What Is a Business Associate Agreement (BAA)? A Plain-English Guide for Health App Founders
You're deep in building your health app. Maybe you're a solo founder, maybe you've got a small team. Either way, someone on a call (an advisor, a potential client, a compliance consultant) casually drops: "You'll need a BAA for that." You nod. You write it down. And then you quietly Google it later.
So, what is a business associate agreement, and why does everyone in healthcare seem to assume you already know?
If that moment sounds familiar, this guide is for you. We wrote it for health app founders, indie developers, and early-stage digital health startups who keep bumping into the term "BAA" and want a clear, honest explanation of what it actually means, when it's required, and what happens if you skip it.
No legalese. No 40-page compliance framework. Just the clearest explanation of HIPAA's most misunderstood contract, written by people who've helped founders ship compliant healthcare products.
A quick note before we dive in: this article is for informational purposes only and does not constitute legal advice. HIPAA is nuanced, and your specific situation may differ from the general guidance here. Please consult a qualified HIPAA attorney for decisions that affect your product or business.
Let's start with the basics.
What is a business associate agreement?
A BAA is a HIPAA-required contract between a healthcare organization and any vendor that handles protected health information (PHI) on its behalf. It defines what the vendor can do with the data, requires specific security safeguards, and establishes breach notification obligations. If your health app touches PHI for a hospital, clinic, or health plan, you need a BAA before any data flows.
Key Takeaways
- A BAA is mandatory, not optional. If your health app handles PHI on behalf of a covered entity, HIPAA requires a signed business associate agreement before any data changes hands. Operating without one is a violation even if no breach occurs.
- Your BAA obligations extend to every vendor in your stack. Cloud hosting, messaging APIs, analytics tools, AI providers: if they touch PHI, they need a BAA with you. Miss one link in the chain and you have a compliance gap.
- Read what you sign. Not all BAAs protect you equally. Watch for overly broad data use permissions, missing breach notification timelines, and absent subcontractor obligations. A BAA is only as good as the terms in it.
What Is a Business Associate Agreement?
A business associate agreement HIPAA requires is, at its core, a contract. It sits between two parties: a covered entity (think hospitals, clinics, health insurers) and any outside vendor that handles protected health information (PHI) on their behalf.
That's the short version. Here's what it actually means in practice.
When a hospital sends patient billing data to a claims processing company, that company now has access to sensitive health information. HIPAA says the hospital can't just hand that data over on a handshake. There needs to be a written agreement that spells out three things:
- What the vendor is allowed to do with the data.
A billing company can use PHI for billing. It can't use it to train an AI model or sell it to a marketing platform. The BAA draws those boundaries explicitly.
- How the vendor will protect the data.
The agreement requires the vendor to implement safeguards (administrative, physical, and technical) that meet HIPAA Security Rule standards. This isn't a vague promise. It's a contractual obligation.
- What happens if something goes wrong.
If there's a data breach, the vendor must notify the covered entity. The BAA defines the timeline and process for that notification, so nobody is guessing during a crisis.
Think of a BAA as the written rules of engagement for anyone who touches patient data on behalf of a healthcare organization. Without it, the relationship isn't just risky. Under HIPAA, it's a violation.
Who Is a "Covered Entity" vs. a "Business Associate"?
These two terms come up constantly in HIPAA conversations, and mixing them up can lead to real confusion about your obligations. Let's make them concrete.
A covered entity is an organization that provides or pays for healthcare and transmits health information electronically. In practice, that means healthcare providers (hospitals, clinics, physicians, pharmacies), health plans (health insurance companies, HMOs, Medicare, Medicaid), and healthcare clearinghouses. If your app is a direct care platform, you may actually be a covered entity yourself. But most health app founders fall into the next bucket.
HIPAA Business Associate
A HIPAA business associate is any person or organization that performs a function or service on behalf of a covered entity, where that function involves creating, receiving, storing, or transmitting PHI. The business associate definition under HIPAA is broad. Some examples relevant to founders:
- A cloud hosting provider storing patient records for a hospital system.
- An analytics platform processing health data for a clinic.
- A SaaS tool that a health plan uses to manage member communications (SaaS HIPAA requirements are the same as any other business associate).
