--- title: Which IT Vendors Count as Business Associates Under HIPAA? description: Do cloud, backup, and software vendors need a HIPAA BAA? Five Nines Technology Group explains which IT vendors are business associates and how to check. image: https://blog.fivenines.com/hubfs/Blog%20banner%20Who%20Else%20Is%20Holding%20Your%20Patient%20Data@1x.png --- [Skip to the main content.](https://blog.fivenines.com/which-it-vendors-count-as-business-associates-under-hipaa#main-content) 1-855-817-5959    [help@fivenines.com](mailto:help@fivenines.com) [![FN\_Reverse\_Logo](https://blog.fivenines.com/hs-fs/hubfs/FN_Reverse_Logo.png?width=3022&height=849&name=FN_Reverse_Logo.png "FN_Reverse_Logo")](https://fivenines.com/) [![FiveNinesPrimaryLogo](https://blog.fivenines.com/hs-fs/hubfs/FiveNinesPrimaryLogo.png?width=3022&height=849&name=FiveNinesPrimaryLogo.png "FiveNinesPrimaryLogo")](https://fivenines.com/) - [Solutions](https://fivenines.com/solutions/) - [Managed IT Services](https://fivenines.com/solutions/managed-it-services/) - [Cybersecurity Services](https://fivenines.com/solutions/cybersecurity/) - [Cloud & Productivity](https://fivenines.com/solutions/cloud-productivity/) - [Projects & Enhancements](https://fivenines.com/solutions/it-projects/) - [Placement Services](https://fivenines.com/solutions/onsite-it/) - Industries - [Finance & Banking](https://fivenines.com/industries/banking/) - [Healthcare](https://fivenines.com/industries/healthcare/) - [Legal](https://fivenines.com/industries/legal/) - [Nonprofit](https://fivenines.com/industries/non-profit/) - [Manufacturing & Logistics](https://fivenines.com/industries/manufacturing-logistics/) - [Small & Mid-Sized Businesses](https://fivenines.com/industries/smb/) - [Insights](https://fivenines.com/resources/) - [Resource Library](https://fivenines.com/resources/) - [Blog](https://blog.fivenines.com) - [About](https://fivenines.com/about/) - [About Five Nines](https://fivenines.com/about/) - [Leadership Team](https://fivenines.com/our-team/) - [Community Impact](https://fivenines.com/community/) - [Partnerships](https://fivenines.com/partnerships/) - [Careers](https://fivenines.com/careers/) - [Company News](https://fivenines.com/news/) Let's Talk Get Support Toggle Menu Toggle Menu Let's Talk Get Support - [Solutions](https://fivenines.com/solutions/) - [Managed IT Services](https://fivenines.com/solutions/managed-it-services/) - [Cybersecurity Services](https://fivenines.com/solutions/cybersecurity/) - [Cloud & Productivity](https://fivenines.com/solutions/cloud-productivity/) - [Projects & Enhancements](https://fivenines.com/solutions/it-projects/) - [Placement Services](https://fivenines.com/solutions/onsite-it/) - Industries - [Finance & Banking](https://fivenines.com/industries/banking/) - [Healthcare](https://fivenines.com/industries/healthcare/) - [Legal](https://fivenines.com/industries/legal/) - [Nonprofit](https://fivenines.com/industries/non-profit/) - [Manufacturing & Logistics](https://fivenines.com/industries/manufacturing-logistics/) - [Small & Mid-Sized Businesses](https://fivenines.com/industries/smb/) - [Insights](https://fivenines.com/resources/) - [Resource Library](https://fivenines.com/resources/) - [Blog](https://blog.fivenines.com) - [About](https://fivenines.com/about/) - [About Five Nines](https://fivenines.com/about/) - [Leadership Team](https://fivenines.com/our-team/) - [Community Impact](https://fivenines.com/community/) - [Partnerships](https://fivenines.com/partnerships/) - [Careers](https://fivenines.com/careers/) - [Company News](https://fivenines.com/news/) # Which IT Vendors Count as Business Associates Under HIPAA? [Five Nines Team](https://blog.fivenines.com/author/five-nines) : Nov 10, 2026, 6:00:00 AM 7 min read [Cybersecurity](https://blog.fivenines.com/topic/cybersecurity) [Healthcare](https://blog.fivenines.com/topic/healthcare) [Compliance](https://blog.fivenines.com/topic/compliance) ![Which IT Vendors Count as Business Associates Under HIPAA?](https://blog.fivenines.com/hubfs/Blog%20banner%20Who%20Else%20Is%20Holding%20Your%20Patient%20Data@1x.png) *Key Value Points* - **Access decides, not the label.** A vendor that creates, receives, maintains, or transmits PHI for you is a business associate, whatever its contract calls it. - **Encrypted still counts.** HHS says a cloud provider storing encrypted PHI is a business associate even if it never holds the decryption key. - **Your vendors have vendors.** Any subcontractor that touches your PHI is a business associate too, and needs a BAA with the vendor that hired it. - **A signed BAA is the floor.** It assigns responsibility. It does not prove the safeguards exist. Any IT vendor that creates, receives, maintains, or transmits protected health information (PHI) on your behalf is a HIPAA business associate and needs a signed business associate agreement (BAA). That includes cloud hosting, backup services, most cloud software, e-fax and email platforms, and the IT company with admin access to your network. Now picture the BAA folder at most clinics. It holds the EHR vendor and the billing company. Meanwhile, the backup tool someone bought on a company card copies every chart to an offsite data center each night. A help desk ticket has a screenshot of a patient's medication list attached. The e-fax service keeps every inbound referral in a web inbox. ***HIPAA does not care what a vendor calls itself. It cares what the vendor can touch.