A business associate agreement (BAA) outlines the responsibilities of healthcare organizations (also called covered entities) and their vendors (also called business associates) in properly handling protected health information (PHI). Healthcare organizations rely heavily on business associates to perform important functions that could involve patients’ PHI. The objective of covered entities is to ensure that their business associates comply with the HIPAA Act.

Unfortunately, with the advancement of new technologies, such as artificial intelligence (AI), business associate attacks in 2026 have become even more difficult for hospitals and clinics to defend against. Modern attacks are considered to be more sophisticated, faster, and more scalable, and healthcare organizations need to understand more about the BAA and how it could prevent the consequences of business associate attacks in 2026.

Need to know: HIPAA-compliant email communication with business associates

 

What is a business associate?

The Health Insurance Portability and Accountability Act (HIPAA) sets national standards that safeguard the privacy and security of PHI. Compliance with the HIPAA Act is a legal requirement that protects patients’ privacy and ultimately lets providers focus on patient care. The legislation applies to healthcare organizations as well as their business associates.

According to the U.S. Department of Health & Human Services (HHS), a business associate is a person or entity that performs certain functions or activities that involve the use or disclosure of PHI for a covered entity. The department further states that “the Privacy Rule allows covered providers and health plans to disclose [PHI] to these ‘business associates’ if the providers or plans obtain satisfactory assurances that the business associate will use the information only for the purposes for which it was engaged by the covered entity, will safeguard the information from misuse, and will help the covered entity comply with some of the covered entity’s duties under the Privacy Rule.”

Business associates must implement strong privacy and security measures, recognizing their direct obligation to adhere to HIPAA and the potential penalties associated with noncompliance.

 

Healthcare business associate roles

Healthcare organizations collaborate with different types of business associates to enhance their health operations. These companies directly engage with healthcare providers to ensure smooth business operations. Tasks of business associates range from billing and IT support to medical equipment and software and can include the following roles:

  1. Third-party administrators (e.g., claims processors)
  2. Email providers (e.g., Paubox Email Suite)
  3. IT service providers
  4. Cloud storage providers
  5. Telehealth platforms
  6. Electronic health record (EHR) providers
  7. Insurance companies
  8. Appointment scheduling software companies
  9. Marketing and website providers
  10. Billing companies
  11. Medical transcriptionists
  12. Data analytics companies
  13. Lawyers, consultants, and accountants

HIPAA compliance requirements differentiate business associates from regular vendors. A healthcare business associate normally needs access to sensitive information (i.e., PHI) to perform their duties effectively and is therefore bound to HIPAA.

 

Is your business associate legally obligated under HIPAA?

Before choosing a business associate, providers should ask the vendor the following questions to see if it is a business associate that must demonstrate HIPAA compliance.

Do you provide services or perform functions for healthcare providers, health plans, or healthcare clearinghouses?

Are your services or functions integral to a covered entity’s operations?

Do you have a contractual agreement or arrangement with a covered entity to provide these services?

If the answers to the three questions are yes, the vendor qualifies as a business associate and should adhere to HIPAA’s regulations. These businesses have a responsibility to follow HIPAA’s rules. A HIPAA compliant business associate must implement a layered approach to security that includes physical, administrative, and technical safeguards. Other important measures should incorporate strong backup plans, such as incident response and disaster recovery strategies.

Moreover, these businesses must sign BAAs with every covered entity they plan to work with. If a business associate does not closely follow HIPAA guidelines and/or will not sign a BAA, it may cause a disastrous breach of information, possibly putting the liability for a HIPAA violation on a provider.

Learn about: When should you ask for a business associate agreement?

 

About the BAA

Under HIPAA, a BAA is a legally binding contract that defines how a business associate may use and disclose PHI and what obligations it must fulfill to keep that information safe. A BAA should be in place before any PHI is shared or accessed by a business associate. Its goal is to ensure compliance with HIPAA standards.

A well-written BAA covers permissible uses and disclosures of PHI, security standards, breach reporting procedures, subcontracting arrangements, and termination clauses and includes the following objectives:

  • Protect PHI
  • Define responsibilities
  • Establish safeguards
  • Ensure accountability
  • Regulate subcontractors
  • Mitigate risks

The BAA also defines what happens after a breach and the potential consequences, including termination of contract, corrective action plans, and financial penalties. A poorly drafted agreement can leave both parties exposed to liability, regulatory penalties, and reputational damage. These agreements should remain in place throughout the provider–vendor relationship and extend beyond the established data-retention period. Finally, regular reviews of the agreement and its content are necessary to ensure HIPAA compliance.