- Your health app, if a clinic or insurer uses it to collect or display patient data.
If you're building an app that a covered entity will use, and your app touches PHI in any way, you are almost certainly a business associate.
The Subcontractor Chain
If you're a business associate and you hire another vendor who will also access PHI (your cloud provider, your email service, your AI/LLM provider), that vendor is your subcontractor under HIPAA. You need a BAA with them, too.
A concrete example: a regional clinic (covered entity) contracts with your patient intake app (business associate). Your app runs on AWS and uses Twilio to send appointment confirmations that contain patient names and visit times. You need a BAA with the clinic, and you separately need BAAs with both AWS and Twilio, because both handle PHI on your behalf.
Miss one link in the chain, and the whole chain has a compliance gap. This is especially relevant for founders who build quickly with AI-assisted tools and integrate vibe coding healthcare app PHI risks by adding third-party services without realizing each one may need its own BAA.
Does Your Health App Need a BAA?
This is the question that keeps founders up at night, and the honest answer is: it depends on what your app does, who it serves, and what kind of data flows through it.
The core test is simple. If your app creates, receives, stores, or transmits protected health information on behalf of a covered entity, you need a business associate agreement health app founders sometimes think they can skip. You can't. Healthcare app compliance starts with this question. And as we'll see, digital health compliance only gets more complex from here.
Remember, PHI is broader than diagnoses and lab results: any individually identifiable health information tied to a health condition, treatment, or payment qualifies. A patient's name paired with an appointment date is PHI. A phone number linked to a prescription refill reminder is PHI.
You Almost Certainly Need a BAA if
- A hospital, clinic, or health plan will use your app to interact with patients or manage their data.
- Your app integrates with an EHR or pulls data from a clinical system.
- You store or process any data that links a person's identity to their health status, treatment, or payment history.
- A covered entity has asked you to sign one (this alone is a strong signal).
You Might Not Need a BAA if
- Your app is a general wellness tool (meditation timer, step counter, calorie tracker) that doesn't receive data from a covered entity and doesn't link health data to identifiable individuals.
- You only handle de-identified data that meets HIPAA's Safe Harbor or Expert Determination standard. Truly de-identified data is not PHI.
- Your users are consumers who input their own data voluntarily, with no covered entity in the picture.
The Grey Areas That Trip Founders Up
Fitness apps that partner with employers offering wellness programs. If that employer's health plan is involved and identifiable health data is shared, you may be in BAA territory.
Mental health apps where therapists (covered entities) use the platform to communicate with patients. Even if the app markets itself as a consumer product, the therapist's use can trigger business associate obligations.
The safest mental model: if there's a covered entity anywhere in your data flow, and identifiable health information passes through your system, assume you need a BAA until a HIPAA attorney tells you otherwise.
What Must a BAA Include? (HIPAA Requirements)
The regulation at 45 CFR §164.504(e), part of the HIPAA Privacy Rule, spells out what must be in every business associate agreement. Here's what HIPAA BAA requirements look like in plain English.
Permitted and Required Uses of PHI
The BAA must state exactly what the permitted uses of PHI are for the business associate, and what it's required to do. A billing vendor can use PHI for claims processing. A cloud host can store PHI. But neither should be using that data for purposes outside the scope of the agreement. Anything not explicitly permitted is off-limits.
Restrictions on Further Disclosure
The business associate cannot share PHI beyond what the contract allows or what the law requires. Any PHI disclosure outside these boundaries is a violation. If your app receives patient data from a clinic, you can't pass it to a third-party analytics tool unless your BAA permits it and you have a subcontractor BAA in place with that tool.
Safeguards
The business associate must implement appropriate administrative, physical, and technical safeguards to prevent unauthorized use or disclosure of PHI. This aligns directly with the HIPAA Security Rule. In practice, it means encryption at rest and in transit, role-based access controls, and audit logging. The BAA makes these obligations contractual, not just regulatory.
Breach Reporting
If the business associate discovers any unauthorized use or disclosure of PHI, it must report it to the covered entity. This includes breaches of unsecured PHI, which trigger specific data breach notification timelines under the HIPAA Breach Notification Rule. A well-written BAA will specify a concrete window like 30 or 60 days.
