A BAA is what actually makes using a cloud or AI vendor HIPAA-compliant. Without a signed BAA, sharing PHI with the vendor is a violation — regardless of what its website says.
Ask for the BAA before a trial with real patient data, and check whether it covers subprocessors such as AI model providers.
From our data: Only 37 of 445 software products publicly state that a BAA is available.
Who needs one
Any vendor that creates, receives, stores or transmits protected health information for you is a business associate: cloud practice management systems, texting and reminder platforms, AI scribes and receptionists, insurance verification tools, IT providers and cloud backup services.
A vendor that never touches patient data, such as an accounting package holding only totals, does not need one.
What a good BAA covers
Permitted uses of the data, the safeguards the vendor maintains, breach notification deadlines, obligations passed on to subcontractors and what happens to the data when the contract ends. For AI products, check that the model provider is covered as a subcontractor and that your data is not used to train models without permission.
Examples
- Emitrr — All-in-one patient engagement
- Hello Rache — Virtual assistants
- mConsent — All-in-one patient engagement
- Scribeberry — AI scribes
- Viva AI — AI receptionists
FAQ
Is a BAA needed for a free trial?
Yes, if real patient data is used. Sign the BAA first or test with dummy data.