Does Imaging Results Delivery Software Need a BAA?

Imaging results delivery software needs a business associate agreement (BAA) when its vendor handles protected health information (PHI) on behalf of a HIPAA covered entity or another business associate. The answer depends on what the vendor does with the information—not simply on whether the product is software, cloud-based, or used to send imaging results.

When does imaging results delivery software handle PHI?

Imaging results and related records are PHI when they identify a person, or could reasonably identify them, and relate to their health, care, or payment for care. When that information is created, received, stored, or sent electronically, it is electronic protected health information (ePHI). HHS guidance on PHI

A delivery platform may handle PHI through reports, image files, patient identifiers, delivery notifications, user accounts, audit logs, or support tools. Consider the entire service—including hosting, troubleshooting, and routine access—not just the screen or message a user sees.

If the software provider performs these services for a covered entity, such as a hospital or qualifying health care provider, and handles PHI on its behalf, the provider may be a HIPAA business associate. HHS guidance on business associates

Which HIPAA roles determine whether a BAA is required?

A covered entity is a health plan, health care clearinghouse, or health care provider that conducts certain standard electronic transactions. A business associate is generally a person or organization outside the covered entity’s workforce that performs specified functions or services involving PHI on the entity’s behalf. A subcontractor business associate that handles PHI for a business associate can also be a business associate.

For imaging delivery, the organization providing care may be the covered entity, while a software vendor that hosts or routes results for that organization may be its business associate. If another vendor handles PHI for the software provider, that vendor may be a subcontractor business associate. The parties’ actual responsibilities and data flows—not the names in a sales contract—determine the roles. HHS guidance on business associate roles

When must a covered entity or business associate sign a BAA with a vendor?

A covered entity generally must have a written BAA with a vendor that creates, receives, maintains, or transmits PHI on its behalf as a business associate. A business associate must also have an appropriate written agreement with a subcontractor that handles PHI on its behalf. The agreements should be in place before the vendor is allowed access to PHI.

For example, HHS says a software vendor that hosts software containing patient information on its own server, or needs access to patient information to troubleshoot the software, is a business associate; the covered entity must have a BAA before allowing that access. Merely selling software is different when the vendor has no access to the covered entity’s PHI. HHS guidance on software vendors

What should a BAA for imaging results delivery include?

A BAA should define the vendor’s permitted and required uses and disclosures of PHI, limit other uses and disclosures, and require appropriate safeguards for PHI and ePHI. It should also require the business associate to report impermissible uses or disclosures and breaches of unsecured PHI, and to ensure that relevant subcontractors accept the required protections.

The agreement should address assistance with individual rights requests when applicable, access to relevant records by HHS, and what happens to PHI when the relationship ends—including return or destruction when feasible. It should also allow the covered entity to terminate the agreement for a material violation. HHS sample business associate agreement provisions

Tailor the agreement to the service. For imaging delivery, consider specifying who manages access, how incidents are reported, how records are returned or securely destroyed, and how long PHI may remain in backups or logs. The BAA does not replace each party’s obligation to comply with applicable HIPAA requirements.

How should you assess cloud hosting and subcontractors?

Map where imaging data is created, transmitted, processed, and stored, and identify every cloud provider or subcontractor involved. Ask whether each vendor has persistent access, maintains data, provides support, or acts only as a short-lived transmission conduit. Review the relevant agreements and confirm that downstream business associates are covered by written protections.

A cloud provider that creates, receives, maintains, or transmits ePHI on behalf of a covered entity or business associate generally qualifies as a business associate—even if the data is encrypted and the provider lacks the decryption key. The entity engaging the provider must have a BAA and conduct its own risk analysis and risk management. HHS cloud computing guidance and HHS guidance on cloud services and ePHI

What exceptions or limitations affect BAA requirements?

A narrow conduit exception can apply to an organization that only transmits PHI, including temporary storage incidental to that transmission, and has only transient access. It does not generally cover a vendor that stores results, processes them, or regularly accesses PHI to perform a service. A data transmission service that requires routine access may be a business associate. HHS guidance on the conduit exception

A BAA may also be unnecessary when a software vendor provides a product without access to the covered entity’s PHI. And when an individual directs a covered entity to send ePHI to an app for the individual’s own purposes, that fact alone does not make the app developer a business associate; the relationship changes if the app handles the data on behalf of or for the benefit of the covered entity. HHS guidance on individual-directed apps

In short, determine who the vendor serves, what PHI it handles, and whether its access is more than transient transmission. If a vendor or subcontractor handles imaging PHI on behalf of a covered entity or business associate, a written BAA is generally required; limited exceptions depend on the actual arrangement.

FAQs.

Does software that only transmits imaging results need a BAA?

Not always. A vendor that only transmits PHI, with access that is transient and any temporary storage incidental to transmission, may qualify for the conduit exception. If it stores, processes, or routinely accesses results to perform a service, it may be a business associate and need a BAA. HHS guidance on business associates and conduits

Can a software vendor access imaging results without a BAA?

If the vendor is acting as a business associate, the covered entity should have a BAA in place before allowing access. A vendor that does not access the covered entity’s PHI may not have a business associate relationship solely because it sells or provides software. HHS guidance on software vendors

Does a cloud hosting provider need a BAA for imaging data?

Generally, yes, when the provider creates, receives, maintains, or transmits ePHI on behalf of a covered entity or business associate. Encryption and lack of access to the decryption key do not, by themselves, remove the provider from business associate status. HHS cloud computing guidance

Who is responsible for obtaining the BAA?

The covered entity is responsible for obtaining a BAA from its business associate before allowing the business associate access to PHI. A business associate must obtain an appropriate written agreement from a subcontractor that handles PHI on its behalf. HHS guidance on business associate agreements