist for treatment purposes.
The receiving specialist uses the information to provide healthcare, not to perform an administrative service on behalf of the hospital as a business associate.
For telehealth operations, this distinction can matter when clinicians refer patients to another provider or coordinate treatment across organizations.
However, not every relationship involving a pharmacy, laboratory, or outside clinical organization has the same legal structure. Operators should have counsel assess those arrangements according to the services performed and applicable HIPAA rules.
The treatment exception should not be applied automatically to every company operating somewhere in the clinical workflow.
True Conduits
Some organizations transmit information without functioning as business associates.
HHS identifies the U.S. Postal Service and certain private couriers as examples of entities that may fall within the conduit exception.
The exception is narrow and depends on the organization's limited role in transporting information.
A service that regularly accesses PHI to perform a business function generally cannot claim to be a conduit merely because it also moves data between systems.
This distinction matters for digital healthcare companies because the same product can handle message transmission and ongoing information management.
The relevant issue is what the service actually does with the information, not whether it describes itself as a delivery channel.
Your Own Workforce
Members of a covered entity's workforce are excluded from the definition of business associate.
HIPAA defines workforce broadly enough to include employees, volunteers, trainees, and certain other individuals whose conduct the organization directly controls while they perform work.
That means an employee handling patient records does not need a separate BAA simply to perform their assigned duties.
However, the organization still needs appropriate workforce privacy and security safeguards, including access management, training, and policies governing PHI.
Platform features can support that work but not replace it. Bask Health's security page lists two-factor authentication among its controls, yet deciding which team members can open patient records, and removing that access when roles change, stays with the brand.
An outside contractor should not automatically be treated as workforce merely because the organization gives that person a login. The nature of the relationship and the organization's control over the work determine the appropriate classification.
Services With Only Incidental Access
Some service providers may encounter PHI incidentally without performing functions that require access to it.
HHS gives janitorial and electrical services as examples of arrangements that typically do not create business associate relationships when access to PHI is incidental.
A maintenance worker entering an office where patient information is present is not necessarily performing a healthcare information service.
The distinction changes when the service itself requires access to protected information.
For example, a technician hired to work on devices containing patient records may qualify as a business associate if the contracted work involves disclosure of that information.
Organizations should therefore evaluate whether access to PHI is incidental to the service or necessary for the service being provided.
Subcontractors Down the Chain
A telehealth business may contract with one primary vendor while that vendor relies on several other companies to deliver its services.
For example, a patient communication platform may use separate infrastructure for hosting, data storage, or other functions involving ePHI.
HIPAA extends business associate responsibilities through that subcontractor chain.
When a business associate engages a subcontractor to create, receive, maintain, or transmit PHI on its behalf, the business associate must establish an appropriate agreement with that subcontractor before disclosing the information.
The agreement must place applicable restrictions and safeguards on the subcontractor, reflecting the obligations imposed on the business associate.
The covered entity generally does not need to sign a separate BAA directly with its business associate's subcontractors.
Instead, the contractual relationship follows the chain of services:
- Covered entity and business associate: The covered entity establishes an appropriate agreement with its direct business associate.
- Business associate and subcontractor: The business associate establishes the required agreement with its subcontractor.
- Further subcontractors: Applicable business associate requirements continue through additional subcontracting relationships.
A business associate also has responsibilities when it knows about a pattern of material violations by a subcontractor.
It must take reasonable steps to address the problem and, when those efforts fail, terminate the agreement if termination is feasible.
For a telehealth brand, the subcontractor structure is a reason to ask vendors how they manage outside service providers that handle patient information.
The brand does not necessarily need to negotiate separate contracts with every subcontractor. Still, it should understand that its direct vendor's BAA obligations extend beyond the vendor's own employees and systems.
