JBMOnboard360 / What is a BAA?
HIPAA guide
What is a business associate agreement? The HHS sample, in plain English.
A business associate agreement (BAA) is the contract HIPAA requires between a covered entity, such as a clinic, and any vendor that creates, receives, maintains or transmits protected health information for it. HHS publishes sample provisions. This guide walks through them clause by clause, says what each one means in practice, and lists what to check before you sign a vendor's BAA.
The basics
Who needs a BAA, and why
HIPAA's Privacy and Security Rules apply to covered entities (health plans, healthcare clearinghouses, and providers who conduct certain transactions electronically, which includes most practices that bill insurance) and to their business associates. A business associate is a person or company that performs a function or service for a covered entity involving protected health information (PHI): a billing company, a cloud host, an IT provider, a CRM, a scheduling tool, an answering service, a shredding company.
Before a covered entity lets a business associate handle PHI, HIPAA requires "satisfactory assurances", in writing, that the vendor will protect it. That written contract is the BAA. Business associates in turn need BAAs with their own subcontractors that touch PHI. HHS's cloud computing guidance makes the point that a cloud provider storing ePHI is a business associate even if the data is encrypted and the provider can't read it.
Enforcement is real. In 2016 the HHS Office for Civil Rights settled with Raleigh Orthopaedic Clinic for $750,000 after it handed X-ray films for about 17,300 patients to a vendor without a BAA, and with North Memorial Health Care for $1.55 million after a business associate without a BAA lost a laptop holding patient data. OCR said at the time that BAAs are more than a check-the-box exercise.
The HHS sample provisions
HHS published Sample Business Associate Agreement Provisions on 25 January 2013, updated for the HITECH Act changes. HHS notes that using them is optional, that they may not be enough on their own to make a binding contract under state law, and that you can add terms. We link to HHS rather than copy a template here, because the right version for you depends on your state and your counsel. The sections, in plain English:
| HHS section | What it says | What it means for you |
|---|---|---|
| Definitions | Uses HIPAA's own definitions for terms like breach, PHI and security incident. | Watch for vendor BAAs that redefine these more narrowly. |
| Use and disclosure limits | The vendor may not use or disclose PHI except as the agreement permits or the law requires. | The vendor can't mine your patient data for its own marketing or product purposes unless the BAA allows it. |
| Safeguards | The vendor uses appropriate safeguards and complies with the Security Rule for electronic PHI. | Ask how: encryption, access control, audit logs, where data is hosted. |
| Reporting | The vendor reports uses or disclosures not allowed by the agreement, including breaches of unsecured PHI and security incidents. | Check the notice period. HIPAA's outer limit for a business associate is 60 days from discovery; many BAAs commit to far less. |
| Subcontractors | The vendor makes sure its subcontractors that handle PHI agree to the same restrictions. | Ask which subprocessors hold your data, such as the cloud host. |
| Access, amendment, accounting | The vendor helps you meet patients' rights to access and amend their records and to an accounting of disclosures. | Make sure you can export a patient's data when they ask. |
| Covered entity obligations carried out by the vendor | If the vendor does something you're obliged to do under the Privacy Rule, it follows the same rules. | Relevant for billing and outsourced front-desk services. |
| Books and records | The vendor makes its practices, books and records available to HHS for compliance checks. | Standard; be wary if a vendor resists it. |
| Permitted uses | What the vendor may do with PHI to provide its service, with optional language on its own management, data aggregation and de-identification. | Read the optional clauses closely; they widen what the vendor can do. |
| Term and termination | When the agreement ends, termination for cause if the vendor breaches it, and what happens to PHI at the end: return or destroy it, or keep protecting what can't be returned. | Plan your exit: how you get data back, and in what format, before you sign. |
Summarized from the HHS sample provisions. This is not a substitute for the HHS text or for advice from your counsel.
Before you sign
Eight questions to ask any vendor about its BAA
- Which plan includes it? Many vendors sign BAAs only on enterprise tiers (Slack and HubSpot are examples) or as a paid add-on.
- Which products does it cover? Google, for instance, covers only listed services; add-ons and other services aren't included.
- How fast will they tell you about a breach?
- Where is the data hosted, and who are the subprocessors?
- Can staff see an audit trail of who opened or changed records?
- What happens when you leave? Export format, deletion timeline, certificate of destruction.
- Are AI features covered? Ask specifically, in writing.
- Does the BAA cover every channel the product uses? A CRM's BAA can't cover WhatsApp, for example, because Meta disclaims business associate status for its platform.
How JBMOnboard360's BAA works
JBMOnboard360 includes a Business Associate Agreement on every plan, from Professional at $79 per user per month billed annually. It covers JBMOnboard360's own system, hosted on AWS in the United States: client records, scheduling, intake forms, invoices, team chat and meeting summaries. It does not cover channels we don't control. In particular, the WhatsApp concierge runs over Meta's platform, which is not HIPAA compliant, so it is limited to general questions and callbacks with no PHI. JBMOnboard360 is not an EHR and doesn't send SMS. See which other vendors sign BAAs in our comparison of 18 CRMs.
Questions
Business associate agreement questions
What is a business associate agreement?
A written contract HIPAA requires between a covered entity and a vendor that creates, receives, maintains or transmits protected health information for it. It limits how the vendor uses the data and requires safeguards, breach reporting and return or destruction of data at the end.
Is there an official BAA template?
HHS publishes sample business associate agreement provisions, last updated in January 2013. Using them is optional, and HHS notes they may not be sufficient on their own under state law, so have counsel review any agreement.
Do I need a BAA if the data is encrypted?
Usually yes. HHS guidance says a cloud provider that stores electronic PHI is a business associate even if the data is encrypted and the provider doesn't hold the key.
Does a BAA make a vendor HIPAA compliant?
No. A BAA is a contract that makes the vendor eligible to handle PHI and binds it to safeguards. You still have to configure and use the product in line with your own HIPAA policies.
What happens if I don't have a BAA with a vendor?
Sharing PHI with a business associate without one is a HIPAA violation by the covered entity. HHS has settled cases over missing BAAs, including $750,000 with Raleigh Orthopaedic Clinic and $1.55 million with North Memorial Health Care in 2016.
Is there a long-term contract?
You choose. Annual plans are a 12-month commitment at the lower annual price, and your price is locked for the term. Monthly plans cost more, and you can cancel them at any time.
Keep reading
Related pages
Sources, checked October 2026: HHS, Sample Business Associate Agreement Provisions; HHS, Guidance on HIPAA and Cloud Computing; reporting on the 2016 OCR settlements, for example Hunton Andrews Kurth and Robinson+Cole. Nothing on this page is legal advice; ask your compliance advisor about HIPAA.
Free consultation
See it with your own workflow.
A free video consultation with the team that builds JBMOnboard360. Tell us how your business runs today, and we'll show you the parts that matter to you, with the AI switched on.
- Completely free
- No obligation, no card needed
- A trial account with your own data if it's a fit
Prefer email? contact@jjstechnologies.com. Partner, investor or press? Book a 1:1 business meeting.
Calendar not loading? Open the booking page.