September 21, 2026
What HIPAA requires in a Business Associate Agreement, and what a practice should add.
Yes. If your IT provider can reach any system that holds client information, HIPAA requires a signed Business Associate Agreement before they begin work. That covers essentially every managed IT arrangement, because managing your computers means being able to access them. A BAA has to spell out six things, including how your provider may use client information, what safeguards they apply, whether their subcontractors are bound by the same terms, and what happens to your data when the relationship ends. Penalties for getting this wrong start at $145 per violation and reach $2,190,294 at the top tier.
If you are not certain whether you have one on file, that uncertainty is itself the answer worth acting on this week.
One note before we go further. This article is general information, not legal advice. Big U Computers is an IT company, not a law firm. Have your own counsel review any agreement before you sign it.
Which of Your Vendors Need a BAA
A business associate is any outside party that creates, receives, maintains, or transmits client information on your behalf. For a behavioral health practice, the list is longer than most administrators expect.
| Vendor | BAA? | Why |
|---|---|---|
| Your IT or managed services provider | Yes | They can reach the systems client information lives on |
| Your records platform vendor | Yes | They store the records themselves |
| Your email and Microsoft 365 provider | Yes | Client information moves through email constantly |
| Your offsite backup provider | Yes | Backups contain the same records |
| Your billing or clearinghouse vendor | Yes | They handle claims containing client information |
| Your shredding or records disposal vendor | Yes | Paper records still count |
| Your janitorial service | No | Incidental exposure is not the same as access |
| Your internet service provider | No | Treated as a conduit for data in transit |
The last two rows are where practices most often get confused. A cleaning service that might glance at a screen is treated as incidental exposure rather than access, and an internet provider that simply carries encrypted traffic is generally treated as a conduit. Your IT provider is neither. They hold the keys.
The Six Things HIPAA Requires a BAA to Contain
At minimum, the agreement has to address all six of these. If any are missing, the document may not do what you think it does.
- How your IT provider may use and disclose client information, stated specifically rather than generally.
- A commitment not to use or disclose it for any other purpose.
- The safeguards they will apply to protect electronic records, which ties back to the HIPAA Security Rule.
- An obligation to report breaches and security incidents to you.
- The same obligations flowed down to any subcontractor they use, which matters more than it sounds, because most IT providers use several.
- Return or destruction of your information when the relationship ends, and what happens if that is not feasible.
Six More Things a Practice Should Pin Down
These are not legally required. They are the ones practices wish they had negotiated once something goes wrong.
A breach notification clock with a real number on it
"Promptly" means nothing at three in the morning. Ask for a specific number of days, or hours, and get it in the document.
Which subcontractors touch your data, named
Your IT provider almost certainly uses outside platforms for monitoring, backup, and security. Ask which ones and what they can see. A provider who cannot answer quickly has not thought about it.
Encryption standards for laptops and backups
An unencrypted laptop with client information on it can turn a lost device into a reportable breach. An encrypted one usually does not. Put the expectation in writing.
Who owns your documentation and passwords
Some IT companies keep network documentation and credentials to themselves, which makes leaving painful and is meant to. Settle ownership at the start, while everyone is friendly.
How quickly they hand everything over if you leave
A number of days, in the agreement. Not a promise made during the sales process.
Cooperation if you are audited
If the Office for Civil Rights asks you for evidence of your safeguards, your IT provider holds much of it. Their obligation to help you produce it should be written down, not assumed.
What It Costs to Get This Wrong
HIPAA penalties sit in four tiers based on what you knew and whether you fixed it. These figures reflect the inflation adjustment published in the Federal Register on January 28, 2026, and they are updated annually.
| Tier | What it means | Per violation |
|---|---|---|
| Tier 1 | You did not know, and reasonable diligence would not have caught it | $145 to $73,011 |
| Tier 2 | Reasonable cause, but not willful neglect | $1,461 to $73,011 |
| Tier 3 | Willful neglect, corrected within 30 days | $14,602 to $73,011 |
| Tier 4 | Willful neglect, not corrected | $73,011 to $2,190,294 |
Two things are worth understanding about this table. First, not knowing still lands you in Tier 1 rather than getting you off entirely. Second, the difference between Tier 3 and Tier 4 is whether you corrected the problem, which means the practical response to discovering a missing BAA is to fix it now rather than to worry about it.
It is also worth noting that the Office for Civil Rights has said it is expanding its enforcement focus during 2026 from risk analysis into risk management, meaning not just whether you identified risks but whether you did anything about them.
How to Check Where You Stand This Week
This takes about thirty minutes and it is worth doing before your next staff meeting.
- List every outside vendor that can reach client information, including the ones nobody thinks about, such as backup and email.
- For each one, find the signed BAA. Not the proposal, not the invoice. The signed agreement.
- Put the signed copies in one place, digital or paper, that you could hand to an auditor without hunting.
- For anything missing, email that vendor today and ask for one. Most will send it back the same week.
- Note the date you checked. Being able to show when you last reviewed this is itself evidence of diligence.
What to Do If Your IT Provider Will Not Sign One
Occasionally a practice discovers their IT company is unwilling to sign, or wants to sign something heavily watered down. Take that seriously.
An IT provider who will not sign a BAA is telling you one of two things. Either they do not understand that they are a business associate, which is a competence problem, or they do understand and do not want the obligations, which is a different problem. Neither is a good fit for a practice handling client records.
We sign a Business Associate Agreement with every covered entity client, and we do it during onboarding rather than after something goes wrong.
About Big U Computers
Big U Computers is a family owned IT provider in Macungie, Pennsylvania, serving practices and small businesses from Allentown and Bethlehem through Danville, Bloomsburg, and Lewisburg.
- We sign a Business Associate Agreement with every covered entity client
- Ten years supporting behavioral health IT in Pennsylvania
- Implemented and currently maintains a Credible records platform environment
- We work to HIPAA and NIST frameworks and are knowledgeable on PCI
- One hour response target and four hour restoration target for mission critical issues, written into our service agreement
- After hours coverage to midnight on business days, plus weekends and holidays
- Full written documentation of your network, licenses, and passwords, in plain English
Not sure whether your vendor agreements hold up? Call 570.340.0800 or book a free consult. We will walk your vendor list with you and tell you what is missing, no charge.
This article is general information and not legal advice. Consult your own counsel before signing any agreement.
Big U Computers | P.O. Box 523, Macungie, PA 18062 | 570.340.0800 | bigucomputers.com
