A BAA (Business Associate Agreement) is a contract in which a vendor promises to protect your patients' information the way HIPAA requires. Your team chat app stores messages about patients, which makes it a business associate, so it needs a BAA before anyone sends the first message. No BAA means the app is off limits for patient information, however secure it looks.
The one-paragraph definition
HIPAA applies directly to covered entities: practices, clinics, pharmacies, health plans and other organizations that handle patient care or billing. It also reaches the companies those organizations hire. A business associate is any vendor that creates, receives, stores or sends protected health information (PHI), meaning any information that identifies a patient and relates to their health or care, on a covered entity's behalf. A Business Associate Agreement (BAA) is the contract that makes the vendor responsible for protecting that PHI. HIPAA requires it before the vendor handles PHI (45 CFR 164.502(e) and 164.308(b)).
In plain terms: the BAA is how the law follows your patients' information out the door and into the vendor's systems.
Why a chat app counts as a business associate
People sometimes argue that a chat app is just a pipe, so it does not need a BAA. That argument fails the moment a message is stored. A staff message saying a named patient needs a callback about her biopsy is PHI. The app stores it on its servers, indexes it for search, backs it up and shows it on several devices. That is creating, receiving and storing PHI, which is the definition of a business associate.
It does not matter that the app was built for general teams, that staff use it on their own phones, or that most messages are about lunch orders. If PHI can land there, the vendor needs to be under a BAA.
What a BAA must cover
The HIPAA rules spell out what the agreement has to say. Read for these points:
| Clause | What it means for you |
|---|---|
| Permitted uses | The vendor may use PHI only to run the service for you, nothing else |
| Safeguards | The vendor must protect PHI with the Security Rule's safeguards |
| Incident reporting | The vendor must tell you about security incidents and breaches |
| Subcontractors | Any company the vendor relies on (hosting, email) must be bound by the same terms |
| Access and amendment | The vendor helps you give patients access to their PHI when the rules require it |
| Termination | What happens to your PHI when you cancel: return, deletion or both |
A BAA that skips the subcontractor clause or the termination clause is incomplete. Those are the two sections small practices most often find missing.
What a BAA does not do
A signed BAA does not make your practice compliant. It makes the vendor accountable. You still have to set up the tool properly, control who is in it, train staff and keep your own policies. A BAA also does not cover plans or products it does not name. Some well-known tools sign a BAA only on their enterprise plans, and a team on a cheaper plan is not covered even though the app looks the same. Read the plan name on the agreement.
Seven questions to ask a vendor before you sign
- Is the BAA included on the exact plan I am buying, and can you send it before I pay?
- Who are your subprocessors, and do you hold BAAs with each of them?
- Is data encrypted in transit and at rest?
- How do I remove a user, and how fast does their access end?
- Is there an audit log, and can I export it?
- Can I set a retention period and place a legal hold?
- What happens to our data within 30 days of cancellation?
A vendor built for healthcare answers all seven in one email. If the answers come back vague, or the BAA has to go through a sales team first, that tells you something about how the vendor sees small practices.
Where the BAA usually sits in the price list
Across team chat tools, the BAA is usually treated as a premium feature. It sits on a higher tier, needs a minimum seat count, or requires a sales conversation. For a five-person office that often means paying for features the team will never use just to get the one document it needs. Our comparison pages show where each vendor puts its BAA.
Yodl takes the opposite approach: the BAA is included on every plan, including the $10 per month plan, with self-serve checkout and no sales call. The HIPAA details are at yodl.cc/hipaa so you can read them before paying.
What to do once it is signed
- Save the signed PDF in the folder with your other HIPAA documents. HIPAA expects you to keep it as part of your compliance records.
- Add the vendor to your business associate list, with the date signed and the plan name.
- Set up the tool the way the BAA assumes: invite-only, roles, retention, audit log turned on.
- Put the tool's name in your internal communication policy as the approved channel for PHI.
- Diary a yearly check that the vendor, the plan and the agreement are still current.
That is the whole job. A BAA is less mysterious than it sounds: it is a vendor saying, in writing, that your patients' information is their responsibility too. If you want one included from day one, Yodl is $10 a month for 5 people with a signed BAA, on the pricing page.
A BAA makes your chat vendor legally responsible for protecting patient information. Get it on the plan you actually buy, check the subcontractor and termination clauses, file it with your HIPAA records, and then configure the tool to match.
Frequently asked questions
Does the BAA need to be signed before we start using the app?
Yes. HIPAA requires the agreement to be in place before the vendor handles PHI. Signing it later does not cover the messages sent before that date.
Can we write our own BAA and ask the vendor to sign it?
You can ask. Most software vendors use their own standard BAA and will not edit it for a small account. Enterprise plans sometimes allow custom terms.
Is an app with end-to-end encryption exempt from needing a BAA?
No. Encryption is one safeguard, not a substitute for the agreement. If the vendor stores or transmits PHI for you, it is a business associate regardless of its encryption.
Does a BAA cover the AI features inside a chat app?
Only if the agreement says so. Ask whether AI features are covered and whether your messages are used to train models. Yodl's optional AI teammate is a separate PhiClaw product, and Yodl never trains AI on customer messages.
What if a vendor says it is HIPAA compliant but will not sign a BAA?
Treat the app as not usable for PHI. The claim without the agreement gives you nothing in writing, and the rules require the agreement.