Every practice knows it needs business associate agreements. Most have a folder of them. Fewer have read one recently, and fewer still could list which vendors are missing.

What a BAA is. A contract required by HIPAA between you and any vendor that creates, receives, maintains or transmits protected health information on your behalf. It obliges them to safeguard the information and to report breaches to you.

What it is not. It is not a transfer of responsibility. You remain accountable for your own compliance and for reasonable diligence about who you hand data to. A signed BAA with a vendor you never checked is paperwork, not protection.

The vendors practices forget

The EHR and the billing company are obvious. The ones that get missed:

Your IT provider, if they can access systems containing ePHI. Which they can, by definition.

Cloud storage and backup, including the backup nobody set up deliberately.

Email, if protected health information moves through it.

Answering, transcription and interpretation services.

Shredding and document destruction.

Anyone doing remote support, however occasionally.

What the agreement should actually say

Beyond the required boilerplate, the things worth insisting on:

A breach notification window with a specific number of days in it, not promptly.

Whether subcontractors are permitted, and confirmation that they are bound by equivalent terms.

What happens to your data when the relationship ends, and how you get it back.

Whether they will confirm in writing, on request, that they have a current risk analysis and security program of their own.

The diligence part

HIPAA expects reasonable diligence, not just a signature. In practice that means asking a vendor how they protect your patients information and keeping the answer.

That question takes five minutes to send. Almost nobody sends it, and it is the single easiest way to be visibly ahead of the standard your peers are meeting.