HIPAA Business Associate: Who Signs Which Agreement?

Separate the person from the agreement

A business associate is a role under HIPAA. A business associate agreement, often called a BAA, is the written arrangement governing that relationship. Calling a document a BAA does not make every proposed task permissible. Start with who performs the service, for whom, and how protected health information is involved.

HHS includes qualifying subcontractors in the business associate definition. That matters when the company a practice hires relies on another company to handle its data. The service chain may extend beyond the name on the practice's invoice. HHS business associate guidance.

Trace the chain before granting access

Consider an invented practice sale. The covered dental practice hires a billing company to work with protected patient billing information. That company engages an outside data processor for part of the same work. Assume both services meet the relevant business associate definition. No real patient information is used in this example.

For a qualifying subcontractor, HHS assigns the downstream agreement to the business associate engaging it. The covered practice is not required to sign a direct BAA with that subcontractor merely because it is downstream. That does not excuse the practice from reviewing its own vendor relationship or other duties. HHS guidance, subcontractor discussion and footnote 5.

Now change one fact. The buyer proposes hiring that processor directly for a separate service after closing. The old chain diagram no longer answers the whole question. Identify the new client, task, information and start date. Have counsel assess the new arrangement before access expands. Do not assume the seller's contract follows the service into every new relationship.

Keep the service description beside the contract

Ask the vendor to describe the work and any relevant subcontracting. Match that description to the legal entities and agreement. Record which party receives incident reports and who can answer a patient-access request. Keep a named owner for unresolved terms so the issue does not disappear between the seller's and buyer's teams.

HHS's sample provisions address permitted use, safeguards, reporting, subcontractors and termination. They can guide a discussion, but they are not a finished agreement for this transaction. HHS also cautions that the sample alone may not satisfy state contract law. HHS sample business associate provisions.

For the broader question of whether buyer diligence may use patient data, read the HIPAA sale guide. For the later custody and usable-access handoff, use the records transfer guide. This term explains the service relationship; it does not replace either review.

Preserve commercial confidentiality separately

Begin buyer outreach with a blind teaser and obtain an NDA before identifying the practice. Agree when staff who maintain vendor records need a limited briefing, and who will announce the wider transition. Those business-disclosure steps do not authorize patient-data sharing or postpone required patient notices. Keep the privacy decision with the responsible professionals.