White-Label Telehealth Vendor BAA Requirements: What to Know

When does a white-label telehealth vendor need a BAA?

A vendor’s white-label branding does not determine whether it needs a business associate agreement (BAA). The key question is what the vendor does with protected health information (PHI), and whether it handles that information on behalf of a HIPAA-covered provider or another business associate.

If the vendor creates, receives, maintains, or transmits PHI to provide telehealth services for a covered provider, it will generally be a business associate. The provider should have an appropriate BAA in place before allowing the vendor to access PHI. HHS identifies hosted software, cloud services, and patient-facing health applications that handle PHI on a provider’s behalf as examples of business associate services. See HHS guidance on business associates.

Map the contractual relationship as well as the technology. A vendor contracted directly by the provider may be the provider’s business associate; a vendor engaged by another business associate may be a business associate subcontractor. The agreement should reflect the actual services, data flows, and parties involved—not just the product’s brand name.

By contrast, merely selling software that does not give the vendor access to PHI does not, by itself, make the software company a business associate. HHS explains that vendor access for hosting or troubleshooting can change that analysis. See HHS guidance on software vendors.

Which services and data flows may involve PHI?

Review the full telehealth workflow, not only the live video appointment. PHI may be handled through:

• Video or audio visits, including recordings, captions, and transcripts.
• Patient accounts, appointment scheduling, intake forms, and provider-patient messages.
• Clinical notes, uploaded documents, images, and remote patient monitoring data.
• Billing, claims, e-prescribing, and integrations with electronic health records.
• Technical support, system logs, backups, and cloud hosting where vendor personnel or systems can access PHI.

Information is PHI when it is individually identifiable health information protected by HIPAA. The same platform can handle both PHI and information that is not PHI, so assess what each feature collects, where it sends data, how long it retains the data, and who can access it.

Consider every organization in the data path, including hosting providers, messaging or transcription services, analytics tools, and support vendors. If a service creates, receives, maintains, or transmits electronic PHI on behalf of a covered entity or business associate, it may have business associate obligations. HHS’s cloud computing guidance explains that cloud providers handling ePHI can be business associates even when the information is encrypted and they do not hold the decryption key.

What terms must a telehealth vendor BAA include?

A BAA should describe the vendor’s work and the PHI involved, then set clear rules for permitted uses and disclosures. Under the HIPAA Privacy Rule, the agreement must limit the vendor’s uses and disclosures to what the agreement permits or what law requires; it cannot authorize uses that would violate the Privacy Rule if performed by the covered provider.

The agreement must also require appropriate safeguards for PHI, including applicable Security Rule protections for electronic PHI. Required provisions address, among other things, reporting impermissible uses or disclosures and security incidents, cooperation with individuals’ access, amendment, and accounting rights when applicable, and making relevant records available to HHS. See HHS’s summary of business associate contract provisions.

For a telehealth relationship, make the operational details specific. The BAA or related agreement should clarify:

• Which services and data the vendor may handle, and the permitted uses and disclosures for each.
• How the vendor will protect PHI, manage access, and support the provider’s compliance responsibilities.
• How promptly the vendor must report a security incident, suspected unauthorized disclosure, or breach—and what details it must provide.
• How the parties will coordinate investigations, mitigation, and any required breach notifications.
• How the provider can retrieve PHI, and what happens to it at termination, including return or destruction when feasible.
• Whether the vendor may use or disclose PHI for management, legal responsibilities, or data aggregation, and what restrictions apply.

HIPAA requires a business associate to notify the covered entity of a breach of unsecured PHI without unreasonable delay and no later than 60 calendar days after discovery. That is an outer limit, not necessarily a suitable operational deadline for a provider’s response. Specify a faster contractual deadline where appropriate, and distinguish breach notification from broader security incident reporting. See HHS’s Breach Notification Rule guidance and its guidance on security incident reporting.

How should a vendor manage subcontractor BAAs?

