Does an Enterprise EHR Need a BAA?

Often, yes. An enterprise EHR vendor generally needs a business associate agreement (BAA) when it creates, receives, maintains, or transmits protected health information on behalf of a HIPAA covered entity. The deciding factor is the vendor’s role and access to the information—not the size or “enterprise” label of the software.

When does an EHR vendor need a BAA?

An EHR vendor is generally a HIPAA business associate if it handles protected health information (PHI) on behalf of a covered entity, such as a healthcare provider. This includes creating, receiving, maintaining, or transmitting PHI while hosting an EHR, providing support that requires access to patient records, or performing services involving that information. HHS describes these activities in its Business Associates guidance.

Before allowing a business associate to handle PHI, the covered entity must obtain satisfactory assurances that the information will be appropriately safeguarded and document them in a written contract or other arrangement. See 45 CFR § 164.502(e).

The BAA requirement applies to the relationship and services, not simply to the software product. A vendor that only sells software and has no access to the covered entity’s PHI may not be a business associate. But hosting the EHR or accessing PHI to troubleshoot it can create a business associate relationship, as HHS explains in its guidance on software vendors and business associate status.

What must an EHR BAA include?

A BAA must establish the vendor’s permitted and required uses and disclosures of PHI, and restrict uses or disclosures that the agreement or law does not allow. It must also require the vendor to use appropriate safeguards, including applicable HIPAA Security Rule safeguards for electronic protected health information (ePHI). HHS summarizes these required provisions in its business associate contract guidance.

The agreement must also address matters such as the vendor’s reporting of impermissible uses or disclosures and breaches of unsecured PHI; cooperation with the covered entity’s duties concerning access, amendments, and accounting of disclosures; and access to relevant records by HHS for compliance review. It must require appropriate protections for PHI handled by the vendor’s subcontractors and address returning or destroying PHI when the agreement ends, if feasible. Review 45 CFR § 164.504(e) for the regulatory requirements.

The BAA should reflect how the parties actually divide security responsibilities. A separate service-level agreement can address operational details such as availability, backups, recovery, data return, and security responsibilities, but its terms should be consistent with the BAA and HIPAA Rules. HHS discusses these considerations in its HIPAA and cloud computing guidance.

Does cloud-based EHR storage require a BAA?

Generally, yes. When a cloud service provider creates, receives, maintains, or transmits ePHI on behalf of a covered entity or business associate, the provider is generally a business associate and a HIPAA-compliant BAA is required. That applies even if the data is encrypted and the cloud provider does not hold the decryption key. HHS addresses this directly in its cloud computing guidance.

The covered entity must also assess risks to the confidentiality, integrity, and availability of its ePHI and manage those risks under the Security Rule. Using a cloud service or signing a BAA does not, by itself, satisfy every HIPAA obligation; each party must carry out the safeguards for which it is responsible.

When can an EHR vendor operate without a BAA?

A vendor may not need a BAA when it does not create, receive, maintain, or transmit PHI on behalf of the covered entity and has no access to that information as part of its service. For example, HHS says that simply providing software does not establish a business associate relationship if the vendor cannot access the covered entity’s PHI. The facts of the vendor’s support, hosting, and maintenance activities matter.

A narrow exception may apply to a conduit that only transmits PHI, with access limited to what is transient or incidental to transmission. A service that persistently stores ePHI, including cloud storage, is generally not merely a conduit. See HHS’s explanation of the conduit exception for cloud services.

There are also situations where an app receives information at an individual’s direction rather than on behalf of a covered entity; that alone may not create a business associate relationship. HHS explains this distinction in its guidance on apps designated by individuals. These exceptions depend on the actual relationship and services, so they should not be assumed simply because a vendor says it does not view the data.

Can BAA terms be included in the EHR contract?

Yes. HIPAA requires an appropriate written contract or other written arrangement containing the required assurances; it does not require a document with “BAA” as its title. The parties can place the terms in a standalone BAA, an addendum, or the main EHR services agreement, provided the written arrangement meets the applicable requirements in 45 CFR § 164.504(e).

Check that the agreement clearly covers the PHI and services involved, identifies permitted uses and disclosures, allocates relevant security and breach notification obligations, and addresses subcontractors and termination. If the EHR contract includes service-level terms, make sure they do not conflict with the BAA or prevent the covered entity from meeting its HIPAA responsibilities. HHS provides sample business associate agreement provisions as a reference.

What are the HIPAA risks of using an EHR without a required BAA?

If a covered entity allows a cloud service provider to maintain ePHI without a required BAA, it violates HIPAA’s business associate requirements. HHS states this in its cloud computing guidance, which also describes an OCR resolution involving ePHI stored on a cloud server without an agreement.

Without a BAA, the parties may lack clear written terms governing permitted uses and disclosures, HIPAA Security Rule safeguards, breach notification obligations, subcontractor protections, and return or destruction of PHI. That can complicate the covered entity’s response to a security incident and its efforts to meet HIPAA duties. If a breach of unsecured PHI occurs, the covered entity and business associate must assess and carry out any applicable notifications under the HIPAA Breach Notification Rule; the absence of a BAA does not, by itself, establish that a reportable breach occurred.

OCR may investigate possible noncompliance, and outcomes depend on the facts and applicable requirements; penalties are not automatic merely because an agreement is missing. But the covered entity should not treat the vendor’s lack of a signed BAA as a substitute for assessing whether the vendor is a business associate and documenting the required assurances.

In short, an enterprise EHR vendor generally needs a BAA when it handles PHI for a covered entity, including when it stores ePHI in the cloud. Confirm the vendor’s role, put the required protections in a written agreement, and align that agreement with the parties’ actual security responsibilities.

FAQs

Does an enterprise EHR vendor qualify as a business associate?

It generally qualifies when it creates, receives, maintains, or transmits PHI on behalf of a covered entity, such as by hosting patient records or accessing them for support. Merely selling software without access to PHI does not necessarily create a business associate relationship. The vendor’s actual services and relationship with the covered entity determine the answer.

Is a BAA required when an EHR stores ePHI in the cloud?

Generally, yes. A cloud provider that maintains ePHI for a covered entity or its business associate is generally a business associate, even if the ePHI is encrypted and the provider cannot decrypt it. The parties must document the required assurances in a written agreement.

Can a healthcare organization include BAA terms in its EHR contract?

Yes. The required BAA terms can be included in the EHR services contract, an addendum, or a separate agreement. Whichever format you use must contain the provisions required by HIPAA and should be consistent with the contract’s service-level and security terms.

What happens if a covered entity uses a cloud service to maintain ePHI without a required BAA?

HHS says that using a cloud service provider to maintain ePHI without a required BAA violates HIPAA’s business associate requirements. OCR may investigate, and the covered entity may also face practical difficulties establishing responsibilities for safeguards, incident response, and breach notifications. An investigation or penalty is not automatic, and any breach notification duties depend on the circumstances of a breach of unsecured PHI.