When is a HIPAA BAA required?

A HIPAA Business Associate Agreement is required whenever a covered entity (healthcare provider, health plan, or clearinghouse) shares protected health information with an outside vendor or contractor that performs a service on its behalf. The trigger is PHI access combined with performing a function for the covered entity — not merely incidental contact with PHI.

What types of vendors require a BAA?

Common vendors requiring a BAA include: EHR and practice management software vendors, medical billing and coding companies, cloud storage and backup services that hold PHI, IT support firms with access to systems containing PHI, transcription and medical coding services, legal and accounting firms that review patient records, shredding services, and telehealth platform providers.

Do covered entities need BAAs with each other?

Generally no — covered entities sharing PHI with each other for treatment purposes do not need a BAA. However, if a covered entity discloses PHI to another covered entity for purposes other than treatment, payment, or health care operations, a BAA may be required. When a covered entity acts as a business associate to another covered entity (e.g., a hospital providing billing services to a physician group), a BAA is required.

Does a cleaning or maintenance vendor need to sign a BAA?

Not typically. Vendors with only incidental access to PHI — such as cleaning crews that may see records left on a desk — are generally not considered business associates. A BAA is required when the vendor performs a function that involves creating, receiving, maintaining, or transmitting PHI on the covered entity's behalf, not merely when they might encounter it by chance.

Compliance

When Do You Need a HIPAA BAA?

By BAA Generator Research Team · Published Feb 28, 2026 · Last reviewed Apr 17, 2026 · 4 min read

Need a BAA right now?

Generate my BAA → See pricing →

Need an NPP too? Most covered entities need both a BAA (with each vendor) and a Notice of Privacy Practices (for patients). See ComplyCreate's decision flowchart or generate an NPP at NPP Generator.

Key Takeaways

✓ A BAA is required when a vendor performs a service using your PHI — not just incidental contact
✓ EHR vendors, billing companies, IT support, and cloud storage all typically require BAAs
✓ Couriers, ISPs, and cleaning services generally do not require BAAs
✓ Covered-entity-to-covered-entity exchanges for treatment don't require a BAA
✓ If unsure, err on the side of executing a BAA — the cost of compliance is far less than the cost of a violation

Quick answer: A HIPAA Business Associate Agreement is required whenever a covered entity shares protected health information with an outside vendor that performs a service on its behalf — including EHR vendors, billing companies, cloud storage providers, telehealth platforms, IT support firms, and shredding services. Relationships that do not require a BAA include conduits (couriers, ISPs), covered-entity-to-covered-entity exchanges for treatment, and vendors with no PHI access.

One of the most common compliance questions in healthcare is also one of the most nuanced: when exactly does a business relationship require a HIPAA Business Associate Agreement? The answer depends on whether PHI is involved — and how.

The Trigger: Access to Protected Health Information

A BAA is required whenever a covered entity shares protected health information (PHI) with an outside party — called a business associate — that performs a function or service on its behalf. The key phrase is "on its behalf." Incidental access alone doesn't necessarily create a business associate relationship.

Under 45 CFR § 160.103, a business associate is a person or entity that:

Creates, receives, maintains, or transmits PHI for a covered entity's functions
Provides services involving the disclosure of PHI (legal, financial, administrative, etc.)
Offers a personal health record to individuals on behalf of a covered entity

Relationships That Require a BAA

If any of the following describe your vendor or contractor, you need a BAA before sharing PHI with them:

EHR and practice management software vendors — they store and process patient records
Medical billing and revenue cycle companies — they receive patient diagnoses and insurance information
Cloud storage and backup providers — if PHI is stored in the cloud (e.g., AWS, Google Cloud, Box)
Telehealth platforms — they transmit clinical encounters containing PHI
IT support and managed service providers (MSPs) — if they have access to systems containing PHI
Medical transcription services
Legal and accounting firms — if they review documents containing PHI
Shredding and document destruction companies — for physical records containing PHI
Answering services — if they take messages that include patient information

Relationships That Do NOT Require a BAA

Not every outside party requires a BAA. The following typically do not:

Covered entity to covered entity — for treatment, payment, or healthcare operations purposes (no BAA required, though many organizations execute them anyway as best practice)
Janitorial or cleaning staff — incidental, non-purposeful access to physical areas containing PHI does not create a business associate relationship
Contractors who never access PHI — a website developer who only works on a public marketing site, for example
Conduit providers — internet service providers and postal services that transmit information without accessing it are excluded
Employment functions — HR vendors managing employee (not patient) data

Subcontractors: The Chain Extends

Under the HITECH Act amendments to HIPAA, the BAA requirement extends down the supply chain. If your business associate shares PHI with a subcontractor, that subcontractor must also sign a BAA with the business associate. This means that cloud subprocessors, offshore development teams, and third-party analytics platforms used by your EHR vendor may each require their own BAAs.

When to Get the BAA Signed

The BAA must be in place before PHI is shared — not after. Many organizations make the mistake of executing BAAs retroactively after a vendor relationship has already begun. This is a compliance gap that OCR auditors specifically look for. Make BAA execution part of your vendor onboarding checklist.

For details on what must actually be in the agreement, read our guide on HIPAA BAA requirements. Or if you're wondering whether a BAA and an NDA are interchangeable, see BAA vs. NDA: What's the Difference?

Need guidance for a specific type of practice? See our vertical guides: BAA for therapists, BAA for telehealth, BAA for SaaS companies, BAA for dental practices, BAA for physical therapy, and BAA for medical billing companies. Not sure if your software vendor offers a BAA? See our vendor BAA reference guide.

Generate a compliant BAA in 5 minutes

HHS model BAA provisions · 45 CFR § 164.504(e) compliant · clean PDF + editable Word