HIPAA vendor and BAA checklist
Short answer: Any vendor that handles, stores or sends patient information while doing work on your behalf needs a signed business associate agreement (BAA) before it gets access. Keep a list of those vendors, check each BAA is signed and current, and review what access each one has at least once a year.
Who usually needs a BAA
- EHR and practice management vendors.
- IT providers and MSPs.
- Cloud backup, email and file sharing services.
- Billing, coding and collections companies.
- Answering services, transcription and patient messaging tools.
- Shredding and records storage companies.
Who usually doesn't
- Your bank processing ordinary payments.
- The mail carrier or a courier who doesn't open what they carry.
- Cleaning staff, if they don't handle records.
The checklist
- List every vendor that touches patient information.
- Confirm a signed BAA is on file for each one.
- Check the BAA covers breach reporting to you and what happens to data when the contract ends.
- Note what systems each vendor can reach, and remove access nobody uses.
- Ask key vendors whether they use two-step login (MFA) and how they back up your data.
- Review the list once a year and whenever you add or drop a vendor.
Common questions
Our vendor says they're "HIPAA compliant." Is that enough?
No. You still need a signed BAA with them. "HIPAA compliant" is a marketing phrase, not a contract.
Who keeps the BAAs?
Usually the practice administrator or privacy officer. Keep them where you can find them in a day, because OCR and insurers may ask.
Harborline helps outpatient medical, dental and behavioral health practices with about 5 to 100 staff. We run the HIPAA Security Rule risk analysis, do penetration testing in-house, and work alongside your IT provider until the fixes are verified. Tell us what you're facing and we'll set up a free 30-minute scoping call.
Contact us