Business Associate Agreements and Vendors: Cloud, IT Providers and AI Tools

Rule versions described: 45 CFR 160.103, 164.308(b), 164.314(a), 164.502(e) and 164.504(e) as amended by the 2013 Omnibus Rule (78 FR 5566, January 25, 2013), current eCFR text read October 28, 2026; HHS Sample Business Associate Agreement Provisions (published January 25, 2013); OCR Guidance on HIPAA and Cloud Computing (October 6, 2016); OCR online tracking technologies bulletin (first issued in late 2022, revised March 2024, partly vacated June 20, 2024); 45 CFR 92.210 (Section 1557 final rule, 89 FR 37522, May 6, 2024). The proposed Security Rule update (90 FR 898, January 6, 2025) is still a proposal as of October 28, 2026. Rules change; check the regulator's current text before relying on any point.

Almost no clinic, hospital or health plan handles patient data alone. The electronic health record runs in someone else's data center. Claims go through a clearinghouse. A billing company chases unpaid accounts. An IT company patches the servers at night through a remote access tool. A transcription service, now often an AI scribe, turns a visit into a note. A marketing agency runs the website, and the website runs code from advertising companies. Each of those relationships moves PHI outside the walls of the organization that collected it, and HIPAA has a specific set of rules for that move.

This lesson covers those rules in depth: who counts as a business associate, what the contract must say, what it should also say, how to check a vendor before and after signing, and the three areas where vendor trouble has been worst in recent years: IT providers with remote access, online tracking technologies and AI tools. If you need the basic map of who HIPAA covers first, start with lesson 1, Who HIPAA Covers, and the overview in Health Privacy: HIPAA and Beyond. The general vendor risk program for any business (not just health care) is in Vendors, Contracts and Third-Party Risk; this lesson adds what HIPAA requires on top of it.

Why vendors are where the big breaches happen

OCR's report to Congress on breaches of unsecured PHI in calendar year 2024 counted 663 breach reports affecting 500 or more people, covering about 242,908,056 individuals. Business associates were involved in 106 of those reports (16 percent), but those 106 reports covered 206,921,071 people, about 85 percent of everyone affected. The single largest, about 192 million people, was ransomware at a health care clearinghouse: Change Healthcare.⁷

The pattern is easy to explain. A clinic that loses a laptop exposes its own patients. A vendor that serves hundreds or thousands of clinics exposes all of their patients at once. Vendors concentrate data, and attackers know it. The same report found that hacking and IT incidents made up 81 percent of the 2024 large breach reports and 99 percent of the people affected, and that network servers were the location in 63 percent of reports.⁷

For 2025 and 2026 the official OCR report is not out yet, but trade press tallies of the HHS breach portal show the same shape. HIPAA Journal's list of the largest 2025 breaches, as of June 2026, was led by Conduent Business Services, a business associate, at 62,224,658 people.¹⁰ Idaho has its own example: in July 2026, Boundary Regional Community Health Center (doing business as Kaniksu Community Health, in the Bonners Ferry and Sandpoint area) reported about 88,000 people affected by hacking at a business associate, Aesto Health.¹¹

When a vendor is a business associate

The definition in 45 CFR 160.103

HIPAA's definitions section, 45 CFR 160.103, defines a business associate as a person who, on behalf of a covered entity (or an organized health care arrangement), and other than as a member of its workforce, does one of two things:¹

• Handles PHI for a regulated function. It creates, receives, maintains or transmits PHI for a function or activity regulated by HIPAA, such as claims processing or administration, data analysis, processing or administration, utilization review, quality assurance, patient safety activities, billing, benefit management, practice management and repricing.
• Provides a listed service that involves PHI. It provides legal, actuarial, accounting, consulting, data aggregation, management, administrative, accreditation or financial services, where the service involves disclosure of PHI from the covered entity or another business associate.

The definition also names some business associates outright: health information organizations, e-prescribing gateways and other people who provide data transmission services and need routine access to PHI; a person who offers a personal health record to individuals on behalf of a covered entity; and any subcontractor that creates, receives, maintains or transmits PHI on behalf of a business associate. A covered entity can itself be a business associate of another covered entity, for example a hospital that does billing for an independent physician group.¹

Three words in that definition do most of the work. "On behalf of" means the vendor is doing the covered entity's work, not its own. "Maintains" means storage counts, even if the vendor never opens the files. And "other than in the capacity of a member of the workforce" separates vendors from employees, volunteers, trainees and others under the covered entity's direct control, who are covered by the entity's own policies instead of a contract.

Status follows the facts, not the paperwork. Since the 2013 Omnibus Rule, a vendor that meets the definition is a business associate and is directly liable for parts of HIPAA whether or not anyone signed a BAA. Signing a BAA with a company that does not meet the definition does not make it one.¹²¹³

Examples HHS gives

HHS keeps a business associates FAQ page with a long list of examples. The version read for this lesson was last reviewed October 21, 2026.⁸ The table groups them with the everyday vendors they describe.

Other common vendors that usually fit the definition: billing and collection agencies, coding companies, shredding and record storage companies, answering services, patient payment and statement vendors that receive diagnosis or visit details, email encryption and secure messaging services, offsite backup, consultants who run your risk analysis with access to real systems, and companies that host your website forms when patients type health information into them.

Who is not a business associate

HHS's FAQ also lists relationships that do not need a BAA.⁸ The main ones:

• Treatment. Disclosures to another health care provider for the patient's treatment, such as a referral to a specialist or an order sent to a lab. The specialist is a covered entity in its own right.
• Payment between plans and providers. A provider sending a claim to a health plan does not make the plan its business associate, and vice versa.
• Financial institutions processing payments. A bank processing card payments, checks or electronic funds transfers for health care is not a business associate for that activity. A bank that runs a lockbox and reads remittance details for you may be a different story; look at what it actually does.
• Incidental contact. Janitors, electricians and similar workers whose jobs do not involve PHI and whose exposure is incidental, as long as reasonable safeguards limit it.
• Conduits, covered next.
• Researchers receiving data under an authorization, a waiver or a limited data set agreement, unless they also perform a service for the covered entity.
• Group health plan disclosures to the plan sponsor under amended plan documents, and certain government program data sharing authorized by law.

The conduit exception

The conduit exception is the most misunderstood idea in this area. In an FAQ first written in December 2002, HHS said the U.S. Postal Service, United Parcel Service and similar delivery services are not business associates because a conduit "transports information but does not access it other than on a random or infrequent basis."¹⁴ The 2013 Omnibus Rule preamble and OCR's later cloud guidance kept the exception narrow: it covers transmission services, including only temporary storage that is incidental to the transmission. An internet service provider carrying traffic, a phone company carrying a call or a courier carrying a sealed box can be a conduit.²¹²

What is not a conduit: any company that stores PHI beyond the moment of transmission. An email provider that keeps your mailboxes, a secure fax service that keeps copies, a texting platform that keeps message history, a cloud backup and a file sharing service all "maintain" PHI. OCR's cloud guidance says a cloud provider that maintains ePHI has persistent access to it and is a business associate, and that a provider offering both transmission and storage is a business associate for the transmission services too.²

Encrypted storage without the key is still a business associate

Cloud companies sometimes argue that they cannot be business associates because the customer encrypts the data and keeps the key, so the provider never sees anything readable. OCR rejected that argument in its Guidance on HIPAA and Cloud Computing, published October 6, 2016 (last reviewed December 23, 2022). The guidance says that lacking an encryption key "does not exempt a CSP from business associate status," and that a BAA is required.²

OCR's reasoning matters for every vendor conversation. The Security Rule protects three things: confidentiality, integrity and availability. Encryption without the key protects confidentiality, but the provider can still delete the data, corrupt it, lose it or make it unavailable, which is exactly what ransomware and outages do. OCR said encryption alone "cannot adequately safeguard the confidentiality, integrity, and availability of ePHI," and that the provider still has Security Rule duties, though how it meets some of them may be shaped by what the customer controls.²

The same guidance answers several other questions that come up constantly:²

• Service level agreements. The SLA (the contract terms on uptime, backup, support and data return) should be consistent with the BAA, and neither may block the customer's access to its own ePHI.
• Security incident reporting. A cloud provider must report security incidents to the customer; the BAA can set the level of detail, frequency and format, but it cannot override the Breach Notification Rule.
• Offshore storage. Storing ePHI on servers outside the United States is not prohibited, but the customer should weigh the added risks and enforcement problems in its risk analysis.
• Audits and documentation. HIPAA does not require a cloud provider to hand over security documentation or allow customer audits. Customers who want those rights must negotiate them.
• End of service. The provider generally need not keep data after the contract ends; the BAA must require return or destruction where feasible.
• De-identified data only. A provider that receives only data de-identified under the Privacy Rule is not a business associate, because de-identified data is not PHI.

