Does a Rehab EHR Need a Business Associate Agreement (BAA)?

Usually, yes. If your rehab practice is a HIPAA-covered entity and an EHR vendor creates, receives, maintains, or transmits protected health information (PHI) on the practice’s behalf, you generally need a written business associate agreement (BAA) with that vendor. The key question is the vendor’s role—not whether the software is called a rehab EHR or whether the vendor can read encrypted data. HHS guidance on business associates

When does a rehab EHR vendor qualify as a business associate?

A rehab EHR vendor generally qualifies as a HIPAA business associate when it handles PHI to perform a service or function for your practice. That can include creating, receiving, maintaining, or transmitting patient information on the practice’s behalf. Whether your organization is one of HIPAA’s covered entities depends on its role and activities; healthcare providers that conduct certain transactions electronically are covered entities under HIPAA. HHS guidance on covered entities

For example, an EHR company that hosts patient records, supports your system through remote access, or maintains backups may be a business associate. A cloud provider that stores electronic protected health information (ePHI) for the EHR vendor may also be a business associate as the vendor’s subcontractor. Encryption does not by itself remove that status, even if the cloud provider cannot decrypt or view the data. HHS guidance on cloud computing and ePHI

By contrast, merely selling software does not establish a business associate relationship if the vendor has no access to your practice’s PHI and does not otherwise create, receive, maintain, or transmit it on your behalf. Check the actual services, support arrangements, hosting, and data flows rather than relying only on a vendor’s product description. HHS guidance on software vendors

What services require a BAA for a rehab EHR?

A BAA is generally required when a vendor performs a service for your practice that involves PHI. Common examples include:

• Hosting the EHR, patient portal, or electronic records.
• Storing or backing up patient records, including encrypted ePHI.
• Providing maintenance, troubleshooting, or technical support that can access PHI.
• Handling billing, claims, practice management, or data analysis on your behalf.
• Operating patient messaging, monitoring, or other EHR-connected services using patient information.

HIPAA’s business associate rules also apply down the service chain. Your direct EHR vendor must have appropriate written agreements with subcontractors that handle PHI for it. If your practice separately hires another vendor to handle PHI on its behalf, assess whether you need a BAA directly with that vendor too. HHS examples and subcontractor guidance

What must a rehab EHR BAA include?

A BAA must establish the vendor’s permitted and required uses and disclosures of PHI, and restrict other uses or disclosures except as allowed by the agreement or required by law. It must also require appropriate safeguards, including applicable HIPAA Security Rule protections for ePHI. HHS summary of required BAA provisions

Review whether the agreement addresses these required topics:

• How the vendor may use and disclose PHI, and that it will not use or disclose PHI outside the agreement or as required by law.
• Safeguards for PHI and ePHI, including applicable Security Rule requirements.
• Reporting of unauthorized uses or disclosures, breaches of unsecured PHI, and security incidents.
• Assistance with patient rights requests, such as access to records, amendments, and accounting of disclosures, when relevant to the vendor’s role.
• Appropriate restrictions and conditions for subcontractors that handle PHI.
• Making relevant records available to HHS for compliance review.
• Return or destruction of PHI when the agreement ends, if feasible, and termination rights for material violations.

These are baseline requirements, not a substitute for reviewing how the contract fits your EHR configuration. Your practice still needs to understand the vendor’s services and address its own Security Rule risk analysis and risk management responsibilities. HHS cloud-computing guidance

How should providers handle security incidents and breaches?

Your BAA should explain how the vendor will report security incidents, who receives reports, what information they contain, and how the parties will coordinate investigation and mitigation. HIPAA’s Security Rule requires business associates to identify and respond to suspected or known security incidents, mitigate harmful effects where practicable, document incidents and outcomes, and report security incidents to the covered entity or business associate whose ePHI they maintain. HHS guidance on security-incident reporting

A security incident is not automatically a reportable breach of unsecured PHI. The Breach Notification Rule generally concerns an impermissible use or disclosure that compromises the security or privacy of PHI; the rules include exceptions and a risk-assessment process. If a breach of unsecured PHI occurs at or by a business associate, the business associate must notify the covered entity without unreasonable delay and no later than 60 calendar days after discovery. The BAA can set a shorter operational reporting deadline so the practice has time to assess and meet its own obligations; the 60-day limit is not a recommended routine response time. HHS Breach Notification Rule guidance

Agree in advance on practical reporting details, such as the vendor’s contact point, initial notice process, follow-up information about affected individuals, and cooperation with investigation and required notifications. The covered entity remains responsible for ensuring required notices are provided, although it may delegate notice tasks to the business associate. HHS guidance on breach notification responsibilities

When might a rehab EHR app not require a BAA?

A BAA may not be required for a consumer health app that a patient independently selects and directs the provider to send their information to, if the app developer is not creating, receiving, maintaining, or transmitting ePHI on behalf of or for the benefit of the provider. The patient’s request to send data to an app, by itself, does not make the app developer a business associate. HHS guidance on patient-designated apps

The result can change if the practice provides the app to patients, contracts with its developer, or uses the app to perform services involving PHI on the practice’s behalf. Also, a transmission-only service may fall within HIPAA’s narrow conduit exception when any storage is merely temporary and incidental to transmission. A company that stores ePHI for later access generally is not a conduit just because it also transmits data. HHS guidance on the conduit exception

When an app is outside HIPAA’s business associate relationship, information received by that app may no longer be protected by the HIPAA Rules in the same way. Confirm who selected and provides the app, what services it performs, and where information is stored before deciding that no BAA is needed. HHS app guidance

Is the BAA separate or part of the EHR contract?

The BAA can be a standalone document, an addendum, or part of a larger EHR services contract. The format is not the deciding factor: the written arrangement must contain the required terms and clearly govern the vendor’s handling of PHI. HHS guidance on BAA provisions

Read the BAA alongside the service agreement and any service-level agreement. Check that terms about data access, support, subcontractors, security incidents, and what happens when service ends work together and do not conflict. HHS advises that cloud service-level terms should be consistent with the BAA and HIPAA Rules. HHS guidance on cloud service agreements

In short, if your rehab EHR vendor handles PHI on your practice’s behalf, document the relationship in a compliant BAA, review the vendor’s subcontracting and incident-reporting terms, and confirm the agreement matches how you actually use the system.

FAQs.

Does a rehab EHR vendor need a BAA if it stores patient data?

Generally, yes, when the vendor stores PHI or ePHI for a HIPAA-covered practice as part of its service. This can apply even if the data is encrypted and the vendor cannot view it. HHS cloud-computing guidance

Can a BAA be incorporated into a rehab EHR contract?

Yes. It may be part of the main contract or a separate written addendum, as long as the written arrangement contains the required BAA terms and applies to the vendor’s handling of PHI. HHS guidance on BAA provisions

What should a rehab EHR BAA cover?

It should cover permitted uses and disclosures, safeguards for PHI and ePHI, security-incident and breach reporting, relevant patient-rights support, subcontractors, access to records for HHS, return or destruction of PHI when feasible, and termination for material violations. HHS summary of required BAA provisions

When is a BAA not required for a health app?

A BAA is generally not required with an app developer that only receives information through a patient-directed request and does not handle ePHI on behalf of or for the benefit of the provider. If the provider supplies or contracts for the app to perform services involving PHI, a BAA may be required. HHS guidance on patient-designated apps