A Business Associate Agreement is the contract that lets a covered entity share PHI with a vendor and keeps the vendor bound to protect it. If your software partner will create, receive, maintain or transmit PHI on your behalf, HIPAA treats them as a business associate, and you need the agreement signed first. After the fact is too late.
When a developer needs one
A developer who only writes code against synthetic data may never touch PHI. In practice, projects almost always include something that does: a staging copy for debugging, a support session in production, hosting and monitoring. If any of that is likely, sign the BAA at the start. It costs nothing to have it ready.
Clauses worth reading twice
- Permitted uses: only to deliver the service, never analytics, marketing or model training.
- Safeguards: what the vendor commits to, and whether it points to the Security Rule and your architecture.
- Breach reporting: a clear timeline and what the first report must contain.
- Subcontractors: the same obligations flow down, and you can see who they are.
- Return or destruction: what happens to PHI and backups when the contract ends, and proof of it.
- Audit and cooperation: help with patient access requests and with an investigation.
Red flags
- A vendor that says "we are HIPAA certified". There is no such certification.
- Reluctance to name the cloud provider or to show that their own cloud agreement is in place.
- Developers using personal tools and accounts with real data.
- Chat, notes or AI tools in the workflow that will not sign a BAA.
A short vendor questionnaire
- Will you sign before anyone sees data?
- Who has access, and how is it removed?
- Is production data ever copied to development?
- What do your logs capture and who can edit them?
- How fast will you tell us about an incident?
- What happens to our data if we leave?
Have your own counsel review any agreement. This article is a plain language guide from an engineering team, and it is not legal advice.
Planning something like this?
We would be glad to look at your architecture or your plan. We sign an NDA and a BAA before you share anything sensitive.