What happens if you use a cloud service without a BAA? OCR's FAQ says the covered entity (or business associate) using it is in violation of 45 CFR 164.308(b)(1) and 164.502(e), and the cloud provider that maintains the ePHI must follow HIPAA anyway. The FAQ points to an enforcement action against an entity that stored ePHI of more than 3,000 people on a cloud-based server without a BAA; the linked news release is OCR's $2.7 million settlement with Oregon Health and Science University, announced July 18, 2016.¹⁵¹⁶

A decision chart: is this vendor a business associate?

The chart below walks through the questions in order. It is a first screen, not a legal opinion; edge cases (a bank that also does lockbox work, a vendor that sees PHI only once a year) deserve a written analysis by your privacy officer.

What a business associate agreement must contain

The rules that set the contents

Four provisions work together. The Privacy Rule standard at 45 CFR 164.502(e) says a covered entity may disclose PHI to a business associate, and let it create, receive, maintain or transmit PHI on the entity's behalf, only if it obtains "satisfactory assurance" that the business associate will appropriately safeguard the information, and 164.502(e)(2) says those assurances must be documented in a written contract or other written agreement that meets 164.504(e).³ The Security Rule has a matching standard at 164.308(b), which requires a written contract or arrangement meeting 164.314(a) before a business associate creates, receives, maintains or transmits ePHI.¹⁷ Then 164.504(e)(2) lists the Privacy Rule terms, and 164.314(a)(2)(i) lists the Security Rule terms.⁴⁵

The current text of both sections dates from the 2013 Omnibus Rule (78 FR 5566), which carried out the HITECH Act of 2009. Omnibus added the requirements that BAAs make business associates comply with the Security Rule, report breaches of unsecured PHI, flow the same terms down to subcontractors, and follow the Privacy Rule when carrying out a covered entity's obligations. It also dropped an older rule that a covered entity report to HHS when it could not terminate a bad contract. Agreements signed before January 25, 2013 had until September 22, 2014 to be updated, so any BAA older than that is out of date on its face.¹²¹⁸

The required terms, item by item

The table lists every term the rules require, where it comes from and what to look for when you read a vendor's paper. Citations are to the current eCFR text (as amended through the 2013 Omnibus Rule), read October 28, 2026.⁴⁵

Two more provisions shape the contract without being terms in it. Under 164.504(e)(4), the business associate may use PHI for its own proper management and administration and to carry out its legal responsibilities, and may disclose PHI for those purposes if the disclosure is required by law, or if it gets reasonable assurances of confidentiality from the recipient, who must report known breaches back.⁴ That is the clause vendors cite when they want to use your PHI for their own billing disputes or audits. It is narrow; it is not a general license to use data for product development.

And under 164.504(e)(1)(ii), a covered entity that knows of a pattern of activity or practice by its business associate that is a material breach of the contract is out of compliance unless it takes reasonable steps to cure the breach or end the violation and, if those steps fail, terminates the contract where feasible. The same duty applies, under 164.504(e)(1)(iii), to a business associate that learns its subcontractor is in material breach.⁴ In plain terms: you cannot sign a BAA and look away. If you learn your vendor is mishandling data, you have to act.

Government and other arrangements

When both parties are government entities, 164.504(e)(3) lets them use a memorandum of understanding, or rely on a law or regulation that imposes the same obligations, instead of a contract. A covered entity that must disclose PHI to a business associate because a law requires it can comply by making a good-faith, documented attempt to get the assurances. The termination clause can be left out if it conflicts with the business associate's statutory duties. A state Medicaid agency working with a contractor such as a fiscal agent or a managed care organization will usually use a contract anyway, but county clinics and public health districts sharing data with another agency sometimes use these alternatives.⁴

What business associates are directly liable for

Before 2013, a business associate that broke its BAA faced only a breach of contract claim. The HITECH Act and the Omnibus Rule made business associates directly liable to HHS. OCR's fact sheet on direct liability (May 24, 2019, last reviewed July 16, 2021) lists ten things OCR can enforce directly against a business associate:¹³

1. Failing to provide records and compliance reports to HHS, cooperate with investigations and compliance reviews, or permit access to information, including PHI, relevant to compliance.
2. Retaliating against anyone for filing a complaint or taking part in an investigation.
3. Failing to comply with the Security Rule.
4. Failing to provide breach notification to the covered entity or to another business associate.
5. Impermissible uses and disclosures of PHI.
6. Failing to disclose a copy of ePHI to the covered entity, the individual or the individual's designee, as the BAA specifies, to satisfy an access request.
7. Failing to make reasonable efforts to limit PHI to the minimum necessary.
8. Failing, in certain circumstances, to provide an accounting of disclosures.
9. Failing to enter into BAAs with subcontractors that create or receive PHI, or failing to meet the requirements for those agreements.
10. Failing to take reasonable steps to address a known material breach or violation by a subcontractor.

Everything else in a BAA (a 10-day access turnaround, a promise to carry insurance, a 5-day breach reporting deadline) is enforceable only as a contract term between the parties. That is a strong reason to write those terms clearly. OCR has used its direct authority: business associates such as Elgon Information Systems ($80,000), Virtual Private Network Solutions ($90,000), BST and Co. CPAs ($175,000) and Consociate Health ($225,000) have paid OCR settlements after ransomware or hacking, each with a finding about the risk analysis.¹⁹²⁰²¹

Subcontractors and the chain of agreements

The flow-down rule

The 2013 Omnibus Rule extended business associate status down the chain. Under 45 CFR 164.502(e)(1)(ii), a business associate may disclose PHI to a subcontractor, and let it create, receive, maintain or transmit PHI on its behalf, only if it obtains satisfactory assurances under 164.504(e)(1)(i) that the subcontractor will appropriately safeguard the information. Section 164.504(e)(5) applies the same contract requirements to agreements between a business associate and a subcontractor, and 164.314(a)(2)(iii) does the same for the Security Rule terms.³⁴⁵

Just as important is what the covered entity does not have to do. The same section says "A covered entity is not required to obtain such satisfactory assurances from a business associate that is a subcontractor."³ Your clinic signs with its EHR vendor; the EHR vendor signs with its cloud host; the cloud host signs with its backup provider. Each link is the responsibility of the party just above it.

Mapping the chain

The legal rule puts each contract on the party just above, but the risk lands on the covered entity and its patients. When a subcontractor three levels down is breached, the notices go out under the covered entity's name, the phone calls come to its front desk and the reporters call its administrator. So the practical step is to know the chain:

1. Ask each business associate, in the BAA or the security questionnaire, for a list of subcontractors that create, receive, maintain or transmit your PHI, with what each does and where it stores data.
2. Require notice before a new subcontractor is added for your data, and a right to object or terminate if the change raises your risk.
3. Ask for confirmation that each subcontractor has signed a BAA with terms at least as strict as yours, including the breach reporting deadline. A five-day deadline in your BAA means little if the subcontractor has 60 days to tell your vendor.
4. Record the chain in your vendor inventory and risk analysis. The proposed Security Rule update would require a technology asset inventory and network map that shows how ePHI moves; a vendor chain map is part of that picture.²²

The HHS sample provisions and what they leave out

What the sample covers

HHS published "Sample Business Associate Agreement Provisions" on January 25, 2013, the same day as the Omnibus Rule. HHS says it is "only sample language and use of these sample provisions is not required for compliance with the HIPAA Rules," and that the language may be changed and placed either in a service agreement or a separate BAA.⁶ The sample has seven parts:

1. Definitions, mostly by reference to the HIPAA Rules.
2. Obligations and activities of the business associate: limits on use and disclosure, safeguards and Security Rule compliance, reporting (with a bracketed note that the parties may add a stricter time frame and decide who sends breach notices), subcontractors, access, amendment, accounting, Privacy Rule compliance when doing the covered entity's work, and books and records for HHS.
3. Permitted uses and disclosures, with options to list purposes or point to the service agreement, minimum necessary options, and optional clauses for management and administration and data aggregation. HHS notes the parties should say whether the business associate may de-identify PHI.
4. Covered entity duties to inform the business associate of limits in its privacy notice, changes in permissions and agreed restrictions.
5. Permissible requests by the covered entity.
6. Term and termination, including termination for cause with an optional cure period and two options for return or destruction at the end.
7. Miscellaneous (optional): references to the rules as amended, amendment and interpretation in favor of HIPAA compliance.

HHS is also plain about the limits. The provisions "address only concepts and requirements set forth in the HIPAA Privacy, Security, Breach Notification, and Enforcement Rules," "alone may not be sufficient to result in a binding contract under State law," and leave out many formalities and substantive terms that a valid contract usually contains.⁶

What the sample does not cover

Many vendors hand over a BAA that is the HHS sample with their name typed in, or a shorter version of it. Signing that meets the HIPAA floor. It does not protect the covered entity on the issues that decide how bad a vendor incident will be. The table lists the common gaps and the additions organizations negotiate. None of these are HIPAA requirements today; they are business terms, and which ones you can get depends on your size and the vendor's.

