Who signs the business associate agreement, you or your MSP?
Both sign. Your practice is the covered entity and your IT provider is the business associate, but the duty to obtain the agreement is yours, and so is the liability if it is missing. HIPAA names ten provisions the contract must contain. The signature transfers work, not accountability.
- Both parties sign, but the duty to obtain the agreement sits with the practice. HIPAA puts the covered entity out of compliance when the contract is missing, not the vendor.
- HIPAA names ten required provisions in the Privacy Rule contract and three more in the Security Rule. Count them in the document your provider emailed you.
- Your provider has up to 60 days to tell you about a breach. If it acts as your agent, your own 60-day clock to notify patients started the day it found out.
- Your provider decides whether an incident was a breach at all, using a four-factor risk assessment. Ask to see that assessment in writing, every time.
- A signature does not move your risk analysis, your privacy official, your workforce training or your penalty exposure. Those stay with the practice.
Who signs the business associate agreement, you or your MSP?
Both parties sign the business associate agreement, and the practice is the one HIPAA holds responsible for getting it signed. Your medical or dental practice is the covered entity. Your IT provider is the business associate. The duty to obtain the contract sits with you, not with the vendor who emailed it over.
Both roles are defined, not negotiable. A health care provider is a covered entity once it transmits any health information in electronic form in connection with a covered transaction. A business associate is a person who, on behalf of that covered entity, creates, receives, maintains, or transmits protected health information, while providing a service other than as a member of the workforce. Your employed office IT person is workforce. The outside firm you pay monthly is not.
The obligation runs one way. A covered entity may disclose protected health information to a business associate only if it obtains satisfactory assurance that the business associate will appropriately safeguard the information, and those satisfactory assurances must be documented through a written contract. The Security Rule lists a written contract or other arrangement as Required. So your provider does not hand you a business associate agreement as a courtesy. You are required to hold one.
The enforcement question lands on your practice first, if the contract is missing, thin or unsigned. Read this beside Your MSP's SOC 2 Does Not Cover You. None of it is legal advice.
Does your IT provider need a business associate agreement at all?
Yes, your IT provider needs a business associate agreement if it can reach protected health information, including when it only stores or carries encrypted files it never opens. A firm holding administrator credentials to your server, your email tenant or your backups can reach the records by definition.
The definition reaches further than most practices expect. Business associate status covers any person that provides data transmission services with respect to protected health information and that requires access on a routine basis. Cloud hosting, remote monitoring, backup and email filtering all sit inside that sentence.
The conduit exception is narrower than your vendor thinks
The conduit exception excludes couriers, not IT providers. HHS wrote that the exception is a narrow one and is intended to exclude only those entities providing mere courier services, and that a conduit transports information but does not access it other than on a random or infrequent basis. The dividing line HHS drew is the transient versus persistent nature of that opportunity to see the data.
The postal service and an internet carrier moving packets are transient. A provider with a standing remote session into your practice management system has persistent access, whether anyone looks or not. HHS applied the same reasoning to storage, treating a data storage company as a business associate even where it rarely views what it holds. So "we never open patient records" is not an answer, because the exception turns on opportunity rather than habit.
What does HIPAA require the agreement to say?
HIPAA requires thirteen provisions in total, ten under the Privacy Rule and three more under the Security Rule. The Privacy Rule contract must provide that the business associate will do each of the ten things listed below.
- Not use or disclose the information other than as permitted or required by the contract or by law.
- Use appropriate safeguards and comply, where applicable, with the Security Rule.
- Report to you any use or disclosure of the information not provided for by its contract.
- Ensure that any subcontractors that create, receive, maintain, or transmit protected health information agree to the same restrictions.
- Make available protected health information so you can answer a patient's right of access request.
- Make available protected health information for amendment, and incorporate any amendments you make.
- Make available the information you need to provide an accounting of disclosures.
- Comply with the parts of the Privacy Rule that apply to you, to the extent it carries out one of your obligations.
- Make its internal practices, books, and records available to the Secretary.
- Return or destroy all protected health information at termination of the contract, if feasible.
The Security Rule adds three, and they are shorter. The contract must provide that the business associate will comply with the applicable requirements of the Security Rule, ensure that any subcontractors handling electronic protected health information agree to comply, and report to the covered entity any security incident of which it becomes aware. That third clause is the most useful sentence in the document, because a security incident is a far lower bar than a confirmed breach.
Two limits in the same regulation get skipped, and both protect you. The contract may not authorize the business associate to use or further disclose the information in a way that would break the Privacy Rule if your practice did it, so strike any clause letting your provider use patient data to improve its own products. The contract must also authorize termination by the covered entity if the business associate has violated a material term, so check that your termination clause runs in your direction.
Hold the emailed document against that list of thirteen. A one-page agreement with no subcontractor clause and no return-or-destroy clause is not a compliant contract, however confidently it is titled.
What does signing the agreement not transfer?
