Why Your Cloud Vendors Need a BAA (and Probably Don’t Have One)

A typical dental practice works with somewhere between eight and fifteen vendors that touch patient data in some way — scheduling software, imaging systems, cloud backup, a billing company, an answering service, maybe a text-reminder tool someone signed up for last year. Some groups have twenty or more once you count every location.

Every one of those vendors is supposed to have a signed Business Associate Agreement on file. In practice, most dental groups are missing several — and missing BAAs are consistently the most commonly cited violation in OCR’s dental HIPAA enforcement actions.

What Actually Makes a Vendor a “Business Associate”

The test isn’t what a vendor calls itself or what their sales page says. Under HIPAA, a business associate is any person or organization — other than someone on your own payroll — that creates, receives, maintains, or transmits protected health information (PHI) on your behalf.

That definition covers more than most practices assume:

• Practice management and EHR software, including anything cloud-hosted
• Digital imaging and radiography platforms
• Cloud storage, backup, and archiving providers
• Billing and claims-processing companies
• IT support and managed service providers
• Outsourced answering services and appointment-reminder tools
• Even a cloud provider that only stores encrypted PHI and never holds the decryption key — they’re still a business associate under HHS guidance

If a vendor is acting on your behalf and touches PHI beyond incidental exposure, it needs a BAA. It doesn’t matter whether they can actually read the data.

Why OCR Doesn’t Wait for a Breach

The case every compliance officer should know is Raleigh Orthopaedic Clinic. OCR fined the practice $750,000 for handing PHI to a vendor without a signed BAA in place — and the settlement wasn’t triggered by a data breach. The missing agreement was the violation, full stop.

That’s the pattern across dental enforcement more broadly: missing or outdated BAAs and a missing annual Security Risk Analysis account for the majority of dental HIPAA citations, and neither requires an actual incident to become a six-figure problem. Operating without a signed BAA breaks 45 CFR §164.308(b)(1) the moment PHI starts flowing, regardless of what happens afterward.

Where Multi-Location Groups Actually Lose Track

A single office can usually name its vendors from memory. That stops being true once you’re coordinating compliance across several locations, especially ones that joined the group through an acquisition.

The gaps tend to show up in predictable places: a BAA signed with the imaging vendor at headquarters that was never extended to a satellite office using the same platform under a separate account. A scheduling tool one location adopted on its own, outside of any centralized vendor review. An answering service or text-reminder app a front-desk manager signed up for because it solved a problem that week. None of these show up on anyone’s radar until an audit asks for the list.

What a Proper BAA Actually Needs to Cover

A signed document alone isn’t enough if it’s missing the required elements. A defensible BAA needs to spell out:

• Permitted uses and disclosures of PHI
• The safeguards the vendor commits to — administrative, physical, and technical, matching the same standard covered entities are held to
• Breach notification procedures and timelines
• Requirements for the vendor to sign its own BAAs with any subcontractors that touch PHI, and to notify you when a new one is engaged
• PHI access, amendment, and accounting-of-disclosures rights
• HHS access provisions for audits
• What happens to PHI when the relationship ends — return or destruction
• Termination rights if the vendor materially breaches the agreement

The subcontractor provision is worth double-checking on older agreements. If your vendor’s own vendor touches your data, that chain needs to be covered too.

Fixing This Doesn’t Require a Legal Overhaul

Most of this is a documentation and tracking problem, not a legal one. The fix is a vendor inventory: every system, tool, and service across every location that could touch PHI, whether a BAA exists for it, and when it was last reviewed. For a single office, a spreadsheet can limp along. For a group managing this across multiple locations and an ever-changing vendor list, it stops being something anyone can track reliably by memory or email thread.

Effex’s Document Control module keeps every vendor agreement, BAA, and renewal date in one place across every location, so “do we have a BAA for that” has an answer you can pull up in seconds instead of a scramble the week before an audit.

This article is for informational purposes and isn’t legal advice. Talk to your healthcare attorney or compliance counsel about your organization’s specific vendor relationships and agreements.