What is a Business Associate Agreement (BAA)?
A Business Associate Agreement (BAA) is a contract required by HIPAA between a covered entity, such as a medical practice, and a vendor that creates, receives, stores or sends protected health information (PHI) on its behalf. It sets out how the vendor may use the information, how it must protect it, and what happens if there is a breach.
- Needed whenever a vendor handles PHI for the practice: marketing agencies with access to patient lists, CRMs, call-tracking and texting tools.
- The BAA limits the vendor to permitted uses and requires safeguards and breach reporting.
- Signing a BAA does not make every marketing use of PHI allowed; marketing still needs patient authorization in many cases.
- Tools that refuse to sign a BAA should not receive patient information.
- Every practice welcome — retainers from $499/mo, Goals-Driven engagements, Performance-Linked Payout Models available.
- Dallas, Texas LLC
- US client team · Central Time (CST)
- 25+ US healthcare clients
- BAA signed with every client
- HIPAA compliance training across client and delivery teams
- Contracts and invoices in USD
-
Primary Care · North Dallas, TXCase study →
-
MedSpa · North Dallas, TX
-
Skin Care · Beverly Hills, CA
-
Dental · Christiansburg, VACase study →
-
Pediatrics · Blacksburg, VACase study →
-
Pediatric Dentistry · Blacksburg, VACase study →
-
Dental · Roanoke, VACase study →
-
Functional Medicine · Telehealth · USACase study →
“They were able to get all my ideas and work with me over a period of three to four months and create this amazing website. It's super customized, very modern, and it incorporates all the elements that I had wanted — the patient portal, nice pictures, a very interactive website, patient reviews. I would highly recommend their company to anyone who wants to make an excellent website.”
What a BAA covers
Under the HIPAA Privacy and Security Rules, a business associate is a person or company that performs a function for a covered entity involving PHI. The BAA must describe the permitted uses and disclosures, require appropriate safeguards, require the vendor to report breaches and security incidents, pass the same obligations to any subcontractors, and return or destroy PHI when the contract ends.
When a marketing vendor needs a BAA
- Needs a BAA: an agency that uploads patient lists to build audiences, a CRM that stores enquiries with health details, a call-tracking tool that records patient calls, a texting platform sending appointment reminders, a website form provider that receives symptoms or treatment interests.
- Usually does not: a vendor that only works with anonymous, aggregate data and never receives information that identifies a patient.
Ad platforms and analytics tools are a common gap: many will not sign a BAA, which is why tracking pixels on pages where patients share health information need careful configuration. See our HIPAA-safe website tracking guide.
What a BAA does not do
A BAA makes it lawful for the vendor to handle PHI for the practice's permitted purposes. It does not, on its own, allow the practice to use PHI for marketing. HIPAA generally requires a patient's written authorization before PHI is used for marketing communications, with narrow exceptions such as communications about the practice's own treatments in some circumstances. State privacy laws can add further requirements.
A BAA checklist for marketing vendors
- List every marketing tool and vendor and note whether it receives names, phone numbers, emails, call recordings or health details from patients.
- For each one that does, confirm a signed BAA is on file before data flows.
- Check that the vendor's subcontractors, such as hosting or messaging providers, are covered by the vendor's own agreements.
- Configure tools that will not sign a BAA so they never receive PHI, for example by removing health details from form fields and URLs passed to analytics.
- Review the list at least once a year and whenever you add a new tool.
Related pages from the US team
HIPAA-safe website tracking
How to measure marketing without leaking PHI to ad platforms.
HIPAA and dental advertising
Compliance for dental practice marketing.
US healthcare marketing glossary
Every term, defined in plain English.
Healthcare marketing agency USA
How Ichelon Consulting US works, with a BAA from day one.
Every practice welcome — Goals-Driven engagements from $499/mo
We benchmark your last 90 days, agree monthly goals with you, and track them live on Ichelon Agency OS with a report every Monday. Performance-Linked Payout Models are available. Our US leadership is based in Dallas, and strategy calls run in US business hours.
Common questions
Does a healthcare marketing agency need to sign a BAA?
Yes, if the agency will create, receive, store or send protected health information for the practice, for example patient lists, call recordings or form submissions with health details. If it only works with anonymous, aggregate data, a BAA may not be required.
Is a BAA the same as HIPAA compliance?
No. A BAA is one requirement. The practice and the vendor still need safeguards, staff training, access controls and correct use of PHI, and marketing uses of PHI may need patient authorization.
What happens if a vendor will not sign a BAA?
Then the practice should not share PHI with that vendor. Many practices change how a tool is configured so it never receives PHI, or switch to a vendor that will sign.
Does Ichelon Consulting US sign BAAs?
Yes. Ichelon Consulting US signs a Business Associate Agreement with every US client before handling any patient information.
A note on this guide: it explains marketing practice, not legal advice. Rules on privacy, advertising and insurance change and vary by state, so confirm anything compliance-related with your own counsel.
Not sure which of your tools touch patient data?
A 30-minute call with the US team. We'll map where PHI flows in your marketing and which vendors need a BAA.