What Is a BAA and Why Does Every AI Vendor Need One?
A Business Associate Agreement (BAA) is a written contract required by HIPAA that obligates a vendor to safeguard any protected health information (PHI) they access on your behalf. If you're a healthcare provider or a business that handles PHI, you cannot legally share that data with an AI vendor unless a signed BAA is in place. No BAA means no legal basis for the data exchange, and both parties are exposed to HIPAA penalties.
Why this question keeps coming up in AI projects
Healthcare practices, billing companies, and health-tech startups are increasingly building AI tools for scheduling, documentation, triage, and patient communication. Almost every one of those use cases touches PHI. The people buying these AI systems often know HIPAA exists but aren't sure exactly what the BAA requirement means in practice or whether their AI vendor qualifies as a business associate in the first place.
The confusion is understandable. Most AI vendors market themselves as software companies, not healthcare contractors. But HIPAA doesn't care how a vendor classifies itself. If the vendor's system touches, stores, transmits, or processes PHI on your behalf, they're a business associate under 45 CFR §160.103, and the BAA requirement applies.
What a BAA actually requires and what it protects
A BAA must specify what PHI the business associate can use and disclose, require them to implement appropriate safeguards, obligate them to report breaches, and require them to return or destroy PHI when the contract ends. These aren't optional provisions. HHS has published required elements, and a BAA that's missing them doesn't satisfy HIPAA even if both parties signed it.
For AI systems specifically, the BAA has to cover not just data storage but also how the model processes inputs. If a dental practice sends patient notes into a public AI API with no BAA, that's a HIPAA violation the moment the request leaves the practice's network. OpenAI's standard API terms do not include a BAA for most accounts. Anthropic's Claude API does not offer a BAA for general commercial use. Google's Gemini API BAA availability is limited. Microsoft's HIPAA BAA covers specific Azure and Copilot for Microsoft 365 configurations, not all products by default.
The practical implication: if you're evaluating an AI vendor for anything that touches PHI, the first question isn't 'what can this model do.' It's 'will you sign a BAA, and does your architecture actually support the obligations in it.' A vendor who agrees to sign a BAA but routes your data through a third-party model API that has no BAA of its own has created a gap in your compliance chain.
When a BAA isn't required
Not every AI project in healthcare requires a BAA. If the AI system never touches PHI, such as a general scheduling chatbot that only handles names and appointment times with no diagnosis or insurance data, you may be operating outside HIPAA's scope. De-identified data under HIPAA's Safe Harbor or Expert Determination standards also falls outside the BAA requirement, but the de-identification has to be rigorous and documented, not just a best-guess scrub.
If you're in finance, logistics, retail, or real estate rather than healthcare, HIPAA's BAA requirement doesn't apply. You may still need data processing agreements under GDPR, CCPA, or your industry's equivalent, but that's a separate question.
How we handle BAAs at Usmart
We sign BAAs for any engagement that involves PHI. That's not a marketing point. It's a baseline requirement we won't waive. More importantly, we build systems where the BAA obligation is actually supportable: private LLM deployments running in your cloud environment or ours, not public API wrappers that route your patient data through a third party we can't contractually bind.
When a healthcare client comes to us, we map PHI flows before we write a line of code. That mapping tells us exactly which components need to be covered under the BAA and which can use standard commercial terms. We've done this across medical practices, behavioral health platforms, and health-tech startups. If you're unsure whether your current AI vendor's BAA actually holds up, that's a conversation worth having before HHS asks the same question.
Ready to see it working for your business?
Book a free 30-minute strategy call. We will scope your use case and give you honest numbers on timeline, cost, and ROI.