Subcontractor Obligations
If the business associate uses subcontractors who will access PHI, the BAA must require that those subcontractors agree to the same restrictions and conditions. This is the "flow-down" provision that creates the chain of agreements we discussed earlier.
Additional Required Provisions
The BAA must also guarantee that the business associate will support patients' rights to access and amend their records, provide an accounting of disclosures, make records available to HHS for compliance audits, return or destroy all PHI when the contract ends, and allow the covered entity to terminate the agreement if the business associate violates a material term.
Beyond these HIPAA-mandated elements, many BAAs include provisions for indemnification, insurance requirements, and specific technical controls. If you're a founder working with a healthcare app development company or building on a platform that provides its own BAA, read through the actual agreement rather than assuming it covers everything.
Who Do You Need a BAA With?
If a vendor creates, receives, stores, or transmits PHI on your behalf, you need a business associate agreement healthcare regulations require before any data changes hands. For most health app founders, the healthcare software vendor list is longer than expected.
Cloud Hosting and Infrastructure
If your app stores PHI, your cloud service provider HIPAA obligations make them a business associate. AWS, Google Cloud, and Azure each offer BAAs, but only for specific HIPAA-eligible services within each platform. The BAA is available; correct configuration is your responsibility.
Messaging and Communication APIs
If your app sends appointment reminders, prescription alerts, or any notification that contains PHI, the messaging provider needs a BAA. Twilio offers one, as does SendGrid (owned by Twilio). Many popular tools in this space don't. Always check before you integrate.
Other Services That Commonly Touch PHI
Payment processors: if your payment flow links payment data to identifiable health information, the processor may be handling PHI. Stripe does not offer a BAA, but can be used under HIPAA's payment processing exemption as long as no PHI enters Stripe. If your payment workflow involves PHI, you'll need a Stripe HIPAA alternative like Rectangle Health or InstaMed that will sign a BAA.
Analytics platforms: standard tools (Google Analytics, Mixpanel, Amplitude) are generally not designed for PHI and most don't offer BAAs. If your app handles PHI, you need analytics tools that either sign BAAs or are configured to never receive identifiable health data.
CRM and support tools: if support agents can see patient names, conditions, or treatment details in your helpdesk, that tool is handling PHI. Some platforms (like Zendesk) offer BAAs at certain plan tiers. Many don't.
AI and LLM Providers
This is the newest and most unsettled category. If you're passing PHI through an AI model for summarization, triage, or any clinical function, the AI provider is a business associate. OpenAI offers a BAA for its API customers at certain tiers. But many AI tools don't.
If you're building with AI-assisted development tools, the compliance question extends to your dev environment too:
The answers affect your compliance posture during development, not just in production.
Vendor HIPAA policies change, and “BAA available” rarely means “safe by default.” The table below reflects publicly stated vendor posture as of March 31, 2026, but you should verify the exact product, plan tier, and data flow before treating any service as PHI-ready.
A Vendor BAA Availability Snapshot
This table is a starting point, not legal advice. Vendor policies change, and BAA availability sometimes depends on your plan tier or usage. Always confirm directly with the vendor before making compliance decisions.
What Happens If You Don't Have a BAA?
Skipping a BAA isn't a grey area. Under HIPAA, sharing PHI with a vendor without a signed BAA HIPAA requires is itself a violation, even if no breach ever occurs.
Financial Penalties
OCR enforces HIPAA through a four-tier penalty system based on culpability. As of January 2026, a single HIPAA fine can range from $145 per violation (Tier 1, no knowledge) up to $2,190,294 per violation (Tier 4, willful neglect not corrected). OCR also applies enforcement discretion annual caps: $25,000 for Tier 1, $100,000 for Tier 2, $250,000 for Tier 3, and $1,500,000 for Tier 4. Multiple violation types can stack, so total exposure in a single investigation can reach several million dollars.
These penalties apply to both covered entities that fail to obtain BAAs and business associates that violate HIPAA directly. The HITECH Act made business associates independently liable.
Enforcement Is Increasing
OCR closed 22 enforcement actions in 2024 and matched that pace through 2025, with a particular focus on Security Rule failures and risk analysis gaps. Missing BAAs are exactly the kind of finding that surfaces during these investigations.
