HIPAA Business Associate Agreement (BAA) for Healthcare Software Vendors: EHR Integration, Custom EHR and Data Engineering

A HIPAA Business Associate Agreement (BAA) is the written contract a healthcare organization must have before a vendor creates, receives, maintains or transmits protected health information (PHI) on its behalf. If your team builds EHR integrations, custom EHR software or healthcare data pipelines, and anyone on your side can reach real patient data, the BAA must be signed before that access starts.

This guide is for the teams that build healthcare software: EHR integration vendors, EHR development partners and healthcare data engineering teams. Every rule links to the regulation, to guidance from the US Department of Health and Human Services (HHS), or to the vendor's own page.

This is general information, not legal advice.

Key facts

• HIPAA requires a BAA before a business associate creates, receives, maintains or transmits PHI for a covered entity (45 CFR 164.502(e)).
• A subcontractor that handles PHI for a business associate is itself a business associate (45 CFR 160.103).
• A cloud provider that stores encrypted PHI without the key is still a business associate (HHS cloud guidance, Q2).
• A business associate must report a breach within 60 calendar days of discovery at the latest (45 CFR 164.410(b)).
• Data de-identified by Safe Harbor (18 identifier types removed) or Expert Determination is not PHI (45 CFR 164.514(b)).

What is a HIPAA Business Associate Agreement?

A HIPAA Business Associate Agreement is the contract that lets a covered entity, such as a clinic, hospital or health plan, share PHI with a vendor. It limits what the vendor may do with the data, requires security safeguards and incident reports, and requires the data to be returned or destroyed when the work ends.

HIPAA calls the vendor a business associate (45 CFR 160.103). HHS names app developers, cloud providers, and IT or EHR vendors whose support work touches electronic PHI as examples (HHS business associate FAQs). Since 2013, a business associate is also directly liable for the Security Rule, breach notice and its own subcontractor BAAs (HHS direct liability fact sheet).

Who signs the BAA with whom?

Each party signs a BAA with the party it hands PHI to. A clinic signs with its direct vendor. That vendor signs a subcontractor BAA with every company it hires to handle the same PHI, such as an engineering partner or a cloud provider. The clinic does not need to sign with those subcontractors (45 CFR 164.502(e)(1)).

Do you need a BAA? How to decide

You need a BAA when your client is a covered entity or a business associate and your team will create, receive, maintain or transmit its PHI. You do not need one for synthetic data, data de-identified under HIPAA rules, pure transmission services, or the client's own workforce. Encryption alone does not remove the need.

• Synthetic data only: no PHI, so no BAA for that work. Most sandbox builds fall here.
• De-identified data: not PHI if done by Safe Harbor or Expert Determination. Masking names alone is not de-identification. See our Safe Harbor and Expert Determination guide.
• Conduits: services that only carry data, like the postal service (HHS FAQ 245). HHS limits the exception to transmission with only temporary storage (cloud guidance, Q3). An app that stores messages, even end-to-end encrypted ones, is not a conduit.
• Workforce and treatment: staff under the client's direct control, and provider-to-provider sharing for treatment, need no BAA.
• Other contracts: an NDA does not meet BAA terms. A data use agreement covers a limited data set (164.514(e)).

Which tools in your vendor stack need a BAA?

Every tool that creates, receives, stores or transmits PHI on your behalf needs a BAA (pure conduits that only transmit are the narrow exception), and many vendors offer one only on certain plans or services. That includes cloud hosting, AI and LLM APIs, SMS and voice, email, CRM, product analytics, logging and error tracking, support desks and backups. Tools that never receive PHI do not need one.

Which named vendors sign a BAA, and on which plan?

Each row below comes from the vendor's own page, checked November 13, 2026. Where the vendor's page did not confirm the plan or the terms, the row says to check with the vendor.

Tools to check before sending PHI

Several vendors offer a self-service BAA you accept in the product: the OpenAI API Platform settings, the Google Workspace admin console, and AWS Artifact, where accounts in an AWS Organization can accept the AWS BAA together (AWS Artifact agreements).

Do marketing pixels and website tracking need a BAA?

Yes, when a tracking tool receives PHI. HHS guidance says tracking technology vendors that receive PHI are business associates and need a BAA, and that tracking on logged-in pages such as patient portals generally has access to PHI. A cookie banner is not a valid HIPAA authorization.