Platform choice also affects how many direct vendor relationships a brand has to track. Bask Health's telehealth infrastructure brings video visits, chat, secure patient portals, EMR functionality, e-prescribing tools, pharmacy fulfillment, and payment processing into one platform, which can reduce the number of separate vendors handling PHI in a workflow. Each outside organization that handles PHI still needs to be evaluated based on its role, and the brand remains responsible for understanding its vendor relationships and maintaining applicable agreements.
What a Business Associate Agreement Has to Say
A BAA is not simply a confidentiality promise. HIPAA requires specific provisions defining the business associate's obligations.
HHS publishes sample business associate agreement provisions that organizations can use when developing their contracts.
The required terms address several areas:
- Permitted uses and disclosures: Specify what PHI the business associate may use or disclose and for which purposes.
- Restrictions on further disclosure: Prohibit uses or disclosures beyond those permitted by the agreement or required by law.
- Privacy and security safeguards: Require applicable safeguards and compliance with relevant Security Rule provisions, including appropriate subcontractor obligations.
- Incident and breach reporting: Require reporting of unauthorized uses or disclosures and security incidents, including breaches of unsecured PHI, as applicable.
- Support for HIPAA obligations: Address necessary assistance with access, amendments, accountings, and Privacy Rule duties performed on behalf of the covered entity.
- Government access: Make relevant internal practices, books, and records available to HHS for determining compliance.
- Subcontractor restrictions: Require subcontractors handling PHI to agree to applicable restrictions and conditions.
- Return or destruction of PHI: Require return or destruction of PHI when the relationship ends, if feasible, with appropriate protections when it is not feasible.
- Termination: Authorize the covered entity to terminate the agreement if the business associate violates a material contractual term.
HHS explains that its published provisions are samples rather than mandatory wording. Organizations may adapt the language to reflect their business arrangements, and using the sample alone does not necessarily satisfy every applicable contractual requirement.
The agreement should fit the actual services and information flows, including what happens to PHI when the relationship ends. These provisions matter most when a telehealth business changes vendors, migrates records, or discontinues a service.
Vendor reviews may also become more formal. Under HHS's proposed Security Rule update, business associates would have to verify to their covered entities at least once every 12 months, through a written analysis and certification, that required technical safeguards are in place. The proposal has not been finalized, but a telehealth brand can already ask vendors how they would provide that verification.
FAQs
Is a BAA the Same as an NDA?
No. A business associate agreement is a HIPAA-required contractual arrangement when the business associate rules apply.
It must include specific provisions governing protected health information, such as permitted uses and disclosures, safeguards, incident reporting, and return or destruction of PHI when the agreement ends.
An ordinary nondisclosure agreement does not automatically satisfy those requirements.
Does HHS Have a Business Associate Agreement Template?
Yes. HHS publishes sample business associate agreement provisions that organizations may use when preparing their contracts.
The sample language is not mandatory and can be modified to reflect the services and relationship involved. HHS also cautions that the provisions alone may not address every requirement for a valid contract under applicable state law.
What Happens If You Don't Have a BAA?
The covered entity can face enforcement for disclosing PHI without the required agreement. In 2016, North Memorial Health Care of Minnesota paid HHS $1.55 million and agreed to a corrective action plan after disclosing the PHI of roughly 290,000 individuals to a contractor, Accretive Health, without a business associate agreement in place. HHS also cited its failure to complete an organization-wide risk analysis.
The vendor carries its own exposure. A business associate is directly liable for certain HIPAA requirements, including the Security Rule, based on the work it performs, whether or not a BAA was signed.
References
- U.S. Department of Health and Human Services. (n.d.). Business associates. https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/business-associates/index.html
- U.S. Department of Health and Human Services. (2013). Business associate contracts: Sample business associate agreement provisions. https://www.hhs.gov/hipaa/for-professionals/covered-entities/sample-business-associate-agreement-provisions/index.html
- U.S. Department of Health and Human Services. (2024). Use of online tracking technologies by HIPAA covered entities and business associates. https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/hipaa-online-tracking/index.html