Beyond Fines
A missing BAA can trigger contract termination by healthcare clients who discover the gap during their own audits. It can disqualify you from enterprise deals where procurement teams require proof of BAA coverage across your vendor stack. And if a breach occurs without a BAA in place, the reputational damage compounds. For a startup, any one of these outcomes can be existential.
How to Get a BAA: Step by Step
Getting BAAs in place isn't complicated, but it does require a systematic approach. Here's a practical BAA checklist any health app founder can follow.
1. Map Your Vendors to Your Data Flow
List every service that touches PHI in your stack. Cloud hosting, databases, messaging APIs, email, analytics, support tools, payment processors, AI providers. Match each PHI touchpoint to the vendor behind it.
2. Check BAA Availability for Each Vendor
Visit each vendor's compliance or legal page. Many (AWS, GCP, Azure, Twilio, Stripe) have self-serve BAAs you can accept online. Others require you to contact sales or upgrade to a specific plan tier. Some simply don't offer one, which means you need a business associate agreement template conversation with them or, more likely, a different vendor.
3. Review Before You Sign
Not all BAAs are equal. Read the key provisions: what uses of PHI are permitted, what's the breach notification timeline, are subcontractor obligations included, and what happens to your data at termination. If you're working with a HIPAA attorney, this is where their review is most valuable. If you're using a template (HHS publishes sample BAA provisions on its website), customize it to reflect the actual relationship.
4. Execute and Store
Sign the BAA before any PHI changes hands. This isn't a formality you can backfill. Store signed copies in a central, retrievable location. If OCR investigates or a client audits you, you need to produce these quickly.
5. Build a BAA Inventory
Maintain a simple tracker: vendor name, BAA execution date, renewal or review date, and which PHI data types are covered. This becomes your custom healthcare software development compliance baseline. Review it whenever you add a vendor, renew a contract, or change how data flows through your system.
BAA Red Flags: What to Watch Out For
Not every BAA protects you equally. When reviewing a BAA, here's what is a BAA red flag versus a reasonable provision.
Overly Broad Permitted Uses
If the BAA gives the vendor permission to use PHI for "any lawful purpose" or "product improvement," that's a problem. Permitted uses should be specific and tied to the service being provided. Watch especially for language that allows the vendor to use PHI for model training, research, or marketing.
No Breach Notification Timeline
HIPAA says "without unreasonable delay," but a good BAA puts a number on it. If the agreement is silent on timeline, or allows 90+ days, push back. Industry standard is 30 to 60 days.
No Subcontractor BAA Requirement
If the vendor uses subcontractors and the BAA doesn't require them to flow down the same obligations, your data is one hop away from being unprotected. This provision is required by HIPAA, but some BAAs are vague about it.
Vendor's Right to Retain Data After Termination
The BAA should require the vendor to return or destroy PHI when the relationship ends. If the agreement lets them retain data indefinitely, or doesn't address termination at all, that's a significant gap.
Auto-Renewal Without Review
BAAs that auto-renew become a risk if your vendor's practices or your data flow have changed since the original signing. Build a review trigger into your BAA inventory so renewals prompt a fresh look at terms.
No Indemnification
HIPAA doesn't require indemnification in a BAA, but from a business perspective, you want clarity on who bears financial responsibility if the vendor's failure causes a breach. If the BAA is silent on this, negotiate it in.
The broader principle: if a BAA reads like it was written to protect the vendor rather than the data, that's worth a conversation before you sign.
How Specode Handles the BAA for You
Instead of stitching together your own HIPAA compliant infrastructure and negotiating BAAs vendor by vendor, you can approach health app development on a platform where the compliance layer is already in place.
Backend Hosting BAA Included
On Specode's Pro plan, the business associate agreement health app founders typically need for their backend hosting is included out of the box. Specode uses Convex for secure backend data storage, and the hosting BAA is covered as part of your production deployment. No extra paperwork, no waiting on a vendor's legal team. A separate Specode BAA is not required, but it is available for founders on a custom tier.
