Does a Digital MSK Platform Need a BAA?

A digital musculoskeletal (MSK) platform may need a business associate agreement (BAA), but the answer depends on who provides the service, whose behalf it operates, and whether it creates, receives, maintains, or transmits protected health information (PHI). A platform does not need a BAA simply because it collects health-related information; HIPAA status depends on the relationship and the information involved.

When HIPAA Applies to Digital MSK Platforms

HIPAA generally applies to covered entities—health plans, health care clearinghouses, and certain health care providers—as well as business associates that handle PHI on behalf of covered entities. A digital MSK platform is not automatically covered by HIPAA just because it offers exercise guidance, pain assessments, virtual coaching, or other health-related features.

For HIPAA to apply to a platform as a business associate, it generally must perform a service for a covered entity or another business associate that involves PHI. Information is not necessarily HIPAA-protected merely because it relates to a person’s health: it must meet HIPAA’s definition of PHI and be handled in a context covered by the law.

HIPAA’s Privacy Rule governs permitted uses and disclosures of PHI. Its Security Rule requires safeguards for electronic protected health information (ePHI). A platform’s specific role, contracts, data flows, and access—not its product label—help determine whether these rules apply.

Covered Entities and Business Associates

A HIPAA covered entity is a health plan, health care clearinghouse, or health care provider that conducts certain transactions electronically. A business associate is generally a person or organization that performs certain functions or services for a covered entity involving PHI, outside the covered entity’s workforce.

A digital MSK vendor may be a business associate when, for example, a health plan or provider engages it to deliver a member or patient program and the platform handles PHI to provide that service. A vendor can also be a business associate when it provides services through another business associate. Subcontractors that handle PHI on a business associate’s behalf may have their own HIPAA obligations and must receive appropriate contractual protections.

Simply selling software to a provider does not necessarily make a vendor a business associate if the vendor does not access or handle the provider’s PHI. But hosting patient data, troubleshooting systems with access to PHI, providing patient messaging, or managing MSK care information on a covered entity’s behalf may create a business associate relationship.

When a Business Associate Agreement Is Required

A covered entity generally must obtain written assurances from a business associate before allowing it to handle PHI on the covered entity’s behalf. Those assurances are usually documented in a business associate agreement. A covered entity must also have an appropriate written agreement with a business associate when that business associate provides services involving PHI to the covered entity.

The relationship matters: a platform may handle health information without acting as a business associate if it is not performing a service on behalf of a covered entity or another business associate. Conversely, a vendor may qualify as a business associate even if it does not directly provide clinical care.

A platform that stores or processes ePHI for a covered entity or business associate may be a business associate even if the information is encrypted and the vendor cannot decrypt it. Encryption alone does not remove the need to assess the relationship or determine whether a BAA is required.

Platform Activities That Involve Protected Health Information

Review what the platform does with data and whether it performs those activities for a covered entity or business associate. Potentially relevant activities include:

• Collecting pain scores, injury details, mobility assessments, or treatment information for a provider’s patients or a health plan’s members.
• Providing virtual MSK consultations, patient messaging, care navigation, or exercise monitoring on behalf of a covered entity.
• Connecting to a covered entity’s electronic health record or receiving referrals and clinical information for program delivery.
• Hosting, processing, backing up, or transmitting ePHI for a covered entity or business associate.
• Producing reports that identify individuals or disclose their health information to the sponsoring covered entity.
• Providing technical support that requires access to PHI, even if that access is occasional.

Assess the full data lifecycle, including information collected in the app, exchanged through integrations, stored by the vendor, available to support staff, and sent to employers, plans, or providers. A platform’s ability to view data is not the only factor: maintaining or transmitting ePHI can also be relevant.

BAA Provisions for Digital MSK Services

A BAA should describe the service and set clear limits on how the platform may use and disclose PHI. It should address the platform’s obligation to safeguard PHI, including ePHI, and comply with applicable HIPAA requirements.

