Clinical AI BAA In-House vs Through EHR Vendor: Cost Compared
Five Nines Executive Team : Sep 8, 2026, 8:44:59 AM
2 min read
Healthcare AI vendor BAAs can be negotiated directly between the hospital and the AI vendor or can flow through the EHR vendor as a subcontractor relationship. Each approach has cost, control, and risk implications.
Direct BAAs produce stronger hospital control but require more BAA management overhead. EHR-flowed BAAs reduce hospital management burden but introduce dependency on the EHR vendor's BAA discipline.
The CFO question is not which approach is structurally superior. Both produce HIPAA compliance when operated well. The question is which approach matches the hospital's vendor management capability and AI footprint complexity.
Direct vs. EHR-Flowed AI Vendor BAAs — What Each Architecture Produces
A healthcare CFO managing AI vendor BAAs faces an architectural choice as AI footprint grows. Direct relationships with each AI vendor or flowing AI BAAs through the EHR vendor have different cost and risk profiles.
What follows is the plain-English version.
What Direct BAAs With AI Vendors Produce
Hospital signs BAA directly with each AI vendor. The hospital controls terms, attestation refresh, breach notification, and contract enforcement.
Cost profile: per-BAA legal review and management. Annual portfolio cost in the low to mid five figures for moderate footprint.
Strengths: full control of terms; direct enforcement; no EHR vendor intermediary.
Weaknesses: portfolio management overhead; new BAA at each new AI vendor.
What EHR-Flowed BAAs Produce
AI vendor relationship flows through EHR vendor. EHR vendor maintains primary BAA with hospital; AI vendor is subcontractor.
Cost profile: lower hospital management overhead; EHR vendor manages the AI relationship.
Strengths: simplified BAA portfolio; EHR vendor handles AI vendor management.
Weaknesses: dependency on EHR vendor's BAA discipline; less direct hospital control; reduced visibility into AI vendor practices.
When Direct BAAs Are the Right Choice
Three conditions favor direct BAAs.
-
Hospital-controlled AI deployment. AI tools the hospital deploys independently of EHR (clinical decision support outside the EHR, AI in revenue cycle, AI in patient communications).
-
Hospital with strong vendor management. Hospitals with mature vendor management functions can absorb the direct BAA portfolio.
-
High-risk or material AI. Tools handling sensitive workflows benefit from direct hospital control.
When EHR-Flowed BAAs Are the Right Choice
Three conditions favor EHR-flowed.
-
EHR-integrated AI. AI tools delivered through the EHR vendor naturally flow through the EHR BAA.
-
Limited hospital vendor management capacity. Hospitals with thin vendor management benefit from EHR vendor handling.
-
Lower-risk AI. Tools handling lower-sensitivity workflows can flow through EHR with manageable risk.
What the CFO Controls in BAA Architecture
The CFO controls three things in BAA architecture.
The first is the portfolio strategy. Direct vs EHR-flowed for new and existing AI vendor relationships.
The second is the management capacity. Direct BAA portfolio requires management investment.
The third is the EHR vendor relationship. EHR-flowed BAAs depend on EHR vendor's discipline.
Three Things to Work Through on BAA Architecture
A healthcare CFO should work through three things on BAA architecture. The first is current-state inventory of AI BAAs by relationship type. The second is strategic decision per tool category. The third is management capacity sizing.
Match the BAA Architecture to the Hospital's Vendor Management Capability
A healthcare CFO designing AI BAA architecture is designing the HIPAA foundation for AI vendor relationships. Either approach can produce compliance; the choice should follow the hospital's capability.
If your hospital has not assessed BAA architecture in the last twelve months, that is the conversation worth having with your Tech-Operations partner before the next vendor cycle.
Five Nines Technology Group is a Tech-Operations partner for community hospitals, clinics, and health systems. Translating regulatory frameworks into operating discipline at community hospital scale is where our team focuses.
Frequently asked questions
Can the same AI vendor have BAAs through both pathways?
Yes. Hospitals sometimes maintain direct BAA for some uses and EHR-flowed for others.
Does the EHR vendor's subcontractor BAA satisfy HIPAA?
When properly structured, yes. The EHR vendor's BAA must flow appropriate terms to subcontractors.
Can the hospital audit AI vendors flowing through EHR?
Subcontractor audit rights depend on the EHR BAA terms. Direct audit is harder than with direct BAA.
What is the most common BAA architecture gap?
Incomplete coverage. Hospitals discover AI vendors handling PHI without complete BAA in place.
How does breach notification work in flowed BAAs?
EHR vendor notifies hospital; hospital responds. Direct BAA produces direct notification.