Your Responsibility: Third-Party Integrations
Specode handles the backend, but if your app integrates with external services (telehealth video, messaging APIs, eRx platforms, analytics), those vendors may require their own BAAs. Specode's team actively guides founders through this. For example, if a service you've integrated doesn't offer a BAA, the team will flag it and recommend an alternative that does.
Security Review Before You Go Live
Before any app goes to production, Specode's team reviews it to verify the deployment is secure and HIPAA compliant. This isn't a self-serve checkbox. It's a human review, typically completed within one to two business days.
For founders who want additional assurance, Specode offers an optional in-house penetration test for $3,000, a fraction of the $10,000 to $15,000 that independent pen tests typically cost.
Coming Soon: HIPAA Compliance Scanning
Specode is also building a HIPAA Agent into its Security Center: a static analysis tool that scans your AI-generated app code for HIPAA compliance gaps. Think of it as a HIPAA-specific linter that flags potential issues (data handling, authentication, infrastructure configuration) and surfaces actionable findings so you can fix them before launch.
When you build on a platform like Specode, the BAA isn't an afterthought you scramble to get before your first healthcare client signs. It's part of the infrastructure from day one. If you're exploring telehealth app development, this is especially relevant: telehealth apps handle PHI by definition, and having the BAA and hosting layer pre-configured can shave weeks off your go-live timeline.
The Bottom Line for Health App Founders
If you're building an app that touches patient data, the BAA question isn't optional. It's foundational.
Here's what to take away: know whether you're a business associate, map every vendor that handles PHI, get signed BAAs in place before any data flows, and read what you're signing. The penalties for skipping this are steep, but more importantly, a solid BAA chain is how you earn trust from healthcare clients who've seen what happens when vendors cut corners.
Still wondering, “Do I need a BAA for my health app?” If a covered entity is anywhere in your data flow and identifiable health information passes through your system, the answer is almost certainly yes. When in doubt, ask a HIPAA attorney. It's cheaper than finding out the hard way.
This article is for informational purposes only and does not constitute legal advice. Consult a qualified HIPAA attorney for guidance specific to your product and business.
Frequently asked questions
A BAA is a contract between a healthcare organization (a covered entity) and any vendor that handles protected health information on their behalf. It spells out what the vendor can and can't do with the data, what safeguards they must have in place, and what happens if there's a breach. It's required by HIPAA before any PHI changes hands.
If your app creates, receives, stores, or transmits PHI on behalf of a covered entity, yes. If your app is a standalone wellness tool that never receives data from a healthcare provider, insurer, or health plan, you may not need one. The grey areas are real, so when in doubt, consult a HIPAA attorney.
It's a HIPAA violation even if no breach occurs. Penalties range from $145 to over $2.1 million per violation depending on culpability, and OCR enforcement is increasing. Beyond fines, a missing BAA can cost you healthcare contracts and client trust.
Any person or organization that performs a function involving the use or disclosure of PHI on behalf of a covered entity. Common examples: cloud hosting providers, billing companies, analytics platforms, messaging APIs, AI tools that process patient data, and EHR vendors. If a subcontractor also accesses PHI, they count too.
Yes, if you're storing or processing PHI on their infrastructure. All three offer self-serve BAAs, but the BAA only covers their HIPAA-eligible services. Proper configuration is your responsibility. A signed HIPAA vendor agreement with your cloud provider is necessary but not sufficient on its own.
You can start with a template. HHS publishes sample BAA provisions on its website, and many vendors provide their own standard agreements. For straightforward vendor relationships, a template may be enough. For complex or high-stakes arrangements, a HIPAA attorney's review is worth the investment. The template gets you 80% of the way; legal counsel closes the gap for regulatory compliance.
Check the vendor's compliance, security, or legal page. Many publish their BAA availability openly. If you can't find it, ask their sales or support team directly. If they can't give you a clear answer, that's a red flag. Healthcare startups should treat "we'll get back to you on the BAA" as a sign to evaluate alternatives.
Yes. On the Pro plan, the backend hosting BAA is included for production deployments. Specode handles the Convex (backend infrastructure) BAA so you don't need to negotiate it separately. If your app integrates third-party services that touch PHI, Specode's team will guide you on which vendors require their own BAAs. An optional penetration test is also available for $3,000 for founders who need additional security validation.
