Glossary
Business associate agreement (BAA)
Under HIPAA, a business associate agreement is the contract or other written arrangement a covered entity, such as many health care providers, must have with a vendor that creates, receives, keeps or sends protected health information for it. In it the vendor promises to safeguard that information.
What HIPAA requires
Under the HIPAA rules, a covered entity may disclose protected health information to a business associate only once it has satisfactory assurance, in a contract or other written arrangement, that the business associate will safeguard it. HHS calls that contract or arrangement a business associate agreement, or BAA (U.S. Department of Health and Human Services).
Covered entities include health care providers such as doctors, dentists and chiropractors that send health information electronically in connection with the standard transactions HHS has adopted (U.S. Department of Health and Human Services).
This page is general information, not legal advice. Whether your practice is a covered entity, and what any agreement of yours should say, are questions for your privacy officer or your lawyer.
Who counts as a business associate
HHS describes a business associate as a person or organization, other than a member of the covered entity's own workforce, whose work for it involves creating, receiving, maintaining or transmitting protected health information. A subcontractor that handles the information for a business associate is one too. Business associates are also directly liable for complying with certain parts of HIPAA themselves (U.S. Department of Health and Human Services).
Two of HHS's examples are close to home for a practice thinking about a chatbot. One is an AI chatbot from an outside vendor, placed in the online area a provider runs for its patients, that handles their information to assess symptoms, send medical reminders or book appointments. The other is a cloud service that stores electronic patient information (U.S. Department of Health and Human Services).
Who does not
HHS says no BAA is needed with someone such as a janitorial service or an electrician, whose work does not involve using or disclosing patient information, provided any access to it would be incidental at most and reasonable safeguards are in place. Nor is one needed with a conduit that only carries the information from one place to another (U.S. Department of Health and Human Services).
A company can sell you one service that never goes near a patient record and another that stores those records every day, so judge each service on its own.
What the agreement must say
HHS says the agreement must describe the uses and disclosures of the information that it permits, and bar the business associate from any others. It is also where the business associate gives its written assurance that it will safeguard the information (U.S. Department of Health and Human Services).
When you read one, look for those two things first: what the vendor may do with your patients' information, and its undertaking to protect it.
Before any tool touches patient information
Ask the vendor for a BAA before patient information goes into any tool, whether a chatbot, an online form or a file store, and have it signed first. If a vendor will not sign one, keep patient information out of that tool.
This is general information, not legal advice. What your practice needs turns on what each tool does with patient information.
Running the free scan involves no patient information. It reads only your public web pages, the ones anyone can open (what the scan reads).
Questions
Does a chatbot on our practice website need a BAA?
Yes, if your practice is a covered entity and the bot handles patient information for you. HHS lists an outside vendor's AI chatbot that handles patients' information for symptom checks, reminders and scheduling among its examples of a business associate (U.S. Department of Health and Human Services). If you are not sure what a bot collects, ask the vendor, and check the answer with your privacy officer or counsel before the bot goes live.
Does our web designer need to sign a BAA?
Only if the work involves patient information. A designer who builds pages anyone can read is not handling it. A designer who sets up a form that collects health details, or who can see what patients submit, may be, so raise the BAA before that work starts.
Is a vendor calling itself HIPAA compliant enough without a BAA?
No. A claim on a vendor's website is not the written assurance HHS describes. The BAA is the contract in which the vendor agrees to safeguard your patients' information and to use it only as the agreement permits (U.S. Department of Health and Human Services). Ask for the agreement itself.
Where this fits in our work
We sign no business associate agreement for any service, and we hold no patient contact lists. We do not offer our AI chatbot to dental, chiropractic, medical spa, medical or other practices that treat people. A practice that treats people sends its review requests from its own system, and we draft the wording. At a practice that treats people, contact and booking forms use the practice's own form or booking provider: we link or embed it, and health details never pass through our systems.
Related reading
Related terms
- Chatbot disclosure: Telling visitors they are talking to a bot, what some state laws require, and how to say it plainly.
- AI hallucination: When an AI tool states something false with confidence, why it happens, and what it means for a chatbot that speaks for your business.
Sources
- U.S. Department of Health and Human Services: Business Associates, updated July 30, 2026. Checked September 26, 2026.
- U.S. Department of Health and Human Services: Covered Entities and Business Associates, updated August 21, 2024. Checked September 26, 2026.