On the timing point, note what the breach rule says about agents. Under 45 CFR 164.404(a)(2), a covered entity is treated as knowing of a breach when any workforce member or agent of the covered entity knows of it, with agency decided under the federal common law of agency. So if a business associate is acting as the covered entity's agent, the business associate's discovery can start the covered entity's own 60-day clock; if it is an independent contractor, the clock generally starts when the covered entity is told.²³ A short reporting deadline in the BAA protects you either way.

BAAs, SLAs and terms of service

Large cloud and software companies usually do not negotiate. They offer a standard BAA that applies only to listed "covered services," and their general terms of service and SLA govern everything else. Three checks prevent surprises:

• Is the product you use on the covered list? Many large cloud providers sign BAAs only for named services. A feature outside the list (a consumer version, a beta, an add-on) is not covered even though it carries the same brand.
• Is the setting right? Some providers require the customer to turn on a HIPAA mode, a specific tenant setting or a paid tier before the BAA applies.
• Do the documents conflict? OCR's cloud guidance says the SLA should be consistent with the BAA and may not prevent the customer from getting its ePHI.² Read the data use and termination sections of the terms of service with the BAA side by side.

Keep the signed BAA, every amendment and the vendor's security answers. The Security Rule requires written policies and documentation to be kept for six years from the date created or last in effect, whichever is later (45 CFR 164.316(b)(2)(i)), and OCR almost always asks for BAAs in an investigation.²⁴

Vendor due diligence for health care

A BAA is a promise. Due diligence is how you decide whether to believe it. HIPAA does not spell out a vendor review process, but the risk analysis required by 45 CFR 164.308(a)(1)(ii)(A) must cover all ePHI the organization creates, receives, maintains or transmits, and that includes ePHI held by vendors. See lesson 4, The Risk Analysis, for the method. The general vendor program (inventory, tiers, questionnaires, contracts, reviews) is taught in Vendors, Contracts and Third-Party Risk; this section covers what is different in health care.

Sort vendors by risk first

A small practice may have 30 vendors that touch PHI and a hospital several hundred or more. Nobody can review all of them in depth. Sort them first by two questions: how much PHI does the vendor hold, and what happens to patient care if the vendor goes down for two weeks? An EHR host, a clearinghouse and an IT provider with administrative access are top tier on both. A shredding company is lower on the second. A scheduling chatbot may be low on volume but high on sensitivity if it collects symptoms.

The Health Sector Coordinating Council (HSCC), the industry and government partnership for the health sector, released a free tool for this in October 2025, the Health Industry Cybersecurity Sector Mapping and Risk Toolkit (SMART). It gives templates for identifying critical workflows, the third parties that support them and which of those pose systemic risk, so limited review time goes to the vendors that matter most.²⁵ The HHS Healthcare and Public Health Cybersecurity Performance Goals (January 2024, voluntary) list "vendor/supplier cybersecurity requirements" among the 10 essential goals, and third-party vulnerability disclosure and third-party incident reporting among the enhanced goals.²⁶

Security questionnaires

Most organizations send a questionnaire. Long generic ones produce long generic answers. For health care vendors, the questions that predict trouble are short:

• Is multifactor authentication required for every remote login, every administrator account and every account with access to our data, including your support staff and subcontractors?
• Is our data encrypted at rest and in transit, and who holds the keys?
• Where is our data stored and from which countries can your staff reach it?
• How do your staff connect to our systems (which remote access tool, from which networks, with what logging)?
• How often do you patch internet-facing systems, and how fast for critical vulnerabilities?
• Are backups kept offline or immutable, and when did you last test a full restore?
• Which subcontractors touch our data, and do all of them have BAAs?
• When did you last complete a HIPAA risk analysis, and who did it?
• Have you had a reportable breach or ransomware incident in the last three years? What changed afterward?
• What cyber insurance do you carry, and at what limit?
• How fast will you tell us about a suspected incident, and who will call us?

Treat answers as statements the vendor can be held to: attach them to the contract, or add a clause saying the vendor's answers are true and that it will tell you if they stop being true.

SOC 2 Type II reports

A SOC 2 report is an independent CPA firm's report on a service organization's controls, measured against the American Institute of CPAs' Trust Services Criteria (security, availability, processing integrity, confidentiality and privacy).²⁷ A Type I report says the controls were designed properly at a point in time. A Type II report says they also operated effectively over a period, usually six to twelve months, and lists any exceptions the auditor found. For a vendor that hosts or processes PHI, ask for the Type II.

How to read one without being an auditor:

1. Check the scope. Make sure the system description covers the product and data centers you actually use. Many companies have a SOC 2 for one product line and sell several.
2. Check the period. A report whose period ended more than a year ago is stale. Ask for a bridge letter covering the gap.
3. Read the exceptions. The auditor's tests and results section lists failures. A failure in access reviews or change management matters more than a late training record.
4. Read the complementary user entity controls. These are the things the report assumes you do, such as managing your own users and turning on MFA. If you are not doing them, the vendor's controls do not protect you.
5. Check subservice organizations. The report says whether controls at the vendor's own providers (often a large cloud host) are included or carved out.

A SOC 2 is not a HIPAA attestation. It does not say the vendor complies with HIPAA, and many SOC 2 reports do not test the privacy criteria at all. Some vendors obtain a SOC 2 with HIPAA mapping or a separate HIPAA assessment by a third party; ask what was actually tested.

HITRUST and other certifications

HITRUST is a private organization whose control framework (the HITRUST CSF) combines requirements drawn from HIPAA, NIST, ISO and other sources. It is widely used by health care vendors. HITRUST offers assessments at several levels: an e1 (foundational, about 43 controls, valid one year), an i1 (182 control requirements, valid one year) and an r2 (risk-based and tailored, the most demanding, valid two years), plus a newer AI security assessment for AI platform and service providers.²⁸ The framework itself is licensed and not reproduced here. When a vendor says it is "HITRUST certified," ask which assessment, for which systems, and when it expires, and read the scope the same way you would read a SOC 2.

ISO/IEC 27001 certification (an information security management system standard, also paid and not reproduced here) is common among international vendors. It shows that a security program exists and is audited; like SOC 2, it is only as useful as its scope. No certification creates a HIPAA safe harbor, and OCR does not endorse or certify any vendor or product as "HIPAA compliant."²

Penetration test summaries

A penetration test is an authorized simulated attack by qualified testers to find weaknesses before criminals do. Vendors will rarely share full reports, which are themselves sensitive. Ask instead for an executive summary or a letter from the testing firm stating the date, the scope (which applications and networks), the number of findings by severity and whether critical and high findings have been fixed and retested. The proposed Security Rule update would require regulated entities, including business associates, to run penetration tests at least every 12 months and vulnerability scans at least every six months.²²

Cyber insurance

Ask for a certificate of insurance showing cyber liability coverage, the limit and the policy period. Check that the policy covers the vendor's liability to customers (third-party coverage), not only its own costs. HHS's guide for small health care organizations, HICP Technical Volume 1 (2023 edition), includes cyber insurance as a sub-practice (10.S.D) for the organization's own program, which is a reminder to check your own policy's terms on vendor-caused incidents too.²⁹

The proposed annual written verification

The Security Rule proposal published January 6, 2025 (90 FR 898) would change vendor oversight more than any other part of HIPAA since 2013. According to HHS's fact sheet, it would require covered entities to obtain, at least once every 12 months, written verification from each business associate that it has deployed the required technical safeguards, consisting of a written analysis of the business associate's systems by a subject matter expert and a written certification that the analysis was performed. Business associates would have to get the same from their subcontractors. It would also require business associates to notify covered entities (and subcontractors to notify business associates) within 24 hours of activating a contingency plan.²²³⁰

As of October 28, 2026, this is still a proposal. HHS's regulatory agenda lists the rule as a long-term action with a projected final action date of July 2027.³¹ Nothing in it is enforceable today, and the final version may differ. Many organizations are adding annual written verification to their BAAs anyway, because the proposal reflects what a careful buyer would want. The policy argument over the proposal is covered in lesson 3.

What the paperwork proves and what it does not

Every large vendor breach of the last decade happened at a company that had signed BAAs, and many had audit reports and certifications. Paper tells you a program exists and was tested at some point. It does not tell you whether one remote access account lacked MFA last Tuesday. The most useful follow-up is to tie the paperwork to a few things you can see: the vendor's accounts in your systems (are they named, limited and protected with MFA?), the alerts you get when a vendor logs in, the data you can export, and how the vendor behaved the last time something went wrong.

