Before You Share Access
Before anything gets sent over, though, somebody needs to ask whether the business associate agreement has actually been signed.
What is a business associate agreement?
In simple words, it is actually a written contract between a practice covered by HIPAA and a company that works with that practice’s patient information. It says how the company may use and share PHI safeguarding it has to keep in place. Further, it also involves careful reporting and what information will be included when the work stops.
What can happen without a BAA
Skipping the BAA can get expensive. North Memorial Health Care is a hospital system in Minnesota. It agreed to pay $1.55 million in 2016 following an OCR investigation. The hospital had given revenue cycle company Accretive Health access to records on roughly 290 thousand patients. Yet the companies worked together for about seven months without a signed BAA. The missing agreement surfaced after a laptop containing patient data was stolen from an Accretive employee’s car.
That case was one of the first OCR settlements built around a missing BAA, and its takeaway is hard to miss. Get the agreement signed before the billing company sees a single record, not after.
Which vendors need a BAA?
Vendor or relationship | Does it need a BAA? |
Medical billing company handling your claims | Generally yes |
Outside coding consultant reviewing patient charts | Generally yes |
Cloud service storing your electronic PHI | Generally yes |
Your own employee doing billing work | No, employees are not business associates |
A supplier whose work never touches PHI | No |
Encrypted files still need a BAA
Why BAAs matter in medical billing
What must a BAA include?
- Which uses and disclosures of PHI are allowed or required
- Limits on any other use or sharing, except as the law requires
- Safeguards, including Security Rule duties for electronic PHI
- Reporting of improper uses and disclosures, including breaches
- Help with patient requests for access, corrections, and accountings of disclosures
- Following Privacy Rule duties that the company takes over for the practice
- Making records available to HHS for compliance reviews
- Returning or destroying PHI when the agreement ends, when possible
- The practice's right to end the agreement if the company seriously breaks it
Terms worth negotiating
Topic | Question to ask |
Incident contacts | Who calls us first, and who’s the backup after hours? |
Reporting deadline | Do we want notice faster than HIPAA’s 60-day limit? |
Subcontractors | How much will you tell us about the outside vendors you use? |
Security proof | Which reports or documents will you share so we can check your setup? |
Insurance and costs | If there’s an incident, who pays for what? |
Transition help | Which records come back to us when we leave, how fast, and is there a fee? |
How quickly must a billing company report a breach?
For a breach of unsecured PHI, the billing company has to notify your practice without unreasonable delay, and in no case later than 60 days after discovering it. HHS breach guidance lays out the rule.
People sometimes read that 60-day figure as a grace period. It isn’t; it’s the absolute outer edge. If your practice wants to hear sooner, write a shorter deadline into the contract, along with what counts as the trigger, when the clock actually starts, and how follow-up updates will reach you.
Keep in mind, too, that plenty of security incidents never turn into reportable breaches. A blocked login attempt is an incident. Whether something needs breach notices is a separate decision, made once someone has looked at the facts.
Make the reporting process specific
What if the billing company uses subcontractors?
What happens to patient information when the contract ends?
Exit planning feels premature when you’re just signing on, which is exactly why it’s the right time. HIPAA requires the BAA to say that PHI will be returned or destroyed when the agreement ends, where that’s feasible. Where it isn’t, the protections stay in place, and the company can only use what it kept for the reasons that made return or destruction impossible.
And no, a billing company can’t hold your records hostage over an unpaid invoice. HHS has said plainly that blocking a practice’s access to its own PHI to settle a payment dispute is an impermissible use, and that PHI has to be returned at the end as the BAA requires.
Beyond the legal minimum, you need a transition plan that actually works for whoever takes over. An open claim might hinge on one appeal letter, a clearinghouse submission receipt, or a note buried in the old company’s system, and a spreadsheet of balances won’t carry any of that across. Before signing, agree on:
- Open claims and patient account data
- Billing notes and appeal documents
- The export format and a secure way to deliver it
- Delivery dates and transition contacts
- Proof that your practice received usable information
- Removing access and handling any leftover copies
None of this is a formal HIPAA checklist, just practical planning. Check your record retention obligations before anything gets deleted, and ask about backups specifically, because closing an account doesn’t always wipe every copy sitting on some backup server.
Does signing a BAA make your practice HIPAA compliant?
Not actually. A BAA is a different game, it is actually a set of promises that does not show you how work is done. If the agreement talks up strong safeguards then onboarding starts with your office one main admin password among five people will be a mismatch before anyone logs in.
Your practice keeps its own HIPAA duties, and the billing company carries direct duties of its own. If you find out the vendor has a pattern of serious BAA violations, HIPAA expects you to take reasonable steps to fix it, and if that fails, to end the arrangement where that’s feasible.
It also helps to name one person as the owner of the vendor relationship, someone who knows where the signed agreement lives, who signs off on access changes, and where concerns should go. For how the Privacy Rule and Security Rule divide up these responsibilities, see our guide to the HIPAA Privacy Rule vs. Security Rule.
A BAA checklist for medical practices
Does the agreement match the relationship?
Make sure the legal names are right and the services listed are the ones you're actually buying.
What does the company really need?
Write down the records and systems involved instead of signing off on blanket access.
Have the documents been read side by side?
The BAA, the service agreement, and any security addendum should tell the same story.
Who calls whom when something goes wrong?
Name a main contact and a backup on both sides, plus how updates will flow.
Which subcontractors are involved?
Find out who else sees PHI and how the billing company keeps tabs on them.
Could you leave cleanly?
Agree now on what data comes back, in what format, and what happens to leftover access and copies.
Ongoing Maintenance
File the signed BAA with the rest of the contract, and pull it out again whenever services, systems, or vendors change.
Make the BAA part of your billing process
When the BAA review is done well, nobody on your team is guessing once patient data starts moving. They know who’s handling it, how a problem finds its way back to the practice, and how the records stay within reach if you ever switch billing companies.
Swift Billing Solutions takes care of the billing for independent practices at a flat 3% collections with no setup fees or any long-term contract required. If you are looking for a switching a medical billing partners to keep your billing process smooth and make your practice financially profitable we are the right people for you.
Frequently asked questions
No. An NDA basically says "keep this confidential." A HIPAA BAA has to include a specific set of required terms, and a generic confidentiality promise doesn't meet that bar.
Yes. The required terms can sit inside a bigger contract, as long as the final document meets the rules and reflects the relationship as it really works.
No. HIPAA has no yearly renewal requirement. Go by whatever term and renewal language is in the agreement itself, and update it when the relationship or the rules change.
No. Health plans are covered entities in their own right, so sending them claims for payment doesn't turn them into your business associate.
No. Health plans are covered entities in their own right, so sending them claims for payment doesn't turn them into your business associate.
Then don't give that vendor any PHI. If the job can't be done without patient information, find a vendor that's willing to sign.
Not necessarily. Whose template you start from doesn't really matter. A vendor's form can be reviewed and negotiated just like your own, as long as the final terms work for your practice.
Yes, as a reference point. The HHS sample provisions are useful, but have the finished agreement checked against your situation and your service contract.
Swift Billing Solutions Team
Our team shares practical guidance on medical billing, coding, denial management, and revenue cycle operations. We write for physicians and practice managers who want to understand billing challenges, reduce avoidable errors, and keep payments moving.
