QUESTIONS / VENDROS AND PRIVACY
Can I sign this BAA?
Your new EHR, billing company, answering service or AI scribe sends a business associate agreement with the contract. It's tempting to sign and move on.
WHAT YOU’RE ASKING
Is this vendor's paperwork safe to sign, and does it actually protect my practice?
WHY IT MATTERS?
HIPAA requires a business associate agreement with any vendor that creates, receives, keeps or transmits patient information for you. Vendor forms are written to protect the vendor. If the vendor has a breach, your practice still has notification duties to patients and to HHS.
New AI tools raise extra questions: whether patient data trains the vendor's models, where the data is stored, and who can see it.
WHAT WE REVIEW
How the vendor may use and disclose your patients' information
Breach notice timing and who pays for notification
Subcontractors and offshore data handling
Indemnity and limits on the vendor's liability
Return or destruction of data when the contract ends
How the BAA fits the underlying services agreement
WHAT YOU LEAVE WITH
A marked-up agreement with the changes to request, a short explanation of each, and a sense of which points are worth holding firm on.
Free 30-minute consultation
Speak directly with a healthcare attorney Reza Ghafoorian, MD, JD. No charge and no obligation.