Do I need a BAA with my IT company?

Key facts

Is my IT company really a business associate?

Almost certainly. A business associate is a person or organization that creates, receives, maintains or transmits PHI on behalf of a covered entity (45 CFR 160.103). HHS's own list of examples includes an "IT contractor or vendor (e.g., EHR vendor, Managed Services Provider)" that maintains or supports systems requiring it to create, receive, maintain or transmit ePHI, whether on site or remotely (HHS). If your MSP can log into the PMS server, the imaging database or the backups, that's you.

Who isn't one? HHS says a BAA isn't required with someone like a janitorial service or electrician whose access to PHI would be incidental at most, or with a pure conduit such as the postal service and its electronic equivalents. The conduit exception is limited to transmission-only services; entities that access PHI regularly to perform a service are not conduits (HHS). Your MSP isn't a conduit.

Using a cloud vendor to store ePHI without a BAA is itself a violation, according to HHS (HHS cloud guidance).

What must the BAA say?

The Privacy Rule lists required terms at 45 CFR 164.504(e)(2) (LII), and the Security Rule adds more at 164.314(a) (LII). In plain terms:

HHS publishes sample provisions you can compare against (HHS sample BAA provisions).

What should a dental practice add beyond the minimum?

The minimum protects patients. These additions protect the practice.

• A shorter breach-reporting clock. The rule's outer limit is 60 calendar days after discovery (45 CFR 164.410), and HHS says a BAA may require more timely reporting (HHS cloud guidance). Pick a number of days and write it in.
• Security-incident reporting detail. The Security Rule doesn't prescribe format or frequency, so HHS says the parties can define them in the BAA (HHS cloud guidance).
• No blocking access. HHS says a business associate may not block your access to PHI, including in a payment dispute (HHS FAQ 2074). Restate it.
• Data return format. Return in a usable format, then certify destruction. HHS lists the manner of data return as an SLA topic for cloud vendors (HHS cloud guidance).
• A list of subcontractors. Remote-monitoring tools, backup clouds and help-desk outsourcers that touch ePHI are subcontractors who need their own BAAs (45 CFR 164.502).

What does a BAA not cover?

Your firewall password, your domain, your Microsoft 365 admin account and your hardware licenses. A BAA governs PHI. Ownership of accounts and credentials belongs in the service agreement; see dental IT contract clauses and who owns dental office passwords.

Who else in a dental office needs a BAA?

Anyone else who creates, receives, maintains or transmits ePHI for you: a cloud PMS or imaging host, backup provider, email host, phone system that stores voicemail or call recordings with patient information, and service technicians for devices that store PHI (HHS). Keep the list with your HIPAA IT checklist.

When should the BAA be signed?

Before the IT company first touches a system that holds ePHI, which for a startup means before the PMS server or cloud tenant is configured, and for a takeover means before the new MSP logs in. If you're changing providers, sign the new BAA first and collect the old provider's return-or-destroy certification last; the sequence is in taking over a dental client from another MSP. Then grant access through named, revocable accounts, as described in sharing credentials with dental clients.

Which free tools help with this?

The credential ownership checklist (free tool, coming soon) is planned to list every login, license and account the practice should own, with a "password hostage" letter template. FloorStack Studio (live, free plan) places every device on your floor plan and gives you a device schedule with rooms, ports and cable lengths (FloorStack FAQ).

How FloorStack helps

FloorStack is a dental build-out platform, and we sign BAAs ourselves: a BAA is included on the Shared Stack and Full Stack plans and available on request for Floor Stack (FloorStack). Studio, the free planning tool, is designed not to hold PHI and isn't a business associate unless a separate BAA is signed (FloorStack HIPAA page). Use Studio (live, free to start) to list every system and vendor in the office, then run the free Credential ownership checklist (coming soon) to confirm each vendor with access has a BAA and an owner-revocable login. Visit the Own Your Dental Passwords hub.

Free tools for this step

• Credential ownership checklist: vendor access and BAA tracker (free tool, coming soon).
• Studio: list every system and vendor (live).