HIPAA and the BAA
What HIPAA requires of a vendor like 2care, what the BAA commits us to, and when it is signed.
3 min read
Key terms
- PHI. Protected health information: health details that can be tied to a patient, such as a name with an appointment reason.
- Covered entity. An organisation HIPAA applies to directly, such as your practice.
- Business associate. A company that handles PHI on a covered entity's behalf.
- BAA. A business associate agreement: the contract HIPAA requires between your practice and each business associate.
This page is general information, not legal advice.
What HIPAA requires
HHS defines a business associate as a company that performs functions on behalf of a covered entity "that involve creating, receiving, maintaining, or transmitting PHI". Your practice must have a BAA in place with each business associate. HHS also treats a subcontractor that handles PHI for a business associate as a business associate itself, so the obligations carry down the chain.
Why 2care is in scope
| What 2care does | Why it counts |
|---|---|
| Answers calls and hears patient details | Receives PHI |
| Books, cancels and registers patients in your system | Creates and transmits PHI |
| Keeps call transcripts and recordings | Maintains PHI |
| Checks insurance eligibility | Transmits PHI to payers through a clearinghouse connection |
Conduits and storage
Some services are exempt as "conduits", such as a phone carrier that only carries a signal. HHS limits that exception to transmission-only services that access information only "on a random or infrequent basis". A voice agent that listens to the patient and acts on what they say is a business associate, so 2care signs a BAA.
HHS guidance on cloud computing adds that business associate status holds even when a service stores only encrypted data. Its guidance on audio-only telehealth says a service that stores recordings or transcripts needs a BAA.
What the BAA commits 2care to
HHS publishes sample BAA provisions setting out what a BAA must do.
- Permitted uses. It sets the uses and disclosures of PHI allowed, tied to the services 2care provides to your practice.
- No other uses. It bars any other use or disclosure. 2care also never uses patient data to train shared models.
- Safeguards. It requires appropriate safeguards, including the HIPAA Security Rule for electronic PHI.
- Reporting. It requires 2care to report any use or disclosure the agreement does not allow, including breaches of unsecured PHI.
When the BAA is signed
The BAA is the first step in onboarding. It is signed before your systems are connected and before any patient data is read. See how onboarding works.
The proposed 2025 Security Rule changes
In January 2025 HHS proposed changes to the HIPAA Security Rule. Among other things, the proposal would require encryption of electronic PHI at rest and in transit, and multi-factor authentication. These changes are proposed, and 2care already encrypts patient data at rest with AES-256 and in transit with TLS 1.2 or higher.
Questions
Is there a HIPAA certification?
There is no official HIPAA certification for any company. What HIPAA asks of a business associate is a signed BAA and the safeguards the Security Rule describes. 2care signs a BAA with every practice, encrypts PHI at rest and in transit, and keeps full audit logs.
Do we need a separate BAA for call recordings?
No. The BAA covers the services 2care provides to your practice, including the recordings and transcripts it keeps. See call recordings and transcripts.
Who on our side signs the BAA?
Whoever is authorised to sign contracts for your practice. Your onboarding specialist sends the BAA to that person at the start.
Related
Was this page helpful?