The same HHS page notes that on June 20, 2024, a federal court in Texas vacated part of this guidance: the part saying HIPAA applies when a tracking tool links an IP address with a visit to a public, unauthenticated page about health conditions or providers. HHS says it is evaluating next steps (HHS OCR tracking technologies guidance). Tracking inside patient portals, booking flows and mobile apps is still covered by the rest of the guidance.

Do AI and LLM tools need a BAA in EHR integration and data pipelines?

Yes. An AI or LLM API that receives prompts, documents or outputs containing PHI is a business associate and needs a BAA. The BAA usually covers only certain products and only after the right account setup, so configure the organization and its data retention settings as the vendor's documentation requires before sending PHI.

What the vendors' own pages say, checked November 13, 2026:

• OpenAI: an organization must enter a BAA before using the OpenAI API with PHI. Eligible organizations accept it in the API Platform settings, and it covers only the eligible API services. OpenAI does not offer a BAA for ChatGPT Business (OpenAI help article).
• Anthropic: Anthropic offers a BAA for its HIPAA-ready services, such as its first-party API and Enterprise plans. To use the API with PHI, the organization's Primary Owner signs the BAA and then contacts Anthropic sales to have it turned on. The BAA covers only the organization that accepted it and excludes features such as Claude Console and beta features. Covered models require 30-day data retention and are not available with zero data retention unless Anthropic has authorized it for that organization (Anthropic privacy center).

These habits keep AI work inside HIPAA:

• Minimum necessary: send the fields the task needs, not the full chart. HIPAA's minimum necessary rule applies directly to business associates (HHS fact sheet).
• De-identify where you can: classification, routing and model evaluation often work on de-identified text.
• Cover every store: vector databases, RAG indexes and prompt logs hold PHI, so their hosts need a BAA too.

What does a HIPAA BAA have to contain?

The terms a HIPAA BAA must include, under 45 CFR 164.504(e)(2) and 164.314(a), cover permitted uses, a ban on other uses, safeguards, incident reporting, subcontractor flow-down, patient rights, Privacy Rule duties the vendor takes on, HHS access, return or destruction of PHI, and termination.

1. Permitted and required uses of PHI.
2. No other use or disclosure except as the contract allows or the law requires.
3. Appropriate safeguards, including the Security Rule for electronic PHI.
4. Reporting of misuse, security incidents and breaches of unsecured PHI.
5. Subcontractors that handle PHI agree to the same restrictions.
6. PHI made available for patient access, amendment and an accounting of disclosures.
7. If the vendor carries out a covered entity's Privacy Rule obligation, it complies with the Privacy Rule requirements for that obligation (164.504(e)(2)(ii)(H)).
8. Practices, books and records open to HHS.
9. Return or destruction of PHI at the end, or continued protection if that is not feasible.
10. Termination by the covered entity for a material breach.

HHS publishes sample BAA provisions that many clients start from.

What a customer's BAA asks of a vendor

Customer BAAs usually go further than the rule. The middle column is the law; the right column is common commercial practice, not a HIPAA requirement.

Is a BAA the same as SOC 2 or HITRUST?

No. A BAA is a contract that HIPAA requires. SOC 2 is an audit report a CPA firm issues on a service organization's controls under AICPA standards. HITRUST is a framework with assessments that can lead to certification. HHS does not certify anyone as HIPAA compliant, so there is no official HIPAA certification.

What should a healthtech company have in place at each stage?

The list below is common practice we see in customer security reviews, not a legal requirement. HIPAA requires a BAA and a Security Rule risk analysis once you handle PHI; SOC 2 and HITRUST are what customers ask for as deals get larger.

For the risk analysis itself, HHS publishes guidance on risk analysis, and HHS and ONC offer a free Security Risk Assessment Tool that walks you through it.

When does the BAA need to be signed in a project?

The BAA must be signed before the first moment anyone on the vendor side can reach real patient data. In most projects that is the first test on a copy of production data, well before go-live. Sandbox work with synthetic records can start without one.

How does a BAA apply to EHR integration support?

An EHR integration vendor needs a BAA from the moment an engineer can open a real message, host the integration, or read logs that contain payloads. A failed lab result in an athenahealth sync shows where that line sits and how to keep access narrow.

