Why business associate agreements (BAAs) matter more than ever in 2026

Most healthcare organizations know they need business associate agreements with their vendors. Fewer know exactly which vendors need one, what happens further down the chain, or how a BAA differs from the NDAs and service agreements sitting in the same folder.

Those gaps matter more each year. Practices rely on more cloud services and outside vendors, and HHS has proposed tightening what it expects from business associates. A BAA is not a formality. It is the document that decides who is responsible when a vendor loses your patients' data. Here is what to know, and what to check in 2026.

What a BAA is, and who needs one

Under HIPAA, a covered entity (a provider, health plan or clearinghouse) can share protected health information with a vendor that performs work on its behalf only if they have a written business associate agreement. The rules are in the HIPAA regulations at 45 CFR 164.502(e), 164.504(e) and 164.308(b).

A business associate is any outside person or company that creates, receives, maintains or transmits PHI for you. Common examples:

• IT providers and managed service providers
• EHR, billing and practice management vendors
• Cloud hosting, backup and email services
• Billing companies, coders and collection agencies
• Answering services, transcription and document shredding
• Attorneys, accountants and consultants who see PHI

Your own workforce doesn't need a BAA, and neither does another provider receiving PHI to treat the same patient.

The chain continues to subcontractors

Since the 2013 HIPAA Omnibus Rule, the BAA requirement doesn't stop at your vendor. If your business associate uses a subcontractor that creates, receives, maintains or transmits your PHI, the business associate must have its own BAA with that subcontractor, and the same applies further down the chain. Business associates and subcontractors are also directly liable for complying with the HIPAA Security Rule.

That is why a vendor might say, "Just as we sign BAAs with our customers, we are required to sign similar agreements with our subcontractors." It is not extra caution. It is the law. When you review a vendor, ask which subcontractors handle your data and confirm those agreements exist.

Cloud and data platforms need BAAs too

A common question is whether a cloud or data platform needs a BAA when it only stores data, or when the data is encrypted. HHS guidance on cloud computing says yes: a cloud provider that maintains ePHI is a business associate even if the data is encrypted and the provider doesn't hold the key.

The reasoning is that HIPAA protects more than confidentiality. A provider that stores your data affects whether it stays available and intact, and it can still be involved in a security incident. The same logic applies to a data warehouse or analytics platform. If a covered entity or business associate puts PHI into it, the platform is handling that data on their behalf and needs a BAA. Many platforms only sign one for certain plans or configurations, so check before any PHI is loaded.

The conduit exception is narrow

Some vendors claim they are "just a conduit." HIPAA's conduit exception covers services that only transmit information and keep it no longer than transmission requires, such as the postal service or an internet service provider. A service that stores PHI, even temporarily or in encrypted form, is generally not a conduit.

How a BAA differs from your other agreements

Telehealth companies and practices often have several agreements with the same vendor. Each does a different job:

• BAA: required by HIPAA when a vendor handles PHI. It limits how PHI can be used, requires safeguards, requires breach reporting, and requires the return or destruction of PHI at the end.
• NDA: protects confidential business information in general. It doesn't contain HIPAA's required terms, so it can't replace a BAA.
• MSA: the master services agreement sets the commercial relationship: services, fees, liability and term. The BAA usually sits alongside it, and many BAAs say they control where the two conflict on PHI.
• Vendor or data processing agreement: often used for privacy laws such as the GDPR or state privacy laws. It may overlap with a BAA but doesn't satisfy HIPAA unless it includes the required terms.
• Provider and payer agreements: set the terms between a provider and a health plan, such as network participation and reimbursement. Both are usually covered entities sharing PHI for payment and treatment, which doesn't require a BAA.

Why 2026 raises the stakes

OCR has enforced missing BAAs for years. In 2016, North Memorial Health Care paid $1.55 million to settle allegations that included sharing PHI with a major contractor without a BAA.

Expectations are also moving. In January 2025, HHS proposed updates to the HIPAA Security Rule. Among them, business associates would have to verify their technical safeguards in writing at least once a year, and notify covered entities within 24 hours of activating their contingency plans. As of mid 2026, the final rule had not been issued, and the federal regulatory agenda listed it for July 2027. Check the current status with your counsel. Even before anything is final, it shows where regulators expect vendor oversight to go.

Vendor breaches also reach Montana patients directly, often through a company several steps removed from the practice. The BAA is what decides how quickly you hear about one, and who is responsible for what happens next.

A checklist for reviewing your BAAs

• List every vendor that can reach PHI, including IT, cloud, billing and answering services.
• Confirm a signed, current BAA for each one, and file it where you can find it.
• Check breach reporting terms: how quickly the vendor must tell you, and what they must include.
• Ask each vendor which subcontractors handle your data, and confirm they have BAAs.
• Confirm what happens to your data when the relationship ends.
• Review the list every year and whenever you add a vendor.

Where to start

Start with your vendor list. Most practices find at least one vendor with access to PHI and no BAA on file. Our HIPAA services team can review your agreements and vendor list with you, and our HIPAA risk analysis guide shows where vendor risk fits in the bigger picture.