Signing transfers four duties and leaves four behind. It moves a written duty, a reporting duty, a subcontractor duty and a termination remedy. It does not move the four below.
Penalty exposure does not move
The regulator can reach both of you, and it can reach you for your provider's conduct. The Secretary imposes a civil money penalty upon a covered entity or business associate that violates the rules, and against each party responsible. A covered entity is also liable, in accordance with the Federal common law of agency, for a civil money penalty based on the act or omission of any agent, including a business associate acting within the scope of the agency. Your signature buys a contractual claim against your provider. It does not buy indemnity from the government.
Your own risk analysis does not move
The Security Rule requires your practice to conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the protected health information it holds, then to implement security measures sufficient to reduce those risks. A provider can run the risk analysis with you and should. It cannot own the obligation.
The Privacy Rule duties are equally personal. Your practice must designate a privacy official, train all members of its workforce, have appropriate administrative, technical and physical safeguards in place, and provide a process for individuals to make complaints. None of those four appears on a vendor invoice.
The paperwork also outlives the relationship. A covered entity or business associate must retain required documentation for 6 years from the date of its creation or the date when it last was in effect, whichever is later. A provider you replaced three years ago is not keeping your file, so collect the agreement, the risk analysis and the incident reports before you leave. See the audit evidence an auditor asks for that nobody collects.
A provider who will tell you in writing whether it is acting as your agent is answering a harder question than whether it is HIPAA compliant.
Who tells whom about a breach, and how fast?
Your provider tells you, you tell the patients, and both outer deadlines are 60 calendar days from discovery. The trap is whose discovery starts your clock, and the business associate agreement is where that gets settled.
A business associate must notify the covered entity of a breach of unsecured protected health information without unreasonable delay and no later than 60 calendar days after discovery, where discovery means the first day on which the breach is known, or would have been known by exercising reasonable diligence. Your practice must then notify each affected individual without unreasonable delay and in no case later than 60 calendar days after discovery of a breach.
Read quickly, that looks like 120 days. It is not. The rule treats an incident as discovered by your practice when it is known to any person, other than the person committing the breach, who is a workforce member or agent of the covered entity, determined in accordance with the federal common law of agency. HHS spelled out the consequence. Where the business associate is an agent of the covered entity, the business associate's discovery of the breach will be imputed to the covered entity. Where it is not an agent, the covered entity is required to provide notification based on the time the business associate notifies it.
So two identical incidents produce two different deadlines, and the difference turns on a question of agency law nobody raises at signing. If your provider is your agent and takes 55 days to tell you, you have five days left, not sixty. If it is an independent contractor, your clock starts fresh on the day you are told.
The fix is contractual and cheap. Require written notice of any suspected security incident in hours rather than days, and require the provider to state whether it considers itself your agent. HIPAA already says the business associate must supply any other available information you need for the individual notice, as it becomes available.
Your filing duties sit on the same clock. For a breach involving 500 or more individuals you notify the Secretary contemporaneously with the notice to individuals. For fewer than 500 you maintain a log and report not later than 60 days after the end of each calendar year. The annual log is the one small practices forget, because nothing prompts it.
Who decides whether an incident was a breach at all?
Whoever holds the data decides first, which in a managed IT relationship usually means your provider. Most practices never see that decision being made.
The rule starts in your favor. Any acquisition, access, use or disclosure of protected health information not permitted by the Privacy Rule is presumed to be a breach unless the covered entity or business associate demonstrates that there is a low probability that the protected health information has been compromised. That demonstration rests on a risk assessment of at least four factors.
- The nature and extent of the protected health information involved, including the types of identifiers and the likelihood of re-identification.
- The unauthorized person who used the protected health information or to whom the disclosure was made.
- Whether the protected health information was actually acquired or viewed.
- The extent to which the risk to the protected health information has been mitigated.
Three narrow exceptions sit alongside the presumption, including an unintentional, good faith access by a workforce member acting within the scope of authority. Here is why that matters in your agreement. A provider that documents a low probability of compromise never has to tell you, and you never notify a patient or file anything. That is a conclusion the regulation allows, reached by the party whose own mistake is under review, with no duty to show you its working.
Write the visibility in yourself. Require the provider to report every suspected security incident, not only confirmed breaches, and to hand over its four-factor assessment in writing so your privacy official can disagree. The Security Rule contract already obliges it to report any security incident of which it becomes aware, a lower bar it already owes you.
What happens to your provider's subcontractors?
They become business associates themselves, and you sign nothing with them. A covered entity is not required to obtain satisfactory assurances from a business associate that is a subcontractor, because that duty belongs one link down the chain.
Your provider carries it. A business associate may let a subcontractor handle protected health information only if it obtains satisfactory assurances that the subcontractor will appropriately safeguard the information. Status follows the data rather than the paperwork, because a subcontractor that creates, receives, maintains, or transmits protected health information on behalf of a business associate is itself a business associate, whether or not anyone has papered it.
