Does This Vendor Need a BAA?
Pick a common vendor type below, or answer 2 quick questions for anything else. Instant answer, free, no signup.
What kind of vendor are you checking?
Frequently Asked Questions
What makes a vendor a 'Business Associate' under HIPAA?
A vendor is a Business Associate if they create, receive, maintain, or transmit Protected Health Information (PHI) on behalf of your dental practice. This covers software vendors, billing companies, IT providers, cloud storage, labs that receive digital records, and more — even if they only have remote access to systems containing patient data.
Does every vendor who enters my office need a BAA?
No. Only vendors who actually create, receive, maintain, or transmit PHI need a BAA. A janitorial service that empties trash cans generally doesn't need one. A janitorial service with unsupervised access to unlocked patient files might. The test is PHI access, not physical presence.
What is the 'conduit exception' to the BAA requirement?
HHS carves out an exception for entities that only act as a conduit for PHI — transporting it without accessing or storing it, like a mail carrier or internet service provider passing along encrypted data. If a vendor could plausibly access or retain the data, the conduit exception usually doesn't apply, and a BAA is the safer choice.
What happens if I don't have a BAA with a vendor who needs one?
Operating without a required BAA is one of the most commonly cited findings in dental HIPAA audits. It's treated as a HIPAA violation on its own, separate from whether any PHI was actually mishandled — fines start well above $100 per violation and scale from there depending on culpability.
Need the actual agreement, not just the answer?
The Vendor BAA Compliance & Tracking Pack includes a signed BAA template, a full vendor reference table, and a tracking log — $29, instant delivery.
Get the BAA Pack — $29 →