“We offer a BAA” is a useful statement to investigate, not the end of a healthcare vendor review. The next questions are which product it covers, how information flows, and whether the actual configuration matches the agreement.
What is a business associate agreement?
A business associate agreement, or BAA, sets permitted uses and disclosures of protected health information and related obligations in a covered business-associate relationship. HHS guidance explains when entities performing certain functions involving PHI on behalf of a covered entity or another business associate need such an agreement. Exceptions exist; not every interaction with health information creates that relationship.[1]
Start by identifying who is acting for whom. A healthcare organization buying an AI service for its operations presents a different question from a person independently choosing a consumer wellness app. The word “health” in a product name is not enough to resolve HIPAA’s scope.
Why encryption does not settle the BAA question
HHS explains that a cloud provider maintaining electronic PHI can be a business associate even when the information is encrypted and the provider lacks the decryption key. It also emphasizes risk analysis and the responsibilities of both parties. “We cannot read it” is therefore not, by itself, an answer to whether the relationship needs a BAA.[2]
Keep three layers separate
- The agreement: what the parties are permitted and required to do.
- The configuration: which services, settings, and providers handle information.
- The operation: how access, incidents, changes, and retention are managed over time.
Map the AI workflow before reviewing the promise
A practical review sequence
Describe the activity
Write down what the AI is supposed to do and which data is necessary. Name the accountable organization and its role.
Draw the data path
Include the app, model provider, storage, logs, support systems, and any other service receiving information. Do not stop at the visible chat screen.
Match contracts to that path
Ask which legal entity and exact products the agreement covers. Identify relevant downstream relationships with the privacy and legal teams.
Verify the configuration
Confirm approved accounts, regions, retention, training settings, and access roles where applicable. Record who can change them.
Plan for a change or incident
Agree how to handle a new provider, an unsupported feature, a security incident, account closure, and the return or deletion of information.
Questions to bring to an AI vendor
Ask for specific evidence
- Does the BAA cover this exact API, feature, plan, and account?
- What happens to prompts, responses, files, and operational logs?
- Can customer content be used for model training, and where is that controlled?
- Which subcontractors receive PHI in this workflow?
- How are support access, retention exceptions, and incident notification handled?
- Which optional integrations or preview features fall outside the approved scope?
Keep the answers with the configuration record. A sales response about an enterprise product may not describe a free account, a third-party extension, or a newly enabled feature. If the scope is unclear, resolve it before sending PHI through that path.
A fictional example: the extra logging service
A clinic approves a model API for a defined workflow. Later, a developer adds a debugging service that captures complete requests. Even if the original agreement remains valid, the new data path needs its own review. The important question is not whether the model vendor once passed procurement; it is whether today’s system still matches what was approved.
What a BAA does not prove
A signed agreement does not establish that an AI answer is medically accurate, that a clinical use is appropriate, or that every operational control works. Those require separate evaluation. Similarly, an audit receipt may support investigation of a specific interaction without demonstrating compliance across the entire organization.
This is a general educational guide to the questions involved, not a determination about a specific service or contract. Healthcare teams should involve their privacy, security, and legal owners in assessing the actual relationship and deployment.
Common questions
Does every AI app need a BAA?
No. The relationship, activities, information, and applicable exceptions determine the answer. A personal consumer app is not automatically a business associate.
Does a BAA allow any use of the data?
No. It defines obligations and permitted activities within the applicable rules. Read the actual terms with the responsible reviewers.
Can a BAA replace a security assessment?
No. The agreement and the operational review answer different questions. Both need to match the workflow you are using.