IT providers and remote access tools: a top risk

Why managed service providers matter so much

Small and midsize practices rarely have their own IT staff. They rely on a managed service provider (MSP): a company that runs their computers, network, email, backups and security, usually remotely. HHS's business associates FAQ names managed service providers as a business associate example.⁸ An MSP typically holds administrator credentials for every client, runs a remote monitoring and management tool that can push software to every machine, and connects from its own network. That is exactly what an attacker wants: compromise one MSP and you can reach every clinic it serves.

CISA, the NSA, the FBI and partner agencies in the United Kingdom, Australia, Canada and New Zealand warned about this in a joint advisory on May 11, 2022, "Protecting Against Cyber Threats to Managed Service Providers and their Customers" (AA22-131A). Its recommendations for both MSPs and customers include preventing initial compromise, improving monitoring and logging (keeping the most important logs for at least six months), enforcing MFA, managing internal architecture risks and segregating networks, applying least privilege, deprecating obsolete accounts and infrastructure, applying updates, backing up systems and data, developing and exercising incident response and recovery plans, managing supply chain risk and promoting transparency. It also says customers should make sure their contracts specify that the MSP implements these measures.³² The last point is the BAA conversation: the contract should say who patches, who monitors, who responds and how fast.

Remote access software

Remote access tools let a technician or vendor see and control a computer from elsewhere. They are essential for IT support, EHR vendor support and medical device maintenance. They are also one of the most common ways ransomware crews get in, because a legitimate tool raises fewer alarms than malware. CISA and partners published a "Guide to Securing Remote Access Software" on June 6, 2023, describing how criminals and state actors abuse legitimate remote access tools and what organizations can do.³³ For health care, the defensive steps to require of any vendor with remote access are:

1. Keep an inventory of every remote access tool in use, approve one or two and block the rest.
2. Require MFA for every remote session and every vendor account, with no shared accounts.
3. Give each vendor technician a named account with only the access the job needs.
4. Turn vendor access on when needed and off when the work is done, where the tool allows it, rather than leaving it always on.
5. Log every session (who, when, what system) and review the logs, with alerts for logins at unusual times.
6. Keep the remote access tool itself patched; several widely used tools have had critical vulnerabilities.
7. Remove vendor access the day a contract ends or a technician leaves (see offboarding below).

Change Healthcare: a concentration example

The largest health data breach ever reported to OCR shows what happens when one vendor sits in the middle of everything. Change Healthcare, a UnitedHealth Group company, is a health care clearinghouse (so a covered entity) and also a business associate to many providers and plans. UnitedHealth has said Change processes about 15 billion health care transactions a year.³⁴

• Initial access. In prepared testimony for Congress in May 2024, UnitedHealth CEO Andrew Witty said attackers used compromised credentials to get into a Change Healthcare Citrix remote access portal that did not have multifactor authentication. Reports put the initial access at February 12, 2024; the ransomware was detected February 21, 2024.³⁴³⁵
• Ransom. UnitedHealth paid a ransom reported at $22 million.³⁴
• Breach reports. OCR opened investigations of Change and UnitedHealth and issued a Dear Colleague letter on March 13, 2024. Change filed a breach report on July 19, 2024 listing a placeholder of 500 people, then reported about 100 million notices by October 22, 2024, about 190 million people affected by January 24, 2025 and about 192.7 million as of July 31, 2025.³⁵
• Who notified. OCR's FAQ said covered entities remain responsible for making sure notices go out, but only one entity needs to send them, and covered entities could rely on Change to notify for them if it did so properly. UnitedHealth said it offered to make notifications for its customers.³⁵
• Enforcement. As of October 28, 2026, no OCR enforcement action against Change Healthcare has been announced.

For providers, the harder lesson was operational. Thousands of practices could not submit claims or check eligibility for weeks, because they had one clearinghouse and no second path. A BAA cannot fix that. What helps is knowing which vendors are single points of failure, having a tested backup path for the most critical ones (a second clearinghouse account, paper or manual procedures, cash reserves), and contract terms on recovery time and help during an outage. The OCR FAQ also reminded every covered entity and business associate involved of the duty to have BAAs in place.³⁵

Online tracking technologies and pixel cases

The OCR bulletin

Tracking technologies are pieces of code on websites and apps (pixels, cookies, session replay scripts, software development kits) that collect information about visitors and send it to the site owner or to third parties such as advertising and analytics companies. In 2022 a series of news reports and lawsuits showed that many hospital websites and patient portals were sending data such as appointment details, doctors searched and medical conditions to advertising platforms.

OCR responded with a bulletin, "Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates," first issued in December 2022 (HHS page metadata shows a November 2022 creation date) and revised on March 18, 2024.³⁶ The bulletin says:

• Tracking on user-authenticated pages (patient portals, telehealth platforms) generally has access to PHI and must be configured so PHI is used or disclosed only as the Privacy Rule allows.
• A tracking vendor that handles PHI on behalf of a regulated entity is generally a business associate and needs a BAA. Signing a BAA does not make a vendor a business associate if it does not meet the definition.
• If a vendor will not sign a BAA, the regulated entity needs a valid HIPAA authorization from each individual before disclosing PHI to it. Website banners asking visitors to accept cookies are not valid authorizations, and removing PHI after the vendor receives it is not enough.
• One option the bulletin describes: use a customer data platform vendor that signs a BAA and de-identifies the data before passing only de-identified information on to the vendor that refuses to sign.
• Tracking must be addressed in the risk analysis and risk management process, and an impermissible disclosure to a tracking vendor is presumed to be a breach requiring notification unless a low probability of compromise is shown.
• Mobile apps offered by regulated entities generally handle PHI; apps not developed by or for a regulated entity fall outside HIPAA but may be covered by the FTC Act and the FTC Health Breach Notification Rule.

AHA v. Becerra

The American Hospital Association and others sued over the part of the bulletin dealing with unauthenticated public pages. On June 20, 2024, in American Hospital Association v. Becerra, No. 4:23-cv-1110 (N.D. Tex.), the court declared unlawful and vacated the bulletin to the extent it said HIPAA obligations arise when an online technology connects an individual's IP address with a visit to an unauthenticated public web page about specific health conditions or health care providers. HHS noticed an appeal and then moved to dismiss it voluntarily in August 2024.³⁶³⁷ The HHS bulletin page now carries a note about the order and says HHS "is evaluating its next steps."

What still applies after the ruling

The ruling was narrow. The rest of the bulletin remains HHS guidance, and the Privacy, Security and Breach Notification Rules themselves did not change. In particular:

• Tracking on patient portals, telehealth pages and inside apps that handle PHI is still covered.
• Information patients type into forms on public pages (appointment requests, symptom checkers, the reason for a visit) is a different question from a bare page visit. The vacated part addressed only the combination of an IP address and a visit to an unauthenticated page about conditions or providers.
• State laws, the FTC Act, the FTC Health Breach Notification Rule and wiretap and consumer protection laws used in private lawsuits are unaffected by the HIPAA ruling.

The vendors in this area have also been clear. Google's Analytics help page, for example, says Google "does not offer Business Associate Agreements in connection with this service," that HIPAA customers must not use Analytics in a way that gives Google access to PHI, and that customers should not put Analytics tags on authenticated pages.³⁸ If the vendor will not sign, the only HIPAA paths are to keep PHI away from it or get authorizations.

Pixel cases

• Kaiser Permanente said in April 2024 that tracking technologies on its websites and apps may have sent information about 13.4 million current and former members and patients (names, IP addresses, whether people were signed in, and browsing activity including health encyclopedia searches) to Google, Microsoft Bing and X.³⁹
• NewYork-Presbyterian Hospital paid the New York Attorney General $300,000 in a settlement announced December 27, 2023, over tracking tools on its website from June 2016 to June 2022 that sent visitors' information, including searches for symptoms, conditions and doctors and appointment bookings, to third parties. The office said the hospital lacked policies to vet tracking tools before using them.⁴⁰
• Blue Shield of California reported about 4.7 million people affected by website tracking tools in 2025, one of the largest health data breaches that year.¹⁰
• The FTC has used the Health Breach Notification Rule against health apps outside HIPAA, including a $1.5 million civil penalty against GoodRx and $100,000 against Easy Healthcare (the Premom app), and amended the rule in 2024 to make clear that unauthorized disclosures, not just hacks, are breaches.⁴¹

Tracking problems are vendor problems. The code comes from a vendor, is usually installed by another vendor (a web agency or marketing firm), and sends data to a third. A practical review: list every script on your website, portal and app; for each, find out who installed it, what it sends and to whom; remove anything on authenticated pages or forms that the vendor will not cover with a BAA; and make your web agency's contract require approval before any new tag is added.

AI vendors: scribes, chatbots and coding tools

AI tools arrived in health care faster than any guidance written for them. Ambient AI scribes listen to a visit and draft the note. Chatbots on portals answer questions, triage symptoms and book appointments. Coding and billing tools read charts and suggest codes. Prior authorization tools read records and fill out payer forms. General-purpose chat assistants get pasted into by staff who want help writing a letter. The HIPAA analysis for all of them starts in the same place as any other vendor. The broader question of how an organization governs AI (inventory, approval, testing, board oversight) is covered in Privacy Program, AI Governance and Board Reporting.

