Does Mobile Radiology Dispatch Software Need a BAA?

Mobile radiology dispatch software needs a business associate agreement (BAA) when its vendor creates, receives, maintains, or transmits electronic protected health information (ePHI) on behalf of a covered entity or another business associate. The answer depends on what the software and vendor actually do—not simply whether the product is labeled “dispatch software.”

If the platform handles identifiable patient details, imaging orders, appointment information, or other ePHI, assess the vendor’s role and access before using it. A vendor that qualifies as a HIPAA business associate generally needs a BAA, even if it cannot read encrypted data.

When HIPAA Requires a BAA

A covered entity—such as a healthcare provider that conducts certain electronic transactions—must generally have a written business associate agreement with a vendor that performs services involving protected health information on its behalf. This requirement also applies when a business associate uses a subcontractor that handles ePHI as part of providing its service.

For radiology dispatch, consider whether the system processes or stores patient names, contact details, exam orders, appointment times, facility information, or other details that identify a patient and relate to their care. If the software vendor handles that information to coordinate, assign, or track imaging work for a provider, it may be acting as a business associate.

By contrast, a vendor that merely sells software and has no access to the provider’s PHI may not have a business associate relationship. Look beyond the software’s features: hosting, troubleshooting, support access, and system configuration can all affect whether the vendor handles PHI.

How Dispatch Software Handles ePHI

Dispatch platforms can handle ePHI in several ways. A system may display patient and exam details to schedulers or technologists, assign studies to mobile radiology teams, send notifications, maintain dispatch histories, or store records in a database or cloud environment.

Assess the entire information flow, including the mobile application, administrative dashboard, hosting environment, messaging functions, backups, analytics, and vendor support tools. A vendor may maintain or access ePHI even if staff do not routinely open patient records. For example, cloud storage or troubleshooting access can still bring the vendor within the business associate definition.

Ask what information appears in alerts and messages, where it is stored, how long it is retained, and which vendor personnel or subcontractors can access it. The purpose is to determine whether the vendor creates, receives, maintains, or transmits ePHI on your organization’s behalf.

BAA Requirements for Cloud and Mobile Access

A cloud provider that creates, receives, maintains, or transmits ePHI for a covered entity or business associate generally qualifies as a business associate and needs a BAA. That remains true when the data is encrypted and the provider does not possess the decryption key.

Mobile access does not by itself determine whether a BAA is required. Focus on the vendor’s role: if its app, servers, or support services handle ePHI to provide dispatch services, the vendor may be a business associate. If it only provides software with no PHI access or handling, a BAA may not be required for that vendor relationship.

A BAA should describe permitted and required uses and disclosures of ePHI, require appropriate safeguards, address reporting of security incidents and breaches, and cover relevant subcontractors. Confirm that the agreement reflects the actual services, data flows, and responsibilities rather than relying on a generic contract label.

Security Safeguards for Mobile Radiology Workflows

A BAA is not a substitute for security safeguards. Covered entities and business associates must assess risks to ePHI and use appropriate administrative, physical, and technical safeguards to protect its confidentiality, integrity, and availability.

For mobile radiology workflows, evaluate safeguards such as unique user accounts, role-based access, strong authentication, audit logging, secure transmission, device encryption, automatic screen locks, and a process to revoke access or remotely wipe a lost device. Also review how the organization manages devices, support access, backups, and incident response.

Encryption can reduce the risk of unauthorized disclosure, but it does not replace other safeguards or resolve the business-associate question. HHS notes that encryption alone does not address every security concern, including data integrity, availability, risk analysis, and physical protections.

When a Transmission Service May Qualify as a Conduit

The conduit exception is narrow. A service may qualify when it only transmits PHI and any storage is temporary and incidental to that transmission. A conduit’s access is generally transient, rather than ongoing access to perform a service for the covered entity.

A dispatch vendor that stores patient or imaging information, processes it to coordinate work, or routinely accesses it for support is unlikely to fit the exception merely because it also transmits messages. A cloud provider that maintains ePHI for processing or storage is generally a business associate, even if it cannot view encrypted information.

Determine whether transmission is truly the service’s only function and whether any storage is temporary and incidental. Do not assume that messaging, routing, or encryption alone makes a dispatch platform a conduit.

Steps to Evaluate a Dispatch Software Vendor

1. Map the data. Identify the patient and imaging information entered, sent, displayed, or stored in the platform and mobile app.
2. Trace access. Ask whether the vendor or its subcontractors can access ePHI for hosting, maintenance, troubleshooting, analytics, or support.
3. Review storage and transmission. Find out where data, logs, backups, and message contents are held, and how long they are retained.
4. Decide whether the vendor is a business associate. If it creates, receives, maintains, or transmits ePHI on your organization’s behalf, arrange an appropriate BAA before allowing that handling.
5. Assess safeguards. Review access controls, authentication, encryption, audit logs, device protections, incident response, and subcontractor practices.
6. Compare the contract with the workflow. Confirm that the BAA and service terms accurately describe permitted uses, safeguards, incident reporting, data return or deletion, and responsibilities.

Make the decision based on the vendor’s actual functions and access, not its marketing claims or the fact that the software is used on a mobile device. HHS guidance treats cloud providers that handle ePHI as business associates even when they store only encrypted data, while software vendors without PHI access may fall outside that relationship.

FAQs

Does mobile radiology dispatch software need a BAA if it accesses ePHI?

Generally, yes, if the vendor accesses or otherwise creates, receives, maintains, or transmits ePHI on behalf of a covered entity or business associate. A vendor that merely provides software without access to PHI may not need a BAA, so assess its actual role and access.

Does encryption remove the need for a BAA?

No. A vendor that maintains encrypted ePHI on behalf of a covered entity or business associate may still be a business associate, even if it lacks the decryption key. Encryption is a safeguard, not an automatic exception to the BAA requirement.

Do cloud providers that maintain ePHI require a BAA?

Generally, yes. A cloud provider that creates, receives, maintains, or transmits ePHI for a covered entity or business associate typically qualifies as a business associate, including when it stores encrypted information without a decryption key.

When can a dispatch service qualify for the conduit exception?

Only when its service is limited to transmitting PHI, with any storage temporary and incidental to transmission, and access is transient. A service that stores, processes, or routinely accesses ePHI to perform dispatch functions generally does not fit this narrow exception.

In short, a mobile radiology dispatch vendor generally needs a BAA when it handles ePHI on your organization’s behalf. Review the complete workflow, verify safeguards, and use the conduit exception only when the service truly provides transmission alone.