The chain has teeth pointing upward too. A business associate is not in compliance if it knew of a pattern of activity or practice of a subcontractor that constituted a material breach and failed to act. Your own duty is identical in shape. A covered entity is not in compliance if it knew of a pattern of activity or practice of the business associate and did not cure it, then terminate the contract where that failed.
That pairing is the part buyers misread. The rule that frees you from signing with subcontractors also removes your line of sight, while leaving you answerable for ignoring a pattern you could have seen. So ask for a list, naming the monitoring vendor, the backup target and any offshore help desk, with the date each one signed downstream. Verizon reported a third party involved in 48 percent of all breaches, with third-party supply chain breaches up 60 percent.
What does it cost to get this wrong?
Penalties run across four culpability tiers, currently from a $145 minimum to $73,011 per violation. The tier depends on what your practice knew, which is why a missing document is a bad place to be found.
The tiers escalate from a violation the entity did not know about and would not have known about by exercising reasonable diligence, through one due to reasonable cause and not to willful neglect, to willful neglect corrected during the 30-day period, to willful neglect not corrected. The amounts published on 28 January 2026 run from a $145 minimum in the lowest tier to a maximum of $73,011 for each violation, with a calendar year cap of $2,190,294 for violations of an identical provision.
One qualifier belongs with those figures. Since 2019 HHS has applied, as a matter of enforcement discretion and pending further rulemaking, separate annual limits per tier of $25,000, $100,000, $250,000 and $1,500,000 rather than the single published cap. That is a policy position, not an amended regulation.
The penalty is rarely the largest figure on the page. IBM put the average cost of a healthcare data breach at $6.64 million in 2026, against a global average of $4.99 million, and measured 247 days to identify and contain an active breach. A missing business associate agreement does not cause a breach. It removes your evidence, your notice period and your remedy at the moment all three matter.
What to ask your provider this week
Six questions settle this, and every one is answerable from documents your provider already holds, so you can verify the answers rather than trust them. Send them in one email and keep the replies in your compliance folder.
- Send the signed agreement with both signatures and both dates, so we can count the ten Privacy Rule provisions.
- State how many hours you have to notify us of a suspected security incident, and whether that clause says 60 days.
- Confirm in writing whether you are our agent or an independent contractor for breach notification purposes.
- List every subcontractor that can reach our systems, and the date each one signed downstream.
- Share the four-factor assessment from the last incident you judged not to be a breach.
- Specify what you will return or destroy on termination, in how many days, and what written evidence we get.
Expect the third question to cause the longest pause. It is the only one a sales engineer cannot answer from a template, and the only one that tells you how much of your 60 days you control.
The rules are moving toward buyers who ask for evidence. In a Security Rule update proposed in January 2025, HHS would require a covered entity to obtain written verification from the business associate at least once every 12 months that required technical safeguards are deployed, including a written analysis of the business associate's relevant electronic information systems and a written certification that the analysis has been performed and is accurate. No proposal binds anyone until a final rule publishes, and this one has not.
No provider can make your practice compliant by signing a form. What the signature does is create a written, enforceable duty, a reporting clock you can shorten, and a paper trail an investigator will ask for. The accountability stays where the patient records do. Start next with HIPAA Compliant File Sharing.
FAQ
Who is responsible for having a business associate agreement in place, the practice or the IT provider?
The practice. A covered entity may disclose protected health information to a business associate only if it obtains satisfactory assurance that the business associate will appropriately safeguard the information, documented in a written contract. Both parties sign, but the compliance duty and the penalty exposure sit with the practice.
Does my IT provider need a BAA if it never looks at patient records?
Yes, if it can reach them. HHS calls the conduit exception a narrow one, intended to exclude only those entities providing mere courier services, and says the line is the transient versus persistent nature of that opportunity. A provider holding administrator credentials has persistent access whether it reads anything or not.
How fast must my IT provider tell me about a breach?
HIPAA sets the outer limit at 60 calendar days after the business associate discovers the breach, which is too slow to be useful. Your own deadline to notify patients is also 60 calendar days after discovery, and it can start on their discovery date if they act as your agent.
What does a business associate agreement have to contain?
Ten provisions under the Privacy Rule and three under the Security Rule. They cover permitted uses, safeguards, reporting, subcontractors, patient access, amendment, accounting of disclosures, records for the Secretary, and return or destruction of all protected health information at termination, if feasible. The Security Rule adds reporting any security incident of which the provider becomes aware.
Can a signed BAA make my practice HIPAA compliant?
No, and no federal body certifies a vendor as HIPAA compliant either. A covered entity stays liable for a penalty based on the act or omission of a business associate acting within the scope of the agency, and still owes its own risk analysis, privacy official and six-year documentation.
Best IT MSP is the independent directory of vetted managed IT and cybersecurity providers across North America. Organic ranking is earned on rating and verified data, and paid placement is always labelled. Take these six questions to three merit-ranked firms in your city and compare what comes back in writing.