No AI-specific BAA guidance yet

As of October 28, 2026, OCR has issued no guidance written specifically about AI vendors and business associate agreements. Nothing in this section is new law; it is the ordinary definition in 45 CFR 160.103 and OCR's cloud computing reasoning applied to a new kind of vendor. The closest official statement is a line in HHS's general business associates FAQ page (last reviewed October 21, 2026), which lists among its examples a third-party chatbot on a provider's patient portal that provides services involving the patient's PHI, such as symptom assessment, reminders and scheduling, and the vendor of an app that provides transcription services to a physician.⁸ Those examples cover the two most common AI products in clinics.

When an AI tool is a business associate

The cloud guidance logic applies directly: an AI vendor does not escape business associate status because its system processes data automatically, because no human at the company reads the transcripts, or because data is deleted after a few days. If it creates, receives, maintains or transmits PHI for you, it is a business associate.²

The limits of de-identification

Vendors often say they use only "de-identified" or "anonymized" data. Under HIPAA, de-identified has a specific meaning. Section 164.514(b) allows two methods: safe harbor, removing 18 kinds of identifiers (including names, geographic units smaller than a state, all date elements except year, phone numbers, email addresses, record numbers, device identifiers, URLs, IP addresses, biometric identifiers, full-face photos and any other unique code) with no actual knowledge that what is left could identify someone; or expert determination, where a qualified expert applies statistical and scientific methods, finds the risk of identification very small, and documents the method and results.⁴²

AI raises three practical problems:

• Free text and audio are hard to clean. A visit recording contains the patient's voice (a biometric identifier), names, dates and places mentioned in passing. Clinical notes contain identifiers in unpredictable places. Automated scrubbing tools miss some, and safe harbor requires all 18 categories to be removed.
• Someone has to do the de-identifying. If the vendor receives identifiable PHI and de-identifies it itself, it is a business associate during that step, and HHS's sample provisions note that the BAA should say whether the business associate may de-identify at all.⁶ Without that permission, the vendor's de-identification is itself an unpermitted use.
• "Anonymized" is not a HIPAA term. Ask which method was used, who performed an expert determination, and whether the vendor will share the expert's report.

Model training on PHI

The biggest contract question with AI vendors is whether they may use your patients' data to train or improve their models. Under 164.504(e)(2)(i) and 164.502(a)(3), a business associate may use PHI only as the BAA permits and may not use it in a way the covered entity could not.³⁴ The analysis below is this lesson's application of those rules, not OCR guidance:

• Training a model used only to provide the service to your organization (for example tuning a scribe to your clinicians' specialties) can fit within the services the covered entity hired the vendor for, if the BAA says so.
• Training a general model the vendor sells to other customers is the vendor's own commercial purpose. It is hard to fit within the covered entity's treatment, payment or operations, and the "proper management and administration" allowance in 164.504(e)(4) is not written for product development. Unless the data is first properly de-identified with the BAA's permission, or patients sign authorizations, it is likely an impermissible use.
• Data aggregation (combining PHI from several covered entities) is allowed only for the health care operations of the covered entities involved, and only if each BAA permits it.

Read the vendor's terms of service and privacy policy, not just the BAA. Many AI products have a general clause allowing use of "customer content" or "usage data" to improve services. The BAA should say it controls over those terms for PHI.

BAA terms to require from AI vendors

The HSCC published a free guide on third-party AI risk and supply chain transparency in April 2026, recommending data lineage tracking, model auditability, mapping embedded third-party dependencies and post-deployment monitoring, aligned with the NIST AI Risk Management Framework (AI RMF 1.0, January 2023).⁴³⁴⁴

Recording, consent and state law

HIPAA does not require patient consent for a provider to use a business associate for treatment documentation. State recording and medical privacy laws may. A proposed class action filed in late November 2025 in San Diego County Superior Court alleged that Sharp HealthCare recorded a patient's July visit at a Sharp Rees-Stealy clinic using Abridge's ambient documentation app without consent, in a state that generally requires all parties to consent to recording; the patient said he learned of the recording from his visit notes. Sharp declined to comment, and the case was pending when reported in December 2025.⁴⁵ The case is an allegation, not a finding, but it shows why a scribe rollout needs a consent process that matches state law, not just a BAA. Idaho's wiretap statute is generally described as a one-party consent law; multistate groups and telehealth across state lines should check each state.

Section 1557 and patient care decision support tools

A separate HHS rule applies to AI and other tools used in clinical decisions. The 2024 Section 1557 final rule, "Nondiscrimination in Health Programs and Activities" (89 FR 37522, May 6, 2024, effective July 5, 2024), added 45 CFR 92.210.⁴⁶ It says a covered entity must not discriminate on the basis of race, color, national origin, sex, age or disability through its use of patient care decision support tools; has an ongoing duty to make reasonable efforts to identify tools that use input variables measuring those characteristics; and must make reasonable efforts to mitigate the risk of discrimination from each tool it identifies.⁹ Paragraphs (b) and (c) apply within 300 days of the effective date, which is May 1, 2025.⁴⁶

Two definitions matter. A "patient care decision support tool" is any automated or non-automated tool, or combination, used to support clinical decision-making in the entity's health programs or activities, so it includes AI models and also older scoring tools. And a "covered entity" under Section 1557 is not the same as under HIPAA: it means a recipient of federal financial assistance (which includes most providers that take Medicare Part A, Medicaid or other HHS funds), HHS itself, and entities set up under Title I of the Affordable Care Act.⁴⁷

Status as of October 28, 2026: no amendment or rescission of 92.210 has been found, and court injunctions against parts of the 2024 rule have targeted the gender identity provisions, not 92.210.⁴⁸ OCR's January 10, 2025 blog post and Dear Colleague letter on nondiscrimination in AI use now redirect from hhs.gov to the HHS web archive, which suggests the guidance was archived; the rule text was not changed.⁴⁹ No OCR enforcement action under 92.210 has been announced. For vendor contracts, the practical effect is that a provider using a vendor's clinical AI tool needs enough information from the vendor (input variables, testing for bias, known limits) to meet its own duty to identify and mitigate risk.

Vendor offboarding

The end of a vendor relationship is when data gets forgotten: an old billing company's server, a former IT provider's remote access agent still running on every workstation, an AI pilot whose recordings were never deleted. The BAA's return or destruction clause (164.504(e)(2)(ii)(J)) is the legal hook; this is the checklist that makes it real.⁴

1. Plan the exit before signing. Put the export format, the timeline and the destruction certificate in the contract. A vendor has the most reason to cooperate while it is trying to win your business.
2. Get your data out in a usable form. Export records, images, audit logs and billing history before access ends, and test that the export opens in the new system. Remember that the clinic still has to keep records for the periods state law and Medicare require, and HIPAA documentation for six years.²⁴
3. Revoke every form of access on the last day. Disable vendor accounts in your systems, VPN and remote access accounts, shared passwords and API keys. Uninstall remote monitoring agents. Change any passwords the vendor knew, including administrator, Wi-Fi and firewall accounts.
4. Get written confirmation of destruction. Ask for a certificate that PHI has been returned or destroyed, covering backups, subcontractors and (for AI vendors) training data, embeddings and logs. HHS's guidance on rendering PHI unusable points to NIST SP 800-88 for media sanitization.⁵⁰
5. If destruction is not feasible, document why. The rule allows the vendor to keep PHI only if return or destruction is infeasible, with the BAA's protections extended and uses limited to the reasons it is kept.
6. Update your records. Mark the vendor inactive in your inventory, update the risk analysis and network map, and keep the BAA and the destruction certificate for at least six years.

The proposed Security Rule update would add a related requirement: notifying certain other regulated entities within 24 hours when a workforce member's access to ePHI is changed or terminated.²² Whether or not that becomes final, the same discipline applies to vendor staff.

The vendor lifecycle on one page

How the business associate rules got here

A BAA checklist

Use this when a vendor sends its paper, or when you review the BAAs you already have. The first group is what the rules require; the second is what a careful buyer adds. A missing item in the first group means the agreement does not meet HIPAA. A missing item in the second group is a business risk to weigh.

Required by the rules (45 CFR 164.504(e) and 164.314(a))

• Describes the permitted and required uses and disclosures, and allows nothing the covered entity could not do (apart from management, administration and data aggregation if included).
• Bars any other use or disclosure except as the agreement permits or law requires.
• Requires appropriate safeguards and compliance with the Security Rule for ePHI.
• Requires reporting of unpermitted uses and disclosures, security incidents and breaches of unsecured PHI under 164.410.
• Requires subcontractors that handle PHI to agree to the same restrictions in writing.
• Provides for access, amendment and accounting of disclosures.
• Requires Privacy Rule compliance when carrying out the covered entity's obligations.
• Makes books and records available to HHS.
• Requires return or destruction of PHI at termination, or extended protections if infeasible.
• Lets the covered entity terminate for a material violation.
• Is signed and dated by both parties, and the signed copy is filed where you can find it.

