BAA Requirements for Clinic Software: What Physician Owners Must Know

The Scope of the BAA Requirement

The BAA requirement is broader than most physician clinic owners initially realize. It doesn’t just cover your EHR — it covers every vendor whose services your practice uses in connection with protected health information.

The test is straightforward: does this vendor create, receive, maintain, or transmit PHI as part of performing services for your practice? If yes, they’re a business associate. A business associate without a signed BAA is a compliance violation.

Here’s where physician practices routinely have BAA gaps:

Email: If patient communications go through Gmail or Outlook, those vendors are business associates. Google and Microsoft both offer BAAs on their business tiers. Standard consumer accounts are not covered.

Cloud storage: If your practice stores scanned records, lab results, or patient documents in Google Drive, Dropbox, or OneDrive, those vendors need BAAs. Major cloud providers offer BAAs; consumer versions don’t.

Task management software: If your staff assigns tasks that reference patient names, procedures, or appointments, the task management tool is a business associate. Asana, Monday.com, and most general-purpose tools only offer BAAs on enterprise tiers.

Billing services: Any billing company with access to patient claims data is a business associate.

IT support: If your IT vendor can remotely access systems that contain PHI, they’re a business associate and need a signed BAA.

Building Your BAA Inventory

The practical step is building an inventory. List every software tool and service vendor your practice uses. For each one, answer three questions:

1. Does PHI ever enter or pass through this system?
2. Have we signed a BAA with this vendor?
3. When does the agreement expire or renew?

This inventory is also an OCR audit document. Investigators reviewing a HIPAA complaint often ask for a list of business associates and their BAA status. An organized, current inventory demonstrates a functioning compliance program.

What a Good BAA Includes

A BAA is not simply a vendor’s statement that they take security seriously. It’s a legal contract with specific provisions required by the HIPAA Privacy and Security Rules.

A properly structured BAA should include: the purposes for which the vendor may use PHI, a prohibition on using PHI except as permitted, a commitment to maintain appropriate safeguards, an obligation to report security incidents, provisions for returning or destroying PHI at contract end, and requirements to impose similar obligations on any subcontractors.

A BAA that is unusually brief, doesn’t specify incident reporting obligations, or excludes large categories of PHI handling from its scope may leave gaps. If you’re reviewing a vendor BAA that seems thin, ask your HIPAA attorney or compliance consultant to review it before signing.

When a Vendor Won’t Sign a BAA

Some vendors genuinely cannot or will not sign BAAs. This is a hard stop. If a vendor refuses to sign a BAA, you cannot use that tool for PHI-related workflows. Period.

This isn’t negotiable — it’s a statutory requirement. The most common versions of this problem involve consumer-grade tools: WhatsApp, personal text messaging, consumer Dropbox, standard social messaging platforms. None offer BAAs. If staff are using these for patient communication or document sharing, that practice needs to stop immediately.

PHIGuard’s compliance dashboard includes a BAA inventory tracker specifically because this is one of the most common compliance gaps in small physician practices. Knowing where your BAA coverage ends tells you where your compliance exposure begins.