Does Lung Nodule Tracking Software Need a BAA?

Often, yes—but it depends on what the vendor does with the data. If a healthcare provider or another HIPAA-regulated organization uses lung nodule tracking software and the vendor creates, receives, maintains, or transmits identifiable patient information on its behalf, the vendor will generally be a HIPAA business associate and a business associate agreement (BAA) is required. If the vendor only sells software and has no access to protected health information (PHI), a BAA may not be necessary.

The key is the relationship and the service—not whether the product is labeled “HIPAA compliant.” Review how the software handles patient information, including data used to track imaging, findings, follow-up recommendations, and appointments. This is general information, not legal advice.

When does lung nodule tracking software create a business associate relationship?

A vendor generally becomes a business associate when it performs a service for a covered entity, such as a healthcare provider, and that service involves creating, receiving, maintaining, or transmitting PHI on the provider’s behalf. A vendor can also be a business associate when it performs certain services for another business associate. The HIPAA definitions appear in 45 CFR § 160.103.

For lung nodule tracking, this may apply when a vendor hosts patient records, receives imaging reports, manages follow-up workflows, or provides remote support that exposes patient information. A radiology finding or scan date may be PHI when it is linked to information that identifies a patient. The vendor’s actual role and access matter more than the software’s name or intended use.

When a vendor is a business associate, the covered entity generally needs a BAA before the vendor handles PHI. If a business associate uses a subcontractor that handles PHI on its behalf, that subcontractor may also need a BAA in the business associate chain. See HHS guidance on business associates.

What PHI access or services make a BAA necessary?

Consider whether the software vendor or its subcontractors can handle identifiable data such as patient names, medical record numbers, dates of service, imaging records, nodule findings, or follow-up status. A vendor may be handling PHI even if its staff do not routinely open patient records.

Services that can create a business associate relationship include:

• Hosting or storing patient records, imaging data, or tracking information.
• Receiving or transmitting patient data between a provider, radiology system, or other care platform.
• Processing patient information to generate tracking lists, alerts, or reports for the provider.
• Accessing patient information during troubleshooting, maintenance, or technical support.
• Using a cloud service provider or another subcontractor to store or process the data.

HHS explains that a software company that hosts software containing patient information or accesses that information while troubleshooting is a business associate. The HHS software-vendor guidance also distinguishes those services from merely selling software without PHI access.

When can a software vendor operate without a BAA?

A vendor may not need a BAA when it only sells or licenses software and does not access, receive, maintain, or transmit PHI on behalf of the healthcare organization. For example, a provider might install software on its own systems, control the data, and prevent the vendor from accessing patient records during support or maintenance.

That conclusion depends on how the product and support arrangements work in practice. Check whether the vendor can remotely access the system, receives diagnostic files that may contain patient information, or uses hosted services or subcontractors to handle the data. If support requires patient data, use a process that removes or de-identifies it where feasible—or reassess whether a BAA is needed.

A contract calling the vendor a “software provider” does not, by itself, settle the question. The relevant issue is whether the vendor’s service involves PHI on behalf of a covered entity or business associate. See HHS’s guidance on software vendors.

Does cloud hosting of encrypted ePHI require a BAA?

Generally, yes. A cloud service provider that creates, receives, maintains, or transmits electronic protected health information (ePHI) for a covered entity or business associate generally needs a BAA—even if the information is encrypted and the provider does not hold the decryption key. Encryption and limited access are important safeguards, but they do not by themselves remove the provider’s business associate status.

HHS states that cloud services used to store or process ePHI on behalf of a regulated organization require a HIPAA-compliant BAA. Its cloud computing guidance addresses providers offering “no-view” services, while the cloud-service FAQ explains the BAA requirement.

This differs from a vendor that only sells software and does not handle the organization’s PHI at all. Determine whether the vendor or cloud provider maintains or processes ePHI on the organization’s behalf; do not rely solely on whether staff can read the data.

How to assess vendor access to lung nodule data

Map how patient information enters, moves through, and leaves the lung nodule tracking system, and assess vendor access. Include the software vendor, hosting provider, support team, and any other subcontractors involved in the service.

• List the data: Identify patient identifiers, imaging records, nodule findings, scan dates, and follow-up details the system uses.
• Trace the data flow: Document where data is stored, processed, transmitted, and backed up, including cloud services.
• Check access paths: Ask whether vendor staff can access the system, logs, support tickets, or diagnostic files that may contain PHI.
• Review subcontractors: Identify any cloud service provider or other party that creates, receives, maintains, or transmits ePHI for the vendor.
• Compare contracts with practice: Confirm that the service description, access controls, support procedures, and BAA match how the product is actually operated.
• Reassess changes: Review the decision if hosting, integrations, support access, or data use changes.

The HIPAA Security Rule requires regulated organizations to assess risks to ePHI and manage those risks. A BAA supports the relationship, but it does not replace the organization’s own security risk analysis or safeguards. HHS discusses cloud risk analysis and safeguards in its cloud computing guidance.

What should a BAA cover for lung nodule tracking software?

A BAA should describe the permitted and required uses and disclosures of PHI and require the business associate to safeguard the information. It should also address reporting, subcontractors, individual rights, and what happens to PHI when the agreement ends. The required terms are set out in 45 CFR § 164.504(e); HHS provides a summary in its sample business associate agreement provisions.

For a lung nodule tracking service, the parties should make the agreement specific enough to cover the vendor’s actual role. Address, as applicable:

• Which PHI the vendor may handle and for what service-related purposes.
• Security safeguards for ePHI and the division of security responsibilities between the parties.
• How the vendor will report impermissible uses or disclosures, security incidents, and breaches of unsecured PHI.
• Requirements for subcontractors that handle PHI.
• How the vendor will help the organization meet applicable requests for access, amendments, or accounting of disclosures.
• How PHI will be returned or destroyed when the service ends, where feasible.
• How the provider will retrieve its data and maintain access to it during service interruptions or contract termination.

A signed BAA does not, by itself, establish that either party complies with HIPAA. The organization should also confirm that its use of the software, security practices, and vendor oversight meet its applicable obligations.

Conclusion

A lung nodule tracking software vendor generally needs a BAA when it handles PHI on behalf of a covered entity or business associate, including through hosting, processing, support, or subcontracted cloud services. A vendor that only sells software and has no PHI access may not need one. Assess the actual data flow and vendor access, then document the arrangement in a BAA when required.

FAQs

Does a software vendor need a BAA if it only sells the software?

Not necessarily. HHS says the mere sale or provision of software does not create a business associate relationship if the vendor has no access to the covered entity’s PHI. Hosting patient information or accessing it during troubleshooting can change the answer. See HHS guidance on software vendors.

Does a cloud provider need a BAA if ePHI is encrypted?

Generally, yes, if the cloud provider creates, receives, maintains, or transmits ePHI on behalf of a covered entity or business associate. Encryption—and the provider’s lack of a decryption key—does not by itself eliminate the BAA requirement. See HHS guidance on HIPAA and cloud computing.

Is a BAA required if the vendor cannot view patient data?

It depends on the vendor’s role. A vendor that merely sells software and does not handle PHI may not need a BAA. But a vendor that maintains or processes ePHI on behalf of a regulated organization may need one even if it cannot decrypt or view the information.

Does a patient-directed app create a business associate relationship?

Not by itself. HHS says that an app’s facilitation of access to an individual’s ePHI at the individual’s request alone does not create a business associate relationship. The relationship may be different if the app is provided by or on behalf of a covered entity, or is developed to handle ePHI on the covered entity’s behalf. See HHS guidance on patient-designated apps.