What careful buyers add

• Suspected incident notice within a short period, confirmed breach notice within a set number of days, with named contacts.
• Treatment of unsuccessful security attempts.
• Who sends breach notices, who approves their content and who pays.
• Indemnity and a data breach liability cap separate from the general cap.
• Cyber insurance at a stated limit.
• Named security controls: MFA, encryption, logging, patching, tested backups.
• Annual evidence: SOC 2 Type II, HITRUST or equivalent, penetration test summary, questionnaire update, written verification of safeguards.
• Data location and notice of changes.
• Subcontractor list and notice of new subcontractors.
• Incident cooperation, evidence preservation and lists of affected people.
• Recovery time commitments and contingency plan notice.
• No AI training, de-identification or secondary use without written consent.
• Offboarding: export format, deadline, destruction of backups, certificate.
• The BAA controls over the terms of service and privacy policy for PHI.

Where this lesson links instead of repeating

• Lesson 1, Who HIPAA Covers: covered entities, hybrid entities, PHI and the full business associate definition in context.
• Lesson 5, Breach Notification: the four-factor risk assessment and the notice rules that a business associate report sets in motion.
• Lesson 8, Enforcement and Real Cases: penalty tiers and the ransomware cases in more detail.
• Vendors, Contracts and Third-Party Risk: the general vendor risk program for any business.
• Privacy Program, AI Governance and Board Reporting: governing AI tools across the organization.
• Cloud, SaaS and Shared Files: plain-language setup of cloud accounts, sharing settings and backups for a small office.
• Health Privacy: HIPAA and Beyond: the overview, including health data outside HIPAA.

Common mistakes, from real OCR cases

OCR's resolution agreements show the same vendor failures again and again.⁵¹ Each case below is a settlement in which the entity did not admit liability unless the agreement says otherwise; amounts are as announced by HHS.

No BAA at all

• North Memorial Health Care (Minnesota) paid $1,550,000 in March 2016. OCR cited its failure to have a business associate agreement with a major contractor and its failure to do an organization-wide risk analysis.⁵²
• Raleigh Orthopaedic Clinic (North Carolina) paid $750,000 in April 2016 for turning over PHI of 17,300 patients to a potential business partner without first signing a BAA.⁵³
• The Center for Children's Digestive Health (Illinois, seven clinics) paid $31,000 in April 2017. It had sent records to a storage company, FileFax, since 2003, but neither side could produce a signed BAA dated before October 12, 2015. OCR found the problem while investigating the vendor.⁵⁴ Small amount, important lesson: a vendor investigation can lead OCR straight to its customers.
• Oregon Health and Science University paid $2,700,000 in July 2016 after OCR found, among other problems, ePHI of more than 3,000 people stored on a cloud-based server without a BAA.¹⁵¹⁶

An out-of-date BAA

Care New England Health System paid $400,000 in September 2016 in a case HHS titled as illustrating "the importance of reviewing and updating, as necessary, business associate agreements."⁵⁵ Many organizations still have pre-2013 agreements in the file that never added Security Rule compliance, breach reporting or subcontractor terms.

A vendor with no risk analysis

When OCR investigates a business associate after ransomware, the risk analysis is almost always the finding. Elgon Information Systems (electronic medical record and billing support services; intrusion through open firewall ports in March 2023; more than 31,000 people) paid $80,000. Virtual Private Network Solutions (data hosting and cloud services; ransomware discovered October 31, 2021, affecting 12 covered entity clients) paid $90,000. Both settlements, announced January 7, 2025, cited failure to conduct an accurate and thorough risk analysis.¹⁹ In April 2026, Consociate Health, a business associate, paid $225,000 in one of four ransomware settlements OCR announced together, each tied to risk analysis failures.²¹

Other recurring failures

• Signing the vendor's BAA without reading the terms of service it points to.
• Keeping no list of vendors, so nobody knows which ones have BAAs.
• Letting a department (marketing, a research group, one physician) sign up for a cloud or AI tool on a credit card, outside procurement.
• Leaving former vendors' remote access in place for years.
• Assuming a big brand name means a BAA is automatic. Large providers sign BAAs only for listed services and often only when the customer accepts them.
• Waiting on the vendor. OCR's Change Healthcare FAQ says a covered entity remains responsible for making sure notices happen, even when a business associate caused the breach.³⁵

Questions people ask

Does every vendor need a BAA?

No. Only vendors that meet the definition in 45 CFR 160.103. The cleaning company, the electrician and the bank processing card payments usually do not. Treatment providers do not. A pure conduit does not. But any vendor that stores, processes or sees PHI as part of its job does, whatever it calls itself.¹⁸

The vendor says it is "HIPAA compliant." Is that enough?

No. There is no government certification of HIPAA compliance, and OCR does not endorse or certify vendors or products.² "HIPAA compliant" in marketing means the vendor will sign a BAA and claims to follow the rules. You still need the signed BAA, and you still have to include the vendor in your risk analysis.

What if the vendor refuses to sign a BAA?

Then you cannot give it PHI, unless each patient signs a valid HIPAA authorization (which is impractical for most services). Find another vendor, change how you use the product so no PHI reaches it, or, for tracking tools, use the approach in OCR's bulletin of routing data through a BAA-covered platform that de-identifies it first.³⁶

Is our EHR vendor responsible for our security?

Only for its part. A hosted EHR vendor is responsible for the systems it runs; you are responsible for your users, passwords, MFA settings, workstations, network and the access you grant. A SOC 2 report's "complementary user entity controls" section lists what the vendor assumes you do. Both of you are directly liable to OCR for your own Security Rule compliance.¹³

Can OCR fine a business associate directly?

Yes, for the ten categories in OCR's direct liability fact sheet, including Security Rule failures, impermissible disclosures and failure to report breaches to the covered entity. OCR has settled with business associates including Elgon, VPN Solutions, BST and Co. CPAs and Consociate Health.^13192021

Do we need a BAA with our AI scribe vendor?

Yes, if it receives visit audio or creates draft notes. HHS lists transcription app vendors as business associates. Also check whether the vendor uses your data to train models, how long it keeps recordings, and whether your consent process meets state recording law.⁸

Our staff paste patient letters into a free chatbot. Is that a problem?

Very likely. Without a BAA with that service, pasting identifiable PHI into it is a disclosure the Privacy Rule does not permit, and it may be a reportable breach after a risk assessment. Give staff an approved tool covered by a BAA, write a policy, and train on it.

How often should we review our BAAs?

HIPAA sets no schedule today. A common practice is to review top-tier vendors every year and every vendor at renewal, whenever the vendor adds a feature (such as AI) or a subcontractor, and after any incident. The proposed Security Rule update would require annual written verification from business associates if finalized.²²

Does the BAA need a specific breach reporting deadline?

The rules require only that the BAA require reporting consistent with 164.410, which has a 60-day outer limit after discovery.⁵⁶ A shorter deadline is a negotiated term. It matters because the covered entity has its own 60-day limit for notifying patients, and if the vendor is its agent, the clock may start when the vendor discovers the breach.²³

Hard questions

Should HHS require annual written verification from every business associate?

The case for: vendor breaches account for most of the people affected (85 percent in 2024), and a signed BAA tells a covered entity almost nothing about whether controls are working. An annual expert analysis and certification would force vendors to check themselves and give covered entities something concrete to review.⁷²² The case against: small practices and small vendors would bear real costs; HHS's own impact analysis put first-year costs for the full proposal in the billions of dollars (widely reported as about $9.3 billion); large vendors already produce SOC 2 and HITRUST reports, while small ones may produce paper that adds little security. What the evidence shows: the Change Healthcare breach began with a remote portal without MFA at one of the largest companies in health care, which suggests paper alone does not catch single control failures, but there is no study yet showing whether certification requirements reduce breaches. The rule is still a proposal, with final action projected for July 2027.³¹³⁴

Should the largest vendors face stricter rules than everyone else?

The case for: one clearinghouse outage stopped claims for a large share of U.S. providers in 2024. Federal banking regulators have authority to examine certain technology service providers to banks; health care has no equivalent for systemically important vendors. The case against: HIPAA already makes business associates directly liable; new tiers would add complexity and could entrench the largest firms, which can afford compliance staff. What the evidence shows: the HSCC's SMART toolkit (2025) was built because the sector itself identified systemic third-party risk as a gap; whether new federal rules are the answer is a policy choice, and Congress and HHS had not acted on a separate regime as of October 2026.²⁵

Should the tracking ruling be the end of the matter?