Log error codes and correlation IDs, never payloads. When the engineer must see the record, grant access to that one record in a viewer that logs who opened it. Before a replay, check whether the first attempt landed, or the chart gets the same result twice. The same approach works for HL7 feeds and FHIR writes, and we build it into every athenahealth integration.

When does a custom EHR developer need a BAA?

A custom EHR developer needs a BAA from the first acceptance test on real charts, because the system it built, and may host or support, now holds PHI. HHS lists IT vendors whose maintenance or support work involves electronic PHI as business associates.

Give clinicians a protected channel for issues with patient details, and cover the ticketing tool if PHI can land there. Plan the exit at the start, because the BAA requires you to return or destroy PHI when the contract ends.

Where does PHI end up in a healthcare data lake or warehouse?

PHI ends up in far more places than the warehouse tables. Landing buckets, failed-record queues, job logs, backups, notebooks, BI tools and support tickets all hold copies. Each vendor that runs or can open one of those copies is part of the BAA chain.

HHS says that using a cloud provider to maintain electronic PHI without a BAA is a HIPAA violation, and it cites a case where a covered entity stored PHI of more than 3,000 people on a cloud server without one (cloud guidance, Q5). For the warehouse itself, Snowflake requires a signed BAA before PHI is stored and supports PHI in its Business Critical Edition, and Databricks applies its BAA when you enable HIPAA through the compliance security profile. That profile is set per workspace, and Databricks says enabling it on any workspace adds a charge for its Enhanced Security and Compliance add-on (Databricks compliance security profile). On Azure Databricks, Microsoft's docs say to enable it on every workspace that processes PHI, under your BAA with Microsoft (Azure Databricks HIPAA). Before the first live feed, push one synthetic record through, make it fail on purpose, and trace every place it lands.

Can an offshore engineering team access US patient data?

Yes. HIPAA does not prohibit storing ePHI outside the US, and the location risk must be addressed in the Security Rule risk analysis (HHS cloud computing guidance). Client contracts often add their own limits on people, locations and devices.

Your customer's contract can restrict offshore access even when HIPAA does not, and contracts tied to government health programs often do. Ask the customer for the exact clause before you staff the project. Also remember that a BAA is a contract with the legal entity that signs it: ask which entity signs, where it is based, and which governing law applies.

Questions to ask any offshore engineering vendor before PHI access:

• Which named engineers will have access, and how is that list kept current?
• Do engineers work through a virtual desktop or on company-managed devices?
• Which device rules apply: disk encryption, no local copies, no personal phones?
• Are background checks done, and what do they cover?
• Is access logged, reviewed and removed when someone leaves?
• Which audits are complete: ISO 27001, SOC 2, HITRUST?

How Nirmitee handles offshore access. Our ISO 27001:2022 certification covers both our US and India operations. Engineering in India is done by an outsourced delivery partner that works on code, synthetic data and test environments, and does not access PHI. Production access is granted only by a named Elintex Technologies Inc. team member in the US or by the client's own team, and patient data stays in the client's environment. If a project ever needs the India partner to touch PHI, that work starts only after a downstream BAA is signed and the client approves it.

Our Trust Center also lists multi-factor sign-in, least-privilege access granted per project and reviewed, account removal at offboarding, yearly security training, signed confidentiality agreements and audit logs on systems that hold patient data.

Does Nirmitee sign a BAA?

Yes. Nirmitee signs BAAs for EHR integration, custom EHR development and healthcare data engineering when the agreed work requires us to handle PHI. Nirmitee is a healthcare software engineering company that builds EHR integrations, custom EHRs and healthcare data platforms. We sign directly with covered entities, or as a subcontractor when a digital health platform brings us in. For US customers, the BAA is signed by Elintex Technologies Inc., Nirmitee's US entity. Governing law is set in the services agreement.

Before any PHI access, we agree four things with you: what data is in scope, which named engineers need access, where the data is processed, and how support and offboarding work.

Explore our healthcare interoperability work and our custom healthcare software development services. Download the BAA readiness checklist for your vendor stack (one-page PDF), or book a free 30-minute PHI data-flow review.

Last updated November 13, 2026: added scheduling tools, the US signing entity, named vendor terms checked on each vendor's page, tools to check before sending PHI, self-service BAAs, offshore contract questions, the Privacy Rule duty term, Databricks workspace settings and risk analysis resources.