Does a Musculoskeletal EHR Need a BAA?

When does a musculoskeletal practice need an EHR business associate agreement?

A musculoskeletal practice generally needs a business associate agreement (BAA) with its EHR vendor when the practice is a HIPAA-covered entity and the vendor creates, receives, maintains, or transmits protected health information (PHI) on the practice’s behalf. This commonly applies when the vendor hosts patient records, provides remote technical support that can access them, or processes patient information as part of the EHR service. HHS guidance on business associates

A health care provider is generally a covered entity if it conducts certain standard electronic health care transactions, such as electronic billing, itself or through a third party. The practice remains responsible for its HIPAA obligations when it uses a vendor to perform services involving PHI. HHS guidance on covered entities

The agreement should be in place before the vendor is allowed to handle the practice’s PHI. HIPAA requires a written contract or other arrangement that sets out the business associate’s permitted uses and disclosures and required safeguards; it does not require that the document have a particular title or use a specific template. HHS sample business associate agreement provisions

How does HIPAA define a business associate?

A HIPAA business associate is generally a person or organization outside a covered entity’s workforce that performs certain functions or services for the entity involving PHI. The definition includes a vendor that creates, receives, maintains, or transmits PHI on the practice’s behalf, as well as a subcontractor that handles PHI on behalf of a business associate. HHS business associate guidance

For an EHR relationship, the key question is what the vendor does with patient data—not whether the vendor calls itself a software company, technology provider, or contractor. A vendor that hosts patient records or needs access to them to provide support may be a business associate. HHS guidance on software vendors

Does the specialty of the practice affect BAA requirements?

No. HIPAA’s business associate rules do not create a separate BAA standard for musculoskeletal, orthopedic, chiropractic, physical therapy, or other specialties. The relevant issues are whether the practice is a covered entity and whether the vendor handles PHI on its behalf.

Musculoskeletal records can include diagnoses, imaging, treatment notes, rehabilitation plans, and billing details. When those records are PHI handled by an EHR vendor for a covered practice, the same business associate rules apply as they do to other provider records. HHS guidance on covered entities

When is an EHR vendor not a business associate?

A vendor that merely sells software and does not access or otherwise handle the practice’s PHI may not be a business associate, so a BAA may not be required for that software-only relationship. HHS distinguishes this from a vendor that hosts the software containing patient information or accesses PHI while troubleshooting it. HHS guidance on software vendors

Not being able to read patient data does not necessarily mean a vendor is outside the BAA rules. A cloud service provider that maintains electronic protected health information (ePHI) on a practice’s behalf may be a business associate even if the data is encrypted and the provider lacks the decryption key. HHS guidance on HIPAA and cloud computing

The conduit exception is narrow: it generally covers transmission-only services with access that is transient, rather than a service that persistently stores or maintains ePHI. Practices should assess the vendor’s actual role and data handling rather than relying only on a vendor’s statement that it cannot view records. HHS cloud computing guidance

What protections should an EHR BAA include?

HIPAA requires a BAA to describe the business associate’s permitted uses and disclosures of PHI and restrict uses or disclosures outside the agreement or as required by law. It must also require appropriate safeguards, including applicable Security Rule protections for ePHI, and reporting of impermissible uses or disclosures and security incidents as required. HHS sample business associate agreement provisions

The agreement should address breach notification, including how and when the vendor will notify the practice of a breach of unsecured PHI. HIPAA’s Breach Notification Rule applies to covered entities and business associates; the BAA can set practical reporting details for the parties. HHS Breach Notification Rule guidance

It should also cover subcontractors: a business associate must ensure that subcontractors handling PHI agree to the same relevant restrictions and conditions. At the end of the relationship, the BAA must address return or destruction of PHI, when feasible, and the protections that apply if return or destruction is infeasible. HHS sample business associate agreement provisions

Review the BAA alongside the EHR service terms. HHS recommends that cloud-service customers understand the service and clarify each party’s security responsibilities; service-level terms should not conflict with the BAA or prevent the practice from accessing its ePHI. HHS guidance on HIPAA and cloud computing

How should practices assess vendor access to PHI?

Before signing, map how PHI moves through the EHR service. Ask whether the vendor or its subcontractors host records, provide backups, administer the system, troubleshoot issues, or use support tools that could access patient data. Include remote access and any service that stores or processes ePHI, even if the vendor says its staff do not ordinarily view the records.

Confirm who the vendor uses as subcontractors, how their access is governed, and how the vendor will report incidents and support the practice’s HIPAA duties. HHS identifies risk analysis and risk management as responsibilities for covered entities and business associates handling ePHI; reviewing vendor access and the division of security responsibilities helps inform that work. HHS guidance on HIPAA and cloud computing

If an EHR vendor that will handle PHI refuses to sign a BAA, do not provide it access to the practice’s PHI until the issue is resolved. Ask whether the vendor offers an appropriate agreement, review the service arrangement with qualified privacy or legal counsel, and consider another vendor if the required protections cannot be established.

In short, the practice’s specialty does not determine whether an EHR BAA is needed. The deciding factors are whether HIPAA applies to the practice and whether the EHR vendor—or a subcontractor—handles PHI on its behalf.

FAQs.

Does every musculoskeletal EHR vendor need a BAA?

No. A BAA is generally required when a covered practice’s EHR vendor creates, receives, maintains, or transmits PHI on the practice’s behalf. A vendor that only sells software and does not handle the practice’s PHI may not be a business associate. HHS guidance on software vendors

Does a software vendor need a BAA if it cannot access PHI?

It depends on what “cannot access” means. If the vendor only provides software and neither accesses nor handles PHI, a BAA may not be required. But a cloud provider that maintains encrypted ePHI on the practice’s behalf may still be a business associate even if it lacks the key to decrypt the data. HHS cloud computing guidance

Does an EHR BAA need to cover subcontractors?

Yes. The BAA must require the business associate to ensure that subcontractors handling PHI agree to the same relevant restrictions and conditions. HHS sample business associate agreement provisions

What should a practice do if an EHR vendor refuses to sign a BAA?

If the vendor will handle PHI on the practice’s behalf, do not give it access to that information until an appropriate agreement is in place. Ask the vendor to clarify its data handling and contract options, consult qualified privacy or legal counsel, and consider another vendor if the necessary protections cannot be agreed upon.