The case for the court's view: a visit to a public web page about a condition, linked to an IP address, does not show that the visitor is a patient, so treating it as PHI stretched the definition, and OCR issued the guidance without notice and comment. The case for broader protection: advertising companies can often link IP addresses and other identifiers to real people, and patients reasonably expect a hospital website not to tell advertisers what conditions they looked up. What the evidence shows: the vacated part was narrow, OCR's guidance on portals, apps and forms stands, and the largest tracking breaches reported (Kaiser, 13.4 million; Blue Shield of California, about 4.7 million) involved members and logged-in users, not just anonymous visitors.¹⁰³⁶³⁹

Should AI vendors be allowed to train models on patient data?

The case for: models trained on real clinical data perform better, and de-identified training data has long been used in research; strict limits could slow tools that reduce clinician burnout and documentation errors. The case against: clinical audio and notes are hard to de-identify reliably, patients are not asked, and the commercial value goes to the vendor. What the evidence shows: HIPAA's existing rules already limit a business associate to uses the BAA permits, and de-identification must meet 164.514. The open question is not whether the rules apply but whether covered entities read and negotiate the terms; OCR has not issued AI-specific guidance to settle the gray areas.⁴⁴²

Where to go next

• HHS Sample Business Associate Agreement Provisions: Free HHS model language covering the HIPAA-required terms. For privacy officers and practice managers drafting or reviewing BAAs; use it as the floor and add the negotiated terms from this lesson.
• OCR Guidance on HIPAA and Cloud Computing: Free OCR Q and A on cloud providers, encryption without the key, SLAs, offshore storage and audits. Read it before signing with any hosting or SaaS vendor.
• HHS Business Associates FAQs: Free HHS list of who is and is not a business associate, including MSPs, chatbots and transcription apps. Useful as a screening reference when building a vendor inventory.
• HHS Healthcare and Public Health Cybersecurity Performance Goals: Free, voluntary list of 20 goals from HHS, including vendor cybersecurity requirements and third-party incident reporting. Good for setting the controls you require of vendors.
• CISA Guide to Securing Remote Access Software: Free joint government guide (June 2023) on how remote access tools are abused and how to defend them. For IT leads and MSPs serving clinics.
• HHS Security Risk Assessment Tool: Free HHS tool for small and medium providers, version 3.7, which includes questions on vendors and remote access. Data stays on your computer.
• HSCC Health Industry Cybersecurity Sector Mapping and Risk Toolkit (SMART): News report on the free HSCC toolkit (October 2025) for ranking third-party vendors by systemic risk; the article links the industry council's materials. For larger organizations sorting hundreds of vendors.

Still being checked (11 items)

These points could not be fully confirmed against a primary source when this lesson was written and fact checked in October 2026. The text above states each one as uncertain.

• The February 12, 2024 date for initial access to Change Healthcare comes from reports of company testimony; the HHS pages read state the February 21, 2024 detection and the breach report figures, not the access date.
• HHS's cost estimate for the proposed Security Rule update (about $9.3 billion in the first year) is widely reported from the regulatory impact analysis; the HHS press release would not load during research.
• The tracking bulletin's original issue date: HHS page metadata shows November 2022, while secondary sources give December 1, 2022. The March 18, 2024 revision date is from secondary sources.
• The status of the Sharp HealthCare ambient AI lawsuit after December 2025 could not be confirmed; it is described as an allegation.
• The Kaniksu Community Health and Aesto Health figure (about 88,000) and the 2023 Idaho Department of Health and Welfare Medicaid incident (2,501 members) come from HIPAA Journal and KTVB, not from primary records read today.
• Kaiser Permanente's 13.4 million figure is the company's count of people whose information may have been transmitted; how many records were actually shared is not known.
• No OCR enforcement under 45 CFR 92.210 and no OCR action against Change Healthcare had been announced as of October 28, 2026; this is an absence of evidence from the OCR newsroom and resolution agreement list.
• The analysis of AI model training on PHI applies 45 CFR 164.502 and 164.504 and is this lesson's interpretation; OCR has issued no AI-specific BAA guidance.
• HITRUST control counts and validity periods are as stated on HITRUST's website in October 2026 and may change.
• The number of people affected in the Virtual Private Network Solutions ransomware breach was not confirmed in a primary source on Oct. 28, 2026, so no count is given; the 12 covered entity clients and the Oct. 31, 2021 discovery date come from TechTarget's report of the OCR release.
• Details of the Sharp HealthCare complaint (filing month, court, Abridge app, July visit) come from Becker's Hospital Review; the article and court docket could not be opened on Oct. 28, 2026.

Last verified October 28, 2026. General education, not legal, compliance or medical advice; rule versions and dates are stated in the text, and the sources used are listed in the Notes and Sources below. Check the regulator's current text before relying on any point.

