Business Associate Agreements: The Paperwork Most Practices Forget to Chase Down
Every small healthcare practice works with vendors who touch protected health information (PHI) in some way: a billing company, a cloud backup provider, an IT vendor, even the after-hours answering service. HIPAA requires a signed Business Associate Agreement (BAA) with every one of them.
In practice, this is one of the most commonly overlooked compliance requirements. Practices sign a BAA with their EHR vendor and assume that covers everything, while smaller vendors with real access to PHI go completely unaddressed.
Who Actually Needs a BAA
A BAA is required with any vendor that creates, receives, maintains, or transmits PHI on the practice's behalf. That includes obvious candidates like billing services and IT support, but also less obvious ones: the answering service that takes patient calls after hours, the shredding company, the cloud storage tool a staff member started using without asking, and the marketing platform that syncs patient contact lists.
If a vendor has access to PHI and there is no signed BAA on file, the practice is out of compliance the moment that access exists, regardless of whether the vendor ever mishandles the data.
Why This Gap Is So Common
BAAs tend to get signed during onboarding and then forgotten. Vendors change hands, renew under new terms, or get replaced by a similar tool that nobody thought to formally document. Without a running inventory, practices lose track of who has access to PHI and whether the paperwork protecting that access is even current.
During an OCR investigation or a breach involving a vendor, one of the first questions is whether a valid BAA was in place. Practices that can't produce one face liability for a gap that had nothing to do with their own staff or systems.
What Good Vendor Management Looks Like
A defensible approach starts with a full inventory of every vendor that touches PHI, followed by a review of whether a current, signed BAA exists for each one. From there, it needs to be maintained: new vendors added before they get access, renewals tracked, and old agreements retired when a vendor relationship ends.
How Consolidated IT Solutions Can Help
Tracking BAAs across every vendor a practice uses is tedious, and it's exactly the kind of ongoing task that falls through the cracks without dedicated ownership. Consolidated IT Solutions helps with:
- A full vendor inventory to identify every system and service touching PHI
- A gap check against your current BAA paperwork
- Templates and coordination to get missing agreements signed
- Ongoing BAA tracking and renewal management as part of a managed compliance service
- Documentation ready to show auditors or cyber insurers on request