Does a Detox Center EHR Need a BAA?

Often, yes. If a detox center is a HIPAA covered entity and its electronic health record (EHR) vendor creates, receives, maintains, or transmits protected health information (PHI) on the center’s behalf, the vendor is generally a HIPAA business associate. The center must have a business associate agreement (BAA) in place before the vendor handles that information.

The answer depends on what the vendor does with patient information—not simply whether the product is called an EHR or whether the vendor can view the data. Detox centers that provide substance use disorder treatment may also need to account for the additional confidentiality requirements of 42 CFR Part 2.

When a Detox Center EHR Vendor Needs a BAA

A detox center that meets HIPAA’s definition of a covered entity must enter into a BAA with an EHR vendor when the vendor handles PHI on the center’s behalf. A health care provider generally qualifies as a covered entity if it conducts certain health care transactions electronically.

An EHR vendor will commonly be a business associate if it hosts patient records, provides remote troubleshooting or maintenance that may involve PHI, supports data backups, or otherwise creates, receives, maintains, or transmits PHI to provide services to the center. The vendor’s role in handling the information is what matters.

Before the vendor receives access to PHI, the center should confirm that the BAA covers the services being used, including any hosting, support, backup, and data-management functions. A general software or service contract does not necessarily include the terms required in a BAA.

When EHR Software Does Not Create a Business Associate Relationship

A vendor that only sells or licenses software may not be a business associate if it does not access, receive, maintain, or transmit the center’s PHI and does not perform services involving that information. In that limited situation, HIPAA generally does not require a BAA with the software vendor.

For example, a center might install software on its own systems and manage all patient information itself, with no vendor access for hosting, support, or maintenance. But if the vendor can access PHI during troubleshooting—or stores or maintains the information for the center—the relationship may require a BAA.

Assess the actual arrangement, including remote access permissions, data flows, and the vendor’s support practices. A vendor’s statement that it “does not view” patient records does not by itself settle whether it is a business associate.

BAA Requirements for EHR Vendors

A BAA should clearly define the vendor’s permitted and required uses and disclosures of PHI. It should also require the vendor to protect the information and limit its use to the purposes allowed by the agreement and applicable law.

HIPAA requires core contract terms, including provisions that require the EHR vendor to:

• Implement appropriate safeguards for PHI, including applicable Security Rule safeguards for electronic protected health information (ePHI).
• Report impermissible uses or disclosures, security incidents, and breaches of unsecured PHI to the detox center.
• Assist the center with applicable patient rights, such as access to records, amendments, and accounting of disclosures.
• Make relevant records available to the Department of Health and Human Services for compliance review.
• Require its own qualifying subcontractors to accept appropriate privacy and security obligations.
• Return or destroy PHI at the end of the relationship when feasible, and permit termination for a material violation.

The center should review the BAA alongside the main service agreement. For example, the contracts should be consistent about security responsibilities, incident reporting, data access, retention, and what happens to records when service ends.

Cloud EHR Providers and ePHI

A cloud EHR provider that creates, receives, maintains, or transmits ePHI on behalf of a detox center is generally a business associate, so the center needs a BAA with that provider. This applies even if the cloud provider stores only encrypted information and does not hold the decryption key.

Cloud hosting does not remove the center’s own responsibilities. The center should assess risks to ePHI, confirm that its security and contingency measures fit the service, and understand how the provider handles backups, access, incidents, retention, and data return.

If the EHR vendor uses a separate cloud provider or other service provider to handle the center’s ePHI, the EHR vendor may need a BAA with that subcontractor. The center is not generally required to sign a direct BAA with each subcontractor in the vendor’s chain, but it should understand which parties handle its data and how the vendor oversees them.

Subcontractor Obligations Under a BAA

An EHR vendor that is a business associate must use a written agreement to require any qualifying subcontractors that handles PHI on its behalf to follow applicable privacy and security restrictions. A subcontractor can include a cloud host, data-backup provider, or technical support company, depending on its role.

The vendor’s agreement with a subcontractor should extend the relevant safeguards and obligations down the chain. These subcontractor safeguards help protect PHI when a vendor relies on other organizations to provide the EHR service.

The detox center should ask the EHR vendor to explain which subcontractors may handle its PHI, what functions they perform, and how security incidents will be communicated. The center generally contracts with its direct business associate, while that business associate is responsible for obtaining the necessary agreements from its own subcontractors.

42 CFR Part 2 Protections for Substance Use Disorder Records

HIPAA may not be the only federal privacy framework that applies to a detox center. 42 CFR Part 2 protects records maintained by federally assisted programs that provide substance use disorder diagnosis, treatment, or referral for treatment. Whether a specific program or record is subject to Part 2 depends on the circumstances.

When Part 2 applies, the center should ensure that the EHR’s contracts, permissions, workflows, and disclosure controls support the applicable Part 2 requirements as well as HIPAA. Depending on the arrangement, a qualified service organization agreement (QSOA) may also be relevant; it is not automatically a substitute for a HIPAA BAA when the vendor is a HIPAA business associate.

The Part 2 final rule’s compliance date was February 16, 2026. Part 2 records remain subject to protections that are not identical to HIPAA, including restrictions on using or disclosing them in legal proceedings against a patient without the required consent or court order. A detox center should make sure its EHR arrangements account for these protections and limit access and disclosures accordingly.

In short, determine whether the center is subject to HIPAA and Part 2, then assess what the EHR vendor and its subcontractors do with patient records. If the vendor handles PHI on the center’s behalf, a BAA is generally required; if Part 2 applies, the center must also address those additional confidentiality requirements.

FAQs

Does a detox center need a BAA with its EHR vendor?

Generally, yes, if the detox center is a HIPAA covered entity and the EHR vendor creates, receives, maintains, or transmits PHI on the center’s behalf. If the vendor only supplies software and has no access to or role in handling PHI, a BAA may not be required.

Does a cloud EHR provider need a BAA?

Generally, yes. A cloud provider that creates, receives, maintains, or transmits ePHI for a covered entity or business associate is generally a business associate and should have a BAA. This can apply even when the data is encrypted and the provider cannot decrypt it.

What must an EHR vendor BAA include?

A BAA must define permitted and required uses and disclosures of PHI, require appropriate safeguards, address incident and breach reporting, support applicable patient rights, cover qualifying subcontractors, and explain what happens to PHI when the relationship ends. It should also fit the services and security responsibilities described in the main contract.

Do 42 CFR Part 2 records require additional protections?

Yes, when the records and program are subject to Part 2. The center must account for Part 2’s confidentiality and disclosure requirements in addition to applicable HIPAA obligations, including restrictions related to legal proceedings against a patient.