Urgent Care Clinics

HIPAA Business Associate Agreement for Urgent Care Clinics

Q: Are urgent care clinics HIPAA covered entities?

Yes. Urgent care clinics are healthcare providers under HIPAA and covered entities when they transmit health information electronically in connection with standard transactions such as insurance claims. As covered entities, they must execute Business Associate Agreements with every vendor that creates, receives, maintains, or transmits protected health information on their behalf, under 45 CFR § 164.504(e).

Q: Do urgent care occupational health services require BAAs?

Yes. Urgent care clinics that provide occupational health services — pre-employment physicals, drug testing, workers' compensation injury care, employer-mandated surveillance — often share results with employers. While workers' compensation records have different privacy rules than standard HIPAA PHI, the occupational health EHR software and billing vendors used to manage these records still require BAAs because the same platforms typically handle both occupational and direct-care patient records.

Q: What urgent care billing companies require BAAs?

Any billing company or revenue cycle management vendor that processes urgent care claims — regardless of whether those claims are for direct patient care or occupational health — must sign a BAA with your clinic before receiving patient data. This applies to companies that specialize in urgent care billing such as Experity's revenue cycle services, as well as general medical billing companies.

By BAA Generator Editorial · Updated Apr 19, 2026 · 5 min read

Key Takeaways

✓ Urgent care clinics are HIPAA covered entities — BAAs required for all PHI-handling vendors
✓ Occupational health software and employer-reporting systems require BAAs regardless of different privacy rules
✓ Check-in kiosks that collect patient data are business associates and require BAAs
✓ Lab interfaces and imaging storage systems require BAAs when they store or transmit PHI

Direct answer: Yes — urgent care clinics are HIPAA covered entities. You must sign Business Associate Agreements with your EHR, billing company, check-in kiosk vendor, imaging storage platform, and lab interface providers. Clinics offering occupational health services have an additional layer of complexity, but BAAs are required for all PHI-handling vendors regardless of whether the records are for direct care or occupational health.

Urgent care clinics handle a broad patient population — walk-in direct care patients and employer-referred occupational health patients — and operate a complex vendor stack including EHR, billing, kiosk check-in, imaging, and lab systems. The combination of direct patient care and occupational health services creates unique HIPAA compliance questions that other practices don't face.

Why Urgent Care Clinics Are Covered Entities

Urgent care clinics are healthcare providers under HIPAA. Those that transmit health information electronically in connection with covered transactions — primarily insurance claim submissions — are covered entities subject to the full HIPAA Privacy and Security Rules.

This applies to:

Independent urgent care clinics
Multi-location urgent care chains
Urgent care clinics operating as occupational health providers
Hospital-affiliated or health system urgent care locations

The Occupational Health Complexity

Many urgent care clinics serve employers through occupational health programs — pre-employment physicals, drug screening, workers' compensation injury treatment, and OSHA-mandated surveillance exams. Workers' compensation records have different privacy rules than standard HIPAA PHI: they can be disclosed to employers for purposes related to the injury claim, which differs from standard HIPAA treatment-operations-payment permissions.

However, this distinction does not eliminate BAA requirements. The EHR, billing software, and occupational health platforms that store and transmit these records still require BAAs because:

The same platform typically handles both direct-care and occupational health records
The records remain PHI under HIPAA until specific exceptions apply
Vendor access to the data is what triggers the BAA requirement, not the ultimate disclosure destination

See our guide on when a HIPAA BAA is required for the full framework.

Vendors Urgent Care Clinics Typically Need BAAs With

Urgent Care EHR and Practice Management

Experity (formerly DocuTAP and Practice Velocity), Charm Health, and similar urgent care-specific EHR platforms hold the core of your patient records. All provide BAAs. Confirm that signed BAAs are in place and on file for each platform relationship, including any telemedicine modules that may be separately contracted.

Occupational Health Software

Occupational health management platforms that track employer accounts, manage drug testing workflows, and store employer-facing reports handle PHI as part of their operation. If you use a separate occupational health module or standalone system, that vendor requires a BAA in addition to your main EHR vendor.

Check-In Kiosk Vendors

Patient self-check-in kiosks that collect name, date of birth, chief complaint, and insurance information capture PHI from the moment a patient interacts with the device. Kiosk vendors whose systems transmit this data to your EHR or store it locally require BAAs. Many kiosk systems integrate directly with EHRs — verify whether the EHR vendor's BAA covers the kiosk integration or whether the kiosk vendor requires a separate BAA.

Imaging and X-Ray Storage

Digital X-ray systems and ultrasound platforms with cloud storage components require BAAs with the software or cloud storage vendor. Urgent care imaging is typically straightforward (extremity X-rays, chest films) but the storage infrastructure vendor must have a signed BAA if images are stored remotely.

Lab Interfaces

Interface vendors or middleware that transmits lab orders and results between your EHR and reference labs (Quest, LabCorp) are business associates if they receive patient-identifying information as part of the data exchange. Review your lab ordering workflow to identify any middleware vendors that require BAAs. See our checklist on whether your vendor signs BAAs.

Billing and RCM

Billing companies specializing in urgent care (including Experity's RCM services), clearinghouses, and general medical billing vendors that process your claims handle PHI and require BAAs before you share any patient data.

Vendor Type	Example Vendors	BAA Required?
Urgent care EHR	Experity, Charm Health, Caliber	Yes
Occupational health software	Occupational health modules, OHM	Yes
Check-in kiosk	Solv, Phreesia, Clearwave	Yes
Imaging / X-ray storage	Ambra, Intelerad, Nanox.cloud	Yes (cloud component)
Lab interface / middleware	Mirth Connect, Rhapsody (vendor dependent)	Yes (typically)
Billing / RCM	Experity RCM, outsourced billing companies	Yes
IT support / MSP	Local or remote IT provider	Yes

Generate a BAA for your urgent care clinic

Create a HIPAA-compliant Business Associate Agreement for your billing company, software vendor, or IT provider — free to start, no subscription required.

Generate BAA for Free →

Frequently Asked Questions

Are urgent care clinics HIPAA covered entities?

Yes. Urgent care clinics are healthcare providers and covered entities under HIPAA when they transmit health information electronically in connection with insurance claims. They must execute BAAs with every vendor that creates, receives, maintains, or transmits PHI on their behalf under 45 CFR § 164.504(e).

Do urgent care occupational health services require BAAs?

Yes. Even though workers' compensation records have some different disclosure rules, the EHR software, occupational health platforms, and billing vendors that handle these records still require BAAs because they access PHI as part of their service. The different disclosure rules govern what you can share with employers — they don't eliminate vendor BAA requirements.

What urgent care billing companies require BAAs?

All urgent care billing companies require BAAs before you share any patient claim data. This includes Experity's RCM services and general medical billing companies. The BAA must be signed and on file before the billing company processes its first claim.

Does a check-in kiosk at urgent care require a BAA?

Yes, if the kiosk captures or transmits patient information. Check-in kiosk vendors whose systems handle patient-identifying data are business associates. Verify whether your EHR vendor's BAA covers integrated kiosk components, or whether the kiosk vendor requires a separate BAA.