Security

What is a Business Associate Agreement — and does your IT company have one?

In one sentence

A Business Associate Agreement is a HIPAA-required contract between your practice and any vendor that creates, receives, maintains, or transmits protected health information on your behalf. Your IT company almost certainly qualifies — they maintain the server, database, and email that hold it — so a signed BAA is expected even if they never read a chart. Without one, you have a compliance and liability gap.

Last updated

On this page
6 min read Published
baahipaacompliancevendordental it

What is a Business Associate Agreement (BAA)?

A Business Associate Agreement is a HIPAA-required contract between a covered entity (your dental practice) and a business associate - any vendor that creates, receives, maintains, or transmits protected health information (PHI) on your behalf. It sets out how the vendor will safeguard PHI, what they may do with it, breach-notification duties, and what happens to the data when the relationship ends. In plain terms: if a vendor handles your patient data or maintains the systems that hold it, HIPAA expects a BAA in place before they do. (General information, not legal advice.)

Does your IT company need a BAA?

Almost always, yes. Your IT provider maintains the server, the practice-management database, email, and backups - all of which hold or can expose PHI. That makes them a business associate, and a signed BAA is expected even if they "never look at patient records." Maintaining the systems that hold PHI is what makes them a business associate, not whether they actually read it. (See the vendor BAA gap.)

What a BAA typically covers

  • The permitted uses and disclosures of PHI by the vendor.
  • The safeguards the vendor must maintain to protect PHI.
  • Breach notification - if the vendor has an incident, how and when they tell you.
  • Subcontractor obligations - the vendor's own vendors must be covered too.
  • Return or destruction of PHI when the agreement ends.

What happens without one

Without a BAA, you have both a compliance gap and a liability gap. If a breach involves a vendor and no BAA exists, the practice can be held responsible for the missing agreement on top of the breach itself. It is one of the most common - and most avoidable - HIPAA findings for small practices.

How to get it right

  • Inventory your vendors. List every vendor that creates, receives, maintains, or transmits PHI for you: IT, PMS, imaging, email/cloud, billing, shredding.
  • Get a signed BAA with each - current, not a decade-old copy.
  • Keep copies where you can produce them; an agreement you cannot find is hard to rely on.
  • Expect BAA-by-default. A dental-fluent IT provider signs one as a matter of course, not as an upsell. (See Security & Compliance.)
This is general information about Business Associate Agreements, not legal advice. A qualified compliance professional or attorney can advise on your specific agreements and obligations.

Frequently asked questions

What is a Business Associate Agreement?

A BAA is a HIPAA-required contract between your dental practice and any vendor that creates, receives, maintains, or transmits protected health information on your behalf. It defines how the vendor safeguards PHI, what they may do with it, breach-notification duties, and what happens to the data when the relationship ends.

Does my dental IT company need a BAA even if they never view records?

Almost always, yes. What matters is that the vendor maintains systems that hold protected health information on your behalf, not whether it actually reads it. Your IT provider maintains the server, database, email, and backups, so HIPAA expects a signed BAA before they do that work - regardless of whether they ever open a patient chart.

What happens if I do not have a BAA with a vendor?

You have a compliance gap and a liability gap. If a breach involves a vendor and no BAA is in place, the practice can be held responsible for the missing agreement on top of the breach. It is one of the most common and most avoidable HIPAA findings for small dental practices.

Security7 min read

Are dental practices really HIPAA-compliant? The vendor BAA gap

Many dental practices believe they are HIPAA-compliant but have real gaps — the most common being the vendor BAA gap: an IT company that maintains systems holding patient data on your behalf without a signed Business Associate Agreement. Compliance is ongoing safeguards, agreements, and evidence, not a one-time certificate. Here is where practices fall short.

Read article
Security7 min read

The 2026 HIPAA Security Rule changes every dental office needs to know

The 2026 HIPAA Security Rule changes are a major proposed update — not final law as of mid-2026. If finalized, the proposal would make encryption and MFA mandatory, remove the addressable-versus-required distinction, and add inventories, testing, and tighter oversight. Most of it is good practice now, so prepare without treating it as a current deadline.

Read article
Security9 min read

What are the HIPAA technical safeguards for a dental practice?

The HIPAA Security Rule’s technical safeguards are set out in 45 CFR §164.312 as five standards — access control, audit controls, integrity, person or entity authentication, and transmission security — with seven implementation specifications beneath them, two required and five addressable. They apply to every system that stores or transmits electronic protected health information.

Read article