A white-label telehealth vendor may rely on subcontractors for hosting, communications, storage, or other parts of its service. When a subcontractor creates, receives, maintains, or transmits PHI on behalf of the vendor, HIPAA requires the vendor to obtain written assurances that the subcontractor will protect the PHI under the applicable BAA requirements.

Those obligations flow down the chain: a business associate must require its PHI-handling subcontractors to accept the same relevant restrictions and conditions that apply to the business associate. The provider should confirm that the vendor has a process for identifying subcontractors, assessing their roles, executing agreements before PHI is shared, and addressing changes in the subcontractor list. HHS describes these requirements in its business associate guidance.

Ask which subcontractors can access or maintain your organization’s PHI, what services they perform, and how the vendor verifies that the agreements and safeguards remain in place. The provider’s BAA can also require advance notice of material subcontractor changes and define how the provider may respond.

How can providers review a white-label vendor’s PHI practices?

Start by matching the proposed BAA to the real product configuration. Identify which features will be enabled, what information they collect, which systems receive it, how long it is retained, and whether vendor or subcontractor personnel can access it. Include support, backups, integrations, recordings, and transcripts in the review.

Ask the vendor to explain its safeguards and incident process in terms you can assess. Relevant topics may include access controls, authentication, encryption, audit logs, workforce procedures, backup and recovery, retention and deletion, and how the vendor investigates and reports incidents. Request appropriate documentation or other assurances based on your organization’s risk analysis.

HIPAA does not expressly require a business associate to let its customer audit its security practices or provide particular security documents. The provider still has its own compliance responsibilities, including risk analysis and risk management, so it should determine what evidence and contractual commitments are appropriate for its circumstances. HHS discusses this distinction in its cloud computing guidance.

Finally, confirm that the BAA, service agreement, and product documentation are consistent. A contract that permits a data use the product settings do not support—or product behavior that exceeds the contract—can create avoidable compliance and operational risk.

When might the conduit exception apply?

The conduit exception is narrow. It generally applies when a service only transmits PHI and any storage is temporary and incidental to that transmission. HHS gives traditional communications services as examples when they do not otherwise create, receive, or maintain PHI for the provider.

A vendor that stores telehealth recordings, transcripts, messages, or other PHI for later use is generally doing more than transmitting it. A cloud provider can also be a business associate even if it cannot view encrypted information. See HHS’s explanation of the conduit exception.

For audio-only telehealth, a telecommunications provider that only connects a call and has no routine access to PHI may be a conduit; an app that stores recordings or transcripts for the provider is different. See HHS guidance on audio-only telehealth.

In short, assess the vendor’s actual role and every PHI data flow, put required BAA protections in place across the vendor chain, and review the safeguards and incident procedures against your organization’s needs. The conduit exception should be considered only when the service is truly transmission-only.

FAQs

Does a white-label telehealth platform vendor need a BAA?

Generally, yes, if the vendor creates, receives, maintains, or transmits PHI on behalf of a HIPAA-covered provider or another business associate. White-label branding does not change the analysis. A vendor that only sells software without PHI access may not be a business associate.

Which telehealth services may handle PHI?

Video and audio visits, recordings, transcripts, patient messages, scheduling, intake forms, clinical notes, monitoring data, billing, hosting, backups, and technical support may involve PHI. Review the data collected and the role of each vendor or subcontractor in the workflow.

Must subcontractors sign a BAA before receiving PHI?

A business associate must obtain the required written assurances from a subcontractor that handles PHI. Put the agreement in place before allowing the subcontractor to receive or access PHI, and ensure its terms cover the applicable HIPAA requirements.

What should providers review in a telehealth vendor BAA?

Review the permitted uses and disclosures of PHI, safeguards, security incident reporting, breach notification coordination, subcontractor obligations, assistance with individual rights, access to records for HHS, and return or destruction of PHI at termination. Check that the BAA matches the product configuration and the vendor’s actual data practices.