A healthcare CFO managing AI vendor BAAs faces an architectural choice as AI footprint grows. Direct relationships with each AI vendor or flowing AI BAAs through the EHR vendor have different cost and risk profiles.
What follows is the plain-English version.
Hospital signs BAA directly with each AI vendor. The hospital controls terms, attestation refresh, breach notification, and contract enforcement.
Cost profile: per-BAA legal review and management. Annual portfolio cost in the low to mid five figures for moderate footprint.
Strengths: full control of terms; direct enforcement; no EHR vendor intermediary.
Weaknesses: portfolio management overhead; new BAA at each new AI vendor.
AI vendor relationship flows through EHR vendor. EHR vendor maintains primary BAA with hospital; AI vendor is subcontractor.
Cost profile: lower hospital management overhead; EHR vendor manages the AI relationship.
Strengths: simplified BAA portfolio; EHR vendor handles AI vendor management.
Weaknesses: dependency on EHR vendor's BAA discipline; less direct hospital control; reduced visibility into AI vendor practices.
Three conditions favor direct BAAs.
Hospital-controlled AI deployment. AI tools the hospital deploys independently of EHR (clinical decision support outside the EHR, AI in revenue cycle, AI in patient communications).
Hospital with strong vendor management. Hospitals with mature vendor management functions can absorb the direct BAA portfolio.
High-risk or material AI. Tools handling sensitive workflows benefit from direct hospital control.
Three conditions favor EHR-flowed.
EHR-integrated AI. AI tools delivered through the EHR vendor naturally flow through the EHR BAA.
Limited hospital vendor management capacity. Hospitals with thin vendor management benefit from EHR vendor handling.
Lower-risk AI. Tools handling lower-sensitivity workflows can flow through EHR with manageable risk.
The CFO controls three things in BAA architecture.
The first is the portfolio strategy. Direct vs EHR-flowed for new and existing AI vendor relationships.
The second is the management capacity. Direct BAA portfolio requires management investment.
The third is the EHR vendor relationship. EHR-flowed BAAs depend on EHR vendor's discipline.
A healthcare CFO should work through three things on BAA architecture. The first is current-state inventory of AI BAAs by relationship type. The second is strategic decision per tool category. The third is management capacity sizing.
A healthcare CFO designing AI BAA architecture is designing the HIPAA foundation for AI vendor relationships. Either approach can produce compliance; the choice should follow the hospital's capability.
If your hospital has not assessed BAA architecture in the last twelve months, that is the conversation worth having with your Tech-Operations partner before the next vendor cycle.
Five Nines Technology Group is a Tech-Operations partner for community hospitals, clinics, and health systems. Translating regulatory frameworks into operating discipline at community hospital scale is where our team focuses.