More info: What does a HIPAA compliant BAA look like?

 

What can’t a BAA do

A BAA is not an active security check. It establishes needed cybersecurity measures (e.g., use of encryption, notification after a breach) but does not guarantee that a business associate will follow them. Moreover, having a signed BAA will not prevent a hacker from attacking a business associate’s systems, leading to various penalties, including HIPAA fines, reputational damage, and potential lawsuits.

Indeed, HHS recorded breaches and known enforcement actions show that even with a BAA in place, healthcare providers can be penalized if their business associates are breached and if they’ve failed to verify business associate security protocols or take the BAA seriously. The HIPAA Act requires covered entities to have a BAA with each business associate, but guidance makes it clear that a BAA alone cannot substitute for strong defenses.

A business associate can mishandle PHI and/or be a victim of a breach, and a covered entity can still suffer the fallout despite having an agreement in place.

 

Business associates and BAAs in 2026

Healthcare business associates are following the same trends as other companies, adopting advanced technologies to further protect themselves and the healthcare companies that employ them. Today’s companies modernize by utilizing:

  • AI integration
  • Enhanced supply chain visibility (i.e., transparency)
  • Automation
  • Stronger third-party risk management
  • Advanced digital procurement strategies

Such innovations have occurred over the past few years due to changes in technologies, financial pressures, workforce transformations and issues, and new cyber risks.

The HIPAA Security Rule is undergoing a rewrite due to such changes and how health-related entities use them. For example, once enacted, both covered entities and business associates will be required to maintain and annually update a technology asset inventory and network map, conduct detailed security risk analyses tied to those inventories, and enforce access controls.

The updated guidelines will also require business associates to confirm adherence to safeguards and contingency plans. This means that the BAA would no longer be sufficient on its own to demonstrate compliance, and healthcare organizations would need to verify all aspects of a business associate’s security and update what they include in their BAA.

Ultimately, the updated rules will have business associates directly liable for HIPAA violations.

 

Best practices for working with business associates in 2026

The key to finding a HIPAA compliant business associate in 2026 is to carefully examine the company’s activities and how it protects PHI. Healthcare providers should evaluate a business associate’s security certifications, compliance history, data protection measures, incident response capabilities, and training agendas. Moreover, they should look for business associates that:

  1. Sign an updated BAA and mention HIPAA compliance
  2. Provide written verification at least annually of technical safeguards (2027 update)
  3. Utilize security measures that comply with HIPAA’s technical, physical, and administrative safeguards
  4. Understand and can answer questions about HIPAA
  5. Have HIPAA-related policies and procedures available
  6. Provide reviews, testimonials, and case studies from other healthcare organizations
  7. Deliver staff training on HIPAA and PHI security
  8. Conduct comprehensive risk analyses
  9. Continuously update their security based on new laws and new attack methods

If a business associate refuses to do any of the above, a healthcare organization should find an alternative, HIPAA compliant solution. Sharing PHI with a business associate that does not demonstrate compliance puts an organization at risk of breaches, HIPAA violations, and fines.

Related info:

 

FAQs

Are business associates directly liable under HIPAA?

Yes. HHS’ Office for Civil Rights explains that business associates are directly liable for certain HIPAA violations.

 

Can a covered entity use a business associate without a BAA?

No, not when the business associate is acting as a business associate. Guidance says covered entities and business associates must enter into HIPAA compliant business associate contracts with business associates that create, receive, maintain, or transmit PHI on their behalf.

 

Does a business associate need agreements with its subcontractors?

Yes. A business associate must ensure that subcontractors with access to protected health information agree to the same restrictions and conditions that apply to the business associate.

 

What information should be included in a BAA?

A BAA should define permitted uses of PHI, security standards, breach procedures, subcontracting rules, and termination clauses.

 

Can BAAs be verbal agreements?

No, BAAs must be written documents signed by both parties.

 

Do standard BAA templates suffice?

While templates can be starting points, customization to address unique risks is important. Consulting a legal professional with HIPAA expertise is recommended.

 

Can a covered entity terminate a BAA if they’re not satisfied with the business associate’s security practices?

Yes, BAAs typically include termination clauses allowing either party to end the agreement under certain circumstances, including concerns about inadequate security practices.

 

Are there any resources available to help healthcare organizations understand BAAs?

Yes, HHS provides various resources, including sample agreements, guidance documents, and FAQs. Industry associations and legal professionals who specialize in healthcare law can also offer valuable assistance.