What Is a Business Associate Agreement? HIPAA BAA Rules for Texas Practices

By Doris Dike, Attorney

A business associate agreement is the HIPAA contract a practice must sign before a vendor can create, receive, keep or send patient information on its behalf. It limits how the vendor may use that information, requires safeguards and breach reporting, and binds the vendor’s subcontractors. Without one, the practice is out of compliance.

Who Counts as a Business Associate?

If you are asking what is a business associate agreement for, start with who needs one. Under HIPAA, a business associate is any person or company outside your workforce that handles protected health information to perform a service for your practice. Common examples in Texas practices include:

• Billing and coding companies
• EHR, practice management and patient portal vendors
• Cloud storage, email, IT support and cybersecurity firms
• Answering services, scheduling platforms and AI scribe tools
• Marketing agencies that work with patient lists or reviews
• Consultants, accountants and attorneys who see patient records
• Management services organizations that run the business side of a practice

The last one surprises many owners. In a Texas MSO structure, the management company almost always handles patient information, so the practice and the MSO need a HIPAA business associate agreement alongside the management services agreement. Our guide to the friendly-PC and MSO model explains how the two entities fit together.

Who Does Not Need a BAA

Not every outside party is a business associate. A BAA is generally not needed for:

• Other providers receiving information for treatment, such as a referral to a specialist
• Your own employees and other workforce members, who are covered by your policies and training instead
• Pure conduits that only transmit data and do not store it, such as the postal service
• Payers receiving claims for payment

The test is the service, not the label. A cleaning company that might glimpse a chart does not need one; a shredding company that handles boxes of records does.

What a BAA Contract Must Include

HIPAA sets the minimum terms of every BAA contract. The agreement must:

1. Describe the permitted uses and disclosures of protected health information
2. Prohibit any other use or disclosure, except as required by law
3. Require reasonable safeguards, including Security Rule safeguards for electronic information
4. Require the vendor to report breaches, security incidents and improper disclosures to the practice
5. Require the same restrictions to flow down to any subcontractors
6. Support patients’ rights to access, amend and get an accounting of their information
7. Make the vendor’s books and records available to HHS when asked
8. Require return or destruction of the information when the relationship ends
9. Allow the practice to terminate the contract if the vendor materially breaches it

HHS publishes sample BAA provisions, and many practices start from a business associate agreement template. A template covers the federal minimum, but it rarely addresses Texas law, breach timing, cyber insurance or who pays for a breach response.

Terms Worth Negotiating Beyond the Minimum

• Breach reporting deadline: shorter than the federal outer limit, so you can meet your own notice duties
• Cost allocation: who pays for notices, credit monitoring and forensic work if the vendor caused the breach
• Indemnification and insurance: whether the vendor carries cyber coverage and names the practice
• Offshore access: whether information can be stored or viewed outside the United States
• AI and de-identified data: whether the vendor may use your data to train tools or build products
• Audit rights: whether you can confirm the vendor’s safeguards

Texas Rules That Sit on Top of HIPAA

Texas has its own medical privacy law, the Texas Medical Records Privacy Act, expanded by House Bill 300. It defines covered entities more broadly than HIPAA, reaching many businesses that assemble, store or use health information, and it requires staff training on state privacy rules. Texas also has its own breach notice law, which can require notice to the Texas Attorney General.

So a vendor that is not a HIPAA business associate may still have duties under Texas law, and your BAA should require the vendor to follow both. Our HIPAA compliance checklist for Texas practices covers the wider program.

What Happens If You Do Not Have a BAA

Missing BAAs are one of the most common findings in HHS Office for Civil Rights investigations. If a vendor without a BAA suffers a breach, the practice faces questions about why patient data was shared at all, and both the practice and the vendor can face penalties. Since the 2013 HIPAA changes, business associates are directly liable for their own compliance, but that does not take the obligation off the practice.

The fix is simple: list every vendor that touches patient data, confirm a signed BAA exists for each, and calendar renewals. Our article on common HIPAA violations shows where else practices slip.

Quick Reference

1. Does the vendor handle patient information for you? It needs a BAA.
2. Is it another provider treating the patient? No BAA needed.
3. Is your MSO handling patient data? Sign a BAA with it.
4. Does the template cover Texas law and breach costs? Usually not.
5. Do subcontractors sign too? Yes, the terms must flow down.

Frequently Asked Questions

What is a BAA in healthcare?

A BAA, or business associate agreement, is the contract HIPAA requires between a healthcare provider and a vendor that handles patient information on its behalf. It sets the rules for using, protecting and reporting problems with that information.

Does my billing company need to sign a BAA?

Yes. A billing company handles protected health information to perform a service for your practice, so it is a business associate and needs a signed BAA before it receives any patient data.

Is a business associate agreement template enough?

A template covers HIPAA’s minimum terms, but it often misses Texas privacy law, breach cost allocation, insurance and AI data use. Have the template reviewed for your vendors before relying on it.

Who is responsible if my vendor has a breach?

Both of you can be. The vendor is directly liable for its own HIPAA failures, and the practice must still give required notices to patients and regulators. A well-drafted BAA decides who pays for the response.

How often should BAAs be reviewed?

Review them when you add or change vendors, when the vendor’s services change, and at least once a year as part of your HIPAA risk assessment.

This article is general information about Texas healthcare law and is not legal advice. Reading it does not create an attorney-client relationship with Dike Law Group PLLC.