Key provisions generally cover:

• Permitted and required uses and disclosures of PHI, and limits on other uses or disclosures.
• Appropriate safeguards, including applicable Security Rule protections for ePHI.
• Reporting unauthorized uses or disclosures, security incidents, and breaches as required by the agreement and applicable rules.
• Assistance with individual rights and covered-entity duties when the platform performs related functions.
• Access to relevant records for the U.S. Department of Health and Human Services’ compliance activities.
• Requirements for subcontractors that handle PHI to accept appropriate restrictions and protections.
• Return or destruction of PHI, when feasible, at the end of the relationship, and the consequences of a material violation.

The BAA should match the platform’s actual features, integrations, support model, and data flows. Signing a BAA does not by itself make a service HIPAA-compliant; the parties must also follow the agreement and meet their applicable HIPAA obligations.

Exceptions for Consumer Health Apps

A direct-to-consumer MSK app that individuals choose and use independently may fall outside HIPAA if it is not operating on behalf of a covered entity or business associate. In that situation, HIPAA generally does not require the app developer to sign a BAA merely because users enter pain, exercise, or mobility information.

There can be an important difference between an app an individual independently selects and one provided by or on behalf of a covered entity. If a provider or health plan engages a platform to deliver services using PHI, the vendor may be a business associate. An app’s role in simply transmitting information at an individual’s direction does not, by itself, necessarily create a business associate relationship.

Information outside HIPAA may still be subject to other privacy, security, consumer-protection, or state laws. A platform should assess those obligations separately rather than assume that being outside HIPAA means health information is unregulated.

Steps to Assess BAA Requirements

1. Identify the contracting parties. Determine whether the platform serves a provider, health plan, clearinghouse, business associate, employer, or individual user.
2. Map the platform’s activities. Document what the platform collects, creates, receives, stores, transmits, and can access, including through integrations and support tools.
3. Determine whether the information is PHI. Assess whether the data is individually identifiable health information handled by or for a covered entity or business associate.
4. Establish whose behalf the platform acts on. Determine whether the vendor performs a service for a covered entity or business associate, rather than simply providing a product to an individual.
5. Review vendors and subcontractors. Identify cloud providers and other partners that create, receive, maintain, or transmit ePHI on the platform’s behalf, and determine which agreements are needed.
6. Document the decision. Record the relationship and data-flow analysis, execute a BAA when required, and revisit the assessment when services, integrations, or data use change.

In short, a digital MSK platform needs a BAA when it handles PHI as a business associate for a covered entity or another business associate. Evaluate the service relationship and data flows together, rather than relying only on the platform’s features or privacy claims.

FAQs

When does a digital MSK platform qualify as a business associate?

A platform generally qualifies as a business associate when it performs a service or function for a covered entity or another business associate that involves creating, receiving, maintaining, or transmitting PHI. Examples may include delivering patient MSK care, hosting ePHI, or providing support that requires access to PHI on the covered entity’s behalf.

Does a digital MSK platform need a BAA if it handles PHI?

Not in every situation. A BAA is generally required when the platform handles PHI as a business associate for a covered entity or another business associate. Handling health-related information alone does not establish that relationship; the parties’ roles and the data flow must also be assessed.

Is a BAA required when an employer offers a digital MSK platform?

It depends on how the program is sponsored and delivered. An employer is not automatically a HIPAA covered entity merely because it offers an MSK benefit. However, the employer’s group health plan may be a covered entity, and a platform engaged to handle that plan’s PHI may need a BAA. Determine whether the platform is serving the employer, the group health plan, a provider, or individuals directly, and what information it handles for each.

Do consumer MSK apps need to sign a BAA?

Usually not when individuals independently choose an app and the app is not operating on behalf of a covered entity or business associate. A BAA may be required if a covered entity or its business associate engages the app to provide services involving PHI on its behalf. Other privacy and security laws may still apply to consumer apps.