AI Vendor BAA Check

What is a BAA? What a Business Associate Agreement must include

AI Vendor BAA Check · Updated

A Business Associate Agreement (BAA) is the contract HIPAA requires before a vendor handles protected health information (PHI) for a doctor, clinic, health plan or other covered entity. No signed BAA, no patient data: that’s the rule, whether the vendor is a billing company or an AI chatbot.

Who counts as a business associate

Under HIPAA, a business associate is any outside person or company that creates, receives, keeps or transmits PHI while doing work for a covered entity. Their subcontractors that touch the same PHI count too. HHS’s own list of examples includes cloud providers that store health data, EHR and IT vendors, transcription services and, by name, AI chatbot vendors working on a provider’s patient portal.1

Encryption doesn’t get a vendor off the hook. HHS says a cloud service that stores PHI is a business associate even if it holds the data encrypted and has no key to read it, and that using such a service for PHI without a BAA violates HIPAA.3 That reasoning covers AI tools: if the tool stores or processes what your staff type or record, it needs a BAA.

When you don’t need one

HHS lists situations where no BAA is required. The ones people ask about most:

  • Sharing PHI with another provider to treat the same patient, such as a referral or a lab order.
  • Pure “conduits” that only carry information, like the postal service or a courier. A service that stores data or routinely accesses it isn’t a conduit, so an AI tool almost never qualifies.
  • People whose work only brings incidental contact with PHI, like a cleaner or an electrician.
  • Banks and card processors handling payments in their normal banking role.

Your own employees aren’t business associates either. But the tools they use are vendors, so a staff member pasting notes into an AI chatbot brings that chatbot’s vendor into the picture.

What a BAA has to say

HIPAA spells out what the contract must cover. In plain terms, the business associate must:2

  1. Use and disclose PHI only as the contract allows, and say what those uses are.
  2. Not use or disclose it any other way, unless the law requires it.
  3. Protect it with appropriate safeguards, including the HIPAA Security Rule for electronic PHI.
  4. Report any use or disclosure the contract doesn’t allow, including breaches of unsecured PHI.
  5. Help you meet patients’ rights to see, amend and get an accounting of their records.
  6. Follow the Privacy Rule for any of your Privacy Rule duties it takes on.
  7. Open its practices and records to HHS if HHS checks your compliance.
  8. Return or destroy the PHI when the contract ends, if that’s feasible.
  9. Make sure any subcontractor handling the PHI agrees to the same restrictions.
  10. Let you end the contract if it materially breaks the terms.

You don’t have to use HHS’s sample wording, and the terms can sit inside a broader service agreement. Most large vendors use their own standard BAA, accepted with a click or signed through sales.

What to check in an AI vendor’s BAA

A BAA can meet every requirement above and still leave you exposed, because of what it covers. With AI tools, look for these:

  • Which plans it covers. Many vendors sign only for enterprise or healthcare plans. Of the 155 tools we track, 56 sign a BAA only on some plans or setups. The free and personal tiers are almost never included.
  • Which features it covers. Vendors often list the products and features inside the BAA, and new AI features can sit outside it. Of the 96 tools that sign a BAA, 39 leave at least one AI feature out or only partly in.
  • Settings you must turn on. Some BAAs only apply once you enable a HIPAA mode, zero data retention or a separate workspace.
  • Training and retention. Check whether your inputs can be used to train models and how long they’re kept.
  • Who else touches the data. AI vendors often send requests to a model provider or other subprocessor. The BAA’s subcontractor terms should cover them.

Every tool page on this site shows the plans that qualify and the AI features the vendor leaves out, with links to the vendor’s own pages.

Is a signed BAA enough?

No. The BAA makes it lawful to give the vendor PHI, but you still need the right plan and settings, a risk analysis that includes the tool, access controls and staff who know the rules. Our checklist for using AI with patient data walks through the rest.

Sources

  1. Business Associates (guidance)U.S. Department of Health and Human Services
  2. Sample Business Associate Agreement ProvisionsU.S. Department of Health and Human Services
  3. Guidance on HIPAA & Cloud ComputingU.S. Department of Health and Human Services

This guide explains HIPAA in plain terms for people choosing AI tools. It isn’t legal advice; confirm with your counsel and the vendor before sending protected health information.