Does Cerner (Oracle Health) Sign a HIPAA Business Associate Agreement?
By BAA Generator Research Team · Published Apr 19, 2026 · Last reviewed Apr 19, 2026 · 3 min read
Key Takeaways
- ✓ Yes — Cerner (now Oracle Health) includes HIPAA BAA provisions in its standard implementation agreements
- ✓ Oracle acquired Cerner in 2022; the product is now marketed as Oracle Health
- ✓ Confirm BAA language is present in your current agreement before go-live
- ✓ Third-party integrations (FHIR API, HL7) each require separate BAA evaluation
Cerner Is Now Oracle Health
Oracle completed its acquisition of Cerner in June 2022 for approximately $28.3 billion. Following the acquisition, Cerner's EHR products have been progressively rebranded under the "Oracle Health" umbrella. Key implications for HIPAA compliance:
- Existing Cerner contracts: Your pre-acquisition Cerner BAA remains in effect. Review for any novation or assignment clauses related to the Oracle acquisition.
- New implementations: New contracts are executed with Oracle Health / Oracle Corporation. Confirm BAA language is included in Oracle Health agreements.
- Product evolution: Oracle has been integrating Cerner with Oracle Cloud Infrastructure. If your data moves to Oracle Cloud environments, confirm those are also covered under the BAA.
What Oracle Health's BAA Covers
Oracle Health's HIPAA BAA covers the core services provided under the implementation agreement:
- Oracle Health EHR (formerly Cerner Millennium) clinical documentation and patient records
- Oracle Health hosted/managed services for the EHR platform
- Oracle Health maintenance, support, and managed services
- PowerChart and other Oracle Health clinical applications
Third-Party Integrations: What Is Not Covered
A significant compliance consideration for Oracle Health / Cerner customers is the scope of the BAA relative to third-party integrations.
| Integration Type | Covered by Oracle Health BAA? | Action Required |
|---|---|---|
| Oracle Health core EHR | Yes | Confirm BAA language in your contract |
| Oracle Health managed hosting | Yes | Covered under Oracle Health BAA |
| Cerner FHIR API partners | No | Each connecting application needs its own BAA |
| HL7 interface partners | No | Each integration partner needs its own BAA |
| Oracle Cloud (OCI) infrastructure | Verify separately | Oracle Cloud has its own HIPAA compliance program; confirm coverage |
| Third-party analytics tools | No | Separate BAA required for each analytics vendor |
Post-Acquisition BAA Considerations
When a vendor you have a BAA with is acquired, the BAA may technically remain in force through successor-in-interest provisions. However, best practice is to review your Oracle Health agreement and confirm:
- Is the BAA still explicitly referenced and in force in your current contract?
- Has Oracle Health issued any updated BAA language as part of the transition?
- If your EHR is being migrated to Oracle Cloud Infrastructure, is the cloud environment covered under the BAA?
- Are there any new subcontractors or hosting partners introduced by Oracle that need to be disclosed under the BAA?
When in doubt, request a current BAA addendum directly from your Oracle Health account manager.
Frequently Asked Questions
Does Cerner sign a HIPAA BAA?
Yes — Cerner (now Oracle Health) includes HIPAA BAA provisions in its standard EHR implementation agreements. Review your current contract to confirm the BAA language is present.
Is Cerner now Oracle Health?
Yes — Oracle completed the acquisition of Cerner in June 2022. The product is now marketed as Oracle Health. Existing Cerner agreements generally carry over, but verify BAA provisions remain current with your Oracle Health account manager.
Do Cerner third-party integrations need their own BAA?
Yes — Oracle Health's BAA covers only Oracle Health's services. Every third-party app connecting to Oracle Health via FHIR API, HL7, or other integration requires its own independent BAA.
For a broader look at which vendors sign HIPAA BAAs, see our vendor BAA lookup guide.
More vendor BAA guides
Generate a compliant BAA in 5 minutes
HHS model BAA provisions · 45 CFR § 164.504(e) compliant · clean PDF + editable Word
No subscription · PDF + Word · Free watermarked preview
Related: EHR & practice management