Notes

1. 45 CFR 160.103, definitions of "business associate," "subcontractor" and "workforce," as amended by the Omnibus Rule, 78 FR 5566 (Jan. 25, 2013), Cornell LII copy of current text (read Oct. 28, 2026). Read it online. ↩
2. HHS Office for Civil Rights, Guidance on HIPAA and Cloud Computing, published Oct. 6, 2016, content last reviewed Dec. 23, 2022 (read Oct. 28, 2026). Read it online. ↩
3. 45 CFR 164.502(a)(3), (a)(4) and (e), current text as amended through 78 FR 5566 (Jan. 25, 2013), Cornell LII (read Oct. 28, 2026). Read it online. ↩
4. 45 CFR 164.504(e), business associate contracts; history 65 FR 82802 (Dec. 28, 2000), 67 FR 53267 (Aug. 14, 2002), 68 FR 8381 (Feb. 20, 2003), 78 FR 5697 (Jan. 25, 2013), Cornell LII (read Oct. 28, 2026). Read it online. ↩
5. 45 CFR 164.314(a), Security Rule organizational requirements; history 68 FR 8376 (Feb. 20, 2003), 78 FR 5694 (Jan. 25, 2013), 78 FR 34266 (June 7, 2013), Cornell LII (read Oct. 28, 2026). Read it online. ↩
6. HHS, Business Associate Contracts: Sample Business Associate Agreement Provisions, published Jan. 25, 2013 (read Oct. 28, 2026). Read it online. ↩
7. HHS Office for Civil Rights, Annual Report to Congress on Breaches of Unsecured Protected Health Information for Calendar Year 2024 (663 reports of 500 or more; 106 involving business associates affecting 206,921,071; largest about 192,000,000) (read Oct. 28, 2026). Read it online. ↩
8. HHS, Business Associates Frequently Asked Questions (FAQs), content last reviewed Oct. 21, 2026, examples of business associates and of relationships that are not (read Oct. 28, 2026). Read it online. ↩
9. 45 CFR 92.210, nondiscrimination in the use of patient care decision support tools, added by 89 FR 37522 (May 6, 2024), Cornell LII (read Oct. 28, 2026). Read it online. ↩
10. HIPAA Journal, "Largest Healthcare Data Breaches of 2025," June 5, 2026 (Conduent Business Services 62,224,658; Blue Shield of California 4,700,000, tracking tools) (read Oct. 28, 2026). Read it online. ↩
11. HIPAA Journal, "July 2026 Healthcare Data Breach Report," Oct. 15, 2026 (Boundary Regional Community Health Center, dba Kaniksu Community Health, about 88,000, hacking at business associate Aesto Health) (read Oct. 28, 2026). Read it online. ↩
12. "Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules Under the HITECH Act and GINA; Other Modifications to the HIPAA Rules," final rule, 78 FR 5566 (Jan. 25, 2013) (read Oct. 28, 2026). Read it online. ↩
13. HHS Office for Civil Rights, Direct Liability of Business Associates fact sheet, May 24, 2019, last reviewed July 16, 2021 (read Oct. 28, 2026). Read it online. ↩
14. HHS FAQ 245, "Are the following entities considered business associates under the HIPAA Privacy Rule: US Postal Service, United Parcel Service, delivery truck line employees and/or their management?" created Dec. 19, 2002, last reviewed Jan. 9, 2023 (read Oct. 28, 2026). Read it online. ↩
15. HHS FAQ, "What if a HIPAA covered entity (or business associate) uses a CSP to maintain ePHI without first executing a business associate agreement with that CSP?" Oct. 6, 2016, last reviewed Jan. 11, 2023 (read Oct. 28, 2026). Read it online. ↩
16. HHS, "Widespread HIPAA vulnerabilities result in $2.7 million settlement with Oregon Health and Science University," July 18, 2016 (read Oct. 28, 2026). Read it online. ↩
17. 45 CFR 164.308(b), business associate contracts and other arrangements (Security Rule), as amended by 78 FR 5566 (Jan. 25, 2013), Cornell LII (read Oct. 28, 2026). Read it online. ↩
18. Covington and Burling, Inside Privacy, "HITECH Update: 6 New Requirements for Business Associate Agreements," Jan. 24, 2013 (removal of the report-to-HHS requirement; Sept. 22, 2014 transition deadline) (read Oct. 28, 2026). Read it online. ↩
19. BankInfoSecurity, "2 HIPAA Business Associates Pay HHS Ransomware Settlements," January 2025 (Elgon Information Systems $80,000; Virtual Private Network Solutions $90,000), reporting OCR releases of Jan. 7, 2025 (read Oct. 28, 2026). Read it online. ↩
20. HHS press release, OCR settlement with BST and Co. CPAs, LLP (business associate), Aug. 18, 2025 (read Oct. 28, 2026). Read it online. ↩
21. HHS press release, "OCR Settles Four Ransomware Investigations," Apr. 23, 2026 (including Consociate Health, a business associate, $225,000) (read Oct. 28, 2026). Read it online. ↩
22. HHS, HIPAA Security Rule Notice of Proposed Rulemaking to Strengthen Cybersecurity for Electronic Protected Health Information fact sheet, Dec. 27, 2024 (business associate annual verification; 24-hour contingency plan notice; asset inventory and network map; testing frequencies) (read Oct. 28, 2026). Read it online. ↩
23. 45 CFR 164.404(a)(2), breaches treated as discovered, including knowledge of agents determined under the federal common law of agency, Cornell LII (read Oct. 28, 2026). Read it online. ↩
24. 45 CFR 164.316(b)(2)(i), documentation retained six years from creation or last effective date, Cornell LII (read Oct. 28, 2026). Read it online. ↩
25. GovInfoSecurity, "Free Healthcare Toolkit Ranks, Maps Third-Party Risk," Oct. 8, 2025, on the Health Sector Coordinating Council's Health Industry Cybersecurity Sector Mapping and Risk Toolkit (SMART) (read Oct. 28, 2026). Read it online. ↩
26. HHS, Healthcare and Public Health Sector Cybersecurity Performance Goals, released Jan. 2024, voluntary (read Oct. 28, 2026). Read it online. ↩
27. AICPA and CIMA, SOC for Service Organizations Engagements overview (SOC 2 and the Trust Services Criteria) (read Oct. 28, 2026). Read it online. ↩
28. HITRUST, "Cybersecurity Compliance Certifications and Assessments" (e1, i1, r2 and AI Security assessments) (read Oct. 28, 2026). Read it online. ↩
29. HHS 405(d) Program and Health Sector Coordinating Council, Technical Volume 1: Cybersecurity Practices for Small Health Care Organizations, 2023 edition, sub-practice 10.S.D (read Oct. 28, 2026). Read it online. ↩
30. "HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information," proposed rule, 90 FR 898 (Jan. 6, 2025), docket HHS-OCR-2024-0020 (read Oct. 28, 2026). Read it online. ↩
31. Unified Agenda, RIN 0945-AA22, 2026 agenda (publication 202510): long-term action, final action projected 07/2027 (read Oct. 28, 2026). Read it online. ↩
32. CISA, NSA, FBI and partner agencies, "Protecting Against Cyber Threats to Managed Service Providers and their Customers," advisory AA22-131A, May 11, 2022 (read Oct. 28, 2026). Read it online. ↩
33. CISA and partners, Guide to Securing Remote Access Software, June 6, 2023 (read Oct. 28, 2026). Read it online. ↩
34. SC Media, "Change Healthcare incident caused by compromised Citrix credentials," April 2024, reporting Andrew Witty's prepared testimony (Citrix portal without MFA; 15 billion transactions a year; reported $22 million ransom) (read Oct. 28, 2026). Read it online. ↩
35. HHS Office for Civil Rights, Change Healthcare Cybersecurity Incident Frequently Asked Questions, last reviewed Aug. 13, 2025 (read Oct. 28, 2026). Read it online. ↩
36. HHS Office for Civil Rights, Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates, first issued 2022, revised March 2024, with note on the June 20, 2024 order in Am. Hosp. Ass'n v. Becerra, No. 4:23-cv-1110 (N.D. Tex.) (read Oct. 28, 2026). Read it online. ↩
37. Proskauer, "Shortly After Its Online Tracking Technologies Bulletin Is Declared Unlawful, HHS OCR Stands Down, Withdraws Appeal," 2024 (read Oct. 28, 2026). Read it online. ↩
38. Google Analytics Help, "HIPAA and Google Analytics" (read Oct. 28, 2026). Read it online. ↩
39. Healthcare Innovation, "Kaiser Permanente: Data Breach Might Affect 13.4M Members," Apr. 26, 2024 (read Oct. 28, 2026). Read it online. ↩
40. Healthcare IT News, "NewYork-Presbyterian pays $300K to settle NY pixel tracking case," Dec. 28, 2023 (read Oct. 28, 2026). Read it online. ↩
41. Federal Trade Commission, "Health Breach Notification Rule," final rule, 89 FR 47028 (May 30, 2024), effective July 29, 2024 (GoodRx and Easy Healthcare cases cited in the preamble) (read Oct. 28, 2026). Read it online. ↩
42. 45 CFR 164.514(a) to (c), de-identification by safe harbor or expert determination, Cornell LII (read Oct. 28, 2026). Read it online. ↩
43. American Hospital Association News, "HSCC releases guide on third-party AI risk, supply chain transparency," Apr. 15, 2026 (read Oct. 28, 2026). Read it online. ↩
44. National Institute of Standards and Technology, AI Risk Management Framework (AI RMF 1.0, NIST AI 100-1, January 2023) (read Oct. 28, 2026). Read it online. ↩
45. Becker's Hospital Review, "Patient sues Sharp HealthCare over ambient AI use," Dec. 15, 2025 (read Oct. 28, 2026). Read it online. ↩
46. "Nondiscrimination in Health Programs and Activities," final rule, 89 FR 37522 (May 6, 2024), effective July 5, 2024; 92.210(b) and (c) apply within 300 days of the effective date (May 1, 2025) (read Oct. 28, 2026). Read it online. ↩
47. 45 CFR 92.4, definitions of "covered entity" and "patient care decision support tool," Cornell LII (read Oct. 28, 2026). Read it online. ↩
48. LiveCompliance, AI in health care regulations tracker, current as of Oct. 27, 2026 (status of 45 CFR 92.210) (read Oct. 28, 2026). Read it online. ↩
49. HHS Office for Civil Rights blog, "Ensuring Nondiscrimination in the Use of AI is Good Medicine," Jan. 10, 2025; the hhs.gov address now redirects to the HHS web archive (observed Oct. 28, 2026). Read it online. ↩
50. HHS, Guidance to Render Unsecured Protected Health Information Unusable, Unreadable, or Indecipherable to Unauthorized Individuals (2009; NIST SP 800-88 for media sanitization) (read Oct. 28, 2026). Read it online. ↩
51. HHS Office for Civil Rights, Resolution Agreements and Civil Money Penalties list (read Oct. 28, 2026). Read it online. ↩
52. HHS, North Memorial Health Care resolution agreement announcement ($1,550,000), Mar. 16, 2016 (read Oct. 28, 2026). Read it online. ↩
53. HHS, Raleigh Orthopaedic Clinic, P.A. resolution agreement and corrective action plan ($750,000), Apr. 19, 2016 (read Oct. 28, 2026). Read it online. ↩
54. HHS, "No Business Associate Agreement? $31K Mistake," The Center for Children's Digestive Health, Apr. 20, 2017 (read Oct. 28, 2026). Read it online. ↩
55. HHS, "HIPAA settlement illustrates the importance of reviewing and updating, as necessary, business associate agreements," Care New England Health System ($400,000), Sept. 2016 (read Oct. 28, 2026). Read it online. ↩
56. 45 CFR 164.410, notification by a business associate, without unreasonable delay and no later than 60 calendar days after discovery, Cornell LII (read Oct. 28, 2026). Read it online. ↩
57. HHS Office for Civil Rights, Breach Portal: Notice to the Secretary of HHS Breach of Unsecured Protected Health Information (read Oct. 28, 2026). Read it online. ↩
58. KTVB, report on the Idaho Department of Health and Welfare Medicaid provider payment account incident of Apr. 18, 2023 (2,501 members; Gainwell-managed system), 2023 (read Oct. 28, 2026). Read it online. ↩
59. Idaho Code 28-51-105, disclosure of breach of security of computerized personal information; the Idaho Attorney General posts notices received at https://www.ag.idaho.gov/consumer-protection/security-breaches/ (read Oct. 28, 2026). Read it online. ↩
60. Idaho Code 18-6702(2)(d), interception permitted when one party to the communication has given prior consent (read Oct. 28, 2026). Read it online. ↩
61. HHS Office for Civil Rights, Annual Report to Congress on HIPAA Privacy, Security, and Breach Notification Rule Compliance for Calendar Year 2024 (no audits initiated in 2024 due to a lack of financial resources) (read Oct. 28, 2026). Read it online. ↩