*** The Office for Civil Rights at the U.S. Department of Health and Human Services made this explicit in its [Guidance on HIPAA and Cloud Computing](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html). A cloud provider that stores encrypted patient data is still a business associate, even when it has no key to read that data. Five Nines Technology Group sees the same blind spot in healthcare IT environments: the vendors that get a BAA are the ones that look like healthcare vendors.  *This post is general information about HIPAA vendor relationships, not legal advice. Confirm BAA decisions with your compliance officer or healthcare attorney.*   ## What Makes an IT Vendor a Business Associate Under HIPAA? > **Short answer:** Under HIPAA, a business associate is any person or company outside your workforce that creates, receives, maintains, or transmits PHI while providing a service to you. The test is the work and the access, not the vendor's industry. HHS also counts any subcontractor that handles PHI for that vendor as a business associate. Four verbs do all the work in the definition: create, receive, maintain, transmit. "Maintain" is the one that catches most IT vendors. Hosting a server, storing a mailbox, keeping a backup, or managing a database all count, even if nobody at the vendor ever opens a patient record. That is why an IT provider with administrative access to systems holding PHI, such as the EHR server, file shares, or email, is generally treated as a business associate. Reputable managed IT providers sign BAAs with healthcare clients as standard practice.  The subcontractor rule matters just as much. HHS defines a business associate to include any subcontractor that creates, receives, maintains, or transmits PHI on behalf of another business associate. Your IT provider's backup platform, monitoring tools, and security operations vendors sit in that chain. ![Graphic 1 Does This Vendor Need a BAA@1x](https://blog.fivenines.com/hs-fs/hubfs/Graphic%201%20Does%20This%20Vendor%20Need%20a%20BAA@1x.png?width=1200&height=1368&name=Graphic%201%20Does%20This%20Vendor%20Need%20a%20BAA@1x.png) ## Do Cloud Providers Need a BAA If the Data Is Encrypted? > **Short answer:** Yes. HHS states in its cloud computing guidance that a cloud provider storing PHI is a business associate even when the data is encrypted and the provider has no decryption key. Encryption lowers breach risk. It does not remove the provider's HIPAA obligations or your need for a signed BAA. HHS calls this arrangement "no-view services," and it closed the loophole directly. The guidance explains that encryption protects confidentiality but does nothing for integrity or availability. Encrypted data can still be corrupted by malware or lost in a disaster. OCR has enforced this. The cloud guidance cites a resolution agreement with [Oregon Health and Science University](https://www.hhs.gov/about/news/2016/07/18/widespread-hipaa-vulnerabilities-result-in-settlement-with-oregon-health-science-university.html), which OCR found had stored ePHI of more than 3,000 individuals on a cloud server without a BAA. The guidance also recommends that you and the cloud provider confirm in writing who handles which Security Rule requirements. In practice, that means the BAA or service agreement should say who controls user access, who manages encryption, and who restores data after an incident.   ## Do Backup and Disaster Recovery Vendors Need a BAA? > **Short answer:** Yes, in nearly every case. A backup service maintains a full copy of your PHI, often for months or years. That persistent access is exactly what makes a vendor a business associate. It applies to cloud backup, offsite replication, and the storage provider behind your IT company's backup platform. Your backup is the most complete copy of patient data your organization owns. It holds every chart, image, and billing record, plus the deleted files nobody remembers. HHS flags two backup questions worth putting in writing. First, how data comes back to you when the contract ends. The Privacy Rule requires a BAA to call for return or destruction of PHI at termination where feasible. Second, whether the vendor can hold your data hostage. HHS has stated that a business associate may not [block or terminate your access to ePHI](https://www.hhs.gov/hipaa/for-professionals/faq/2074/may-a-business-associate-of-a-hipaa-covered-entity-block-or-terminate-access/index.html) in a way that violates HIPAA, including during a contract dispute. > ### The Hidden Risk > > Your backup is the one place every patient record lives at once. If the company holding it never signed a BAA, your best safeguard is also your biggest gap.   ## Do Software Vendors Need to Sign a BAA? > **Short answer:** It depends on where the data lives and who can reach it. Cloud software that stores or processes PHI needs a BAA. Software installed on your own servers may not, unless the vendor has remote support access to systems containing PHI, which most do. The obvious ones are the EHR, practice management, and billing platforms. The ones that get missed are patient texting and reminder tools, online scheduling, dictation and transcription, e-fax, secure file sharing, and survey tools that collect intake details. Remote support is the quiet trigger. A vendor that connects to fix an interface between the EHR and the lab system sees PHI on the screen and can reach the database behind it. That is routine access, not an accident. Two checks settle most software questions. Does the vendor offer a BAA at the plan level you are buying? If it does not, the tool should not hold PHI. And does the BAA cover every feature your staff actually use, or only part of the product?   ## Which IT Vendors Do Not Need a BAA? > **Short answer:** Vendors that only transmit data, with no storage beyond what transmission requires, fall under HIPAA's narrow conduit exception. HHS points to the postal service, couriers, and internet service providers acting purely as carriers. Vendors with no access to PHI at all also fall outside the rule. The conduit exception is smaller than most vendors claim. HHS limits it to transmission-only services, with any storage only temporary and incidental to delivery. In [HHS FAQ 2077](https://www.hhs.gov/hipaa/for-professionals/faq/2077/can-a-csp-be-considered-to-be-a-conduit-like-the-postal-service-and-therefore-not-a-business%20associate-that-must-comply-with-the-hipaa-rules/index.html), OCR says a provider that stores data in addition to transmitting it is a business associate for the transmission too. A true conduit looks like the internet circuit into your building. A hardware reseller that ships sealed laptops never touches PHI. The status changes when a device that held PHI goes back to a vendor for repair, recycling, or end of lease. Whoever handles that drive is handling patient data.   ## How Do You Sort Every Vendor by PHI Access? > **Short answer:** Sort vendors by what they can do with PHI, not by what they sell. The Five Nines PHI Access Map groups every vendor into four levels: holds PHI, reaches PHI, moves PHI only, and never near PHI. The first two levels need a signed BAA. **The Five Nines PHI Access Map** | Access level | What the vendor does | Typical IT vendors | BAA needed? | What it looks like on the floor | | --- | --- | --- | --- | --- | | 1. Holds PHI | Stores or processes PHI on its own systems | Cloud hosting, EHR and other cloud software, backup and disaster recovery, email, e-fax | Yes | Your patient data sits in their data center, encrypted or not | | 2. Reaches PHI | Has admin, remote, or monitoring access to systems that hold PHI | Managed IT provider, remote support for EHR or lab interfaces, security monitoring that collects logs | Yes, generally | A technician can open the server, the mailbox, or the screen a nurse is using | | 3. Moves PHI only | Transmits PHI with no storage beyond delivery | Internet circuit, courier | Usually no (conduit exception) | The pipe, not the place the data rests | | 4. Never near PHI | No access to systems or devices holding PHI | Reseller shipping sealed hardware, tools with no patient data | No, but recheck at every change | Until a laptop comes back for repair or someone pastes patient names into the tool |   ![Graphic 2 The Five Nines PHI Access Map@1x](https://blog.fivenines.com/hs-fs/hubfs/Graphic%202%20The%20Five%20Nines%20PHI%20Access%20Map@1x.png?width=1200&height=1344&name=Graphic%202%20The%20Five%20Nines%20PHI%20Access%20Map@1x.png) Vendors drift between levels. A level 4 tool becomes level 1 the day a front desk team starts using it for appointment reminders. That is why the map works best as a standing review, not a one-time list. > ### Five Nines Insight > > Count the vendors that can touch PHI, not the vendors you think of as healthcare vendors. The first list is almost always longer.   ## Is a Signed BAA Enough to Manage Vendor Risk? > **Short answer:** No. A BAA sets the rules and assigns liability, but HHS does not require a vendor to show you security documentation unless your contract asks for it. A proposed HIPAA Security Rule update would require annual written verification of business associate safeguards. As of late 2026, that rule is still proposed. HHS says this plainly in its cloud guidance: HIPAA requires "satisfactory assurances" in the form of a BAA, and it does not require vendors to provide audits or evidence. You can require that evidence through the BAA or service agreement, based on your own risk analysis. That may change. The Security Rule proposal published in the Federal Register in January 2025 would require business associates to verify their technical safeguards in writing at least once every 12 months. According to [The HIPAA Journal](https://www.hipaajournal.com/hipaa-security-rule-business-associates/), the federal regulatory agenda now projects final action for July 2027, and the current Security Rule remains what OCR enforces today. The largest vendor incident in healthcare shows why paperwork alone falls short. Change Healthcare, a claims and payment processor, notified OCR in July 2025 that its February 2024 ransomware attack affected about 192.7 million individuals, according to the [HHS OCR breach portal](https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf) as compiled by UpGuard. A BAA decides who notifies whom after a breach. It does not keep your operations running while a vendor rebuilds. > ### What Leadership Misses > > A BAA is a promise about safeguards. Unless your contract demands evidence, nobody is required to show you the safeguards exist.   ## What Does Five Nines Usually Find in a Healthcare Vendor Review? > **Short answer:** Five Nines most often finds BAAs that cover the EHR and billing vendors but miss the tools around them: backup software bought outside a contract process, subcontractors behind the IT provider, and cloud apps staff adopted on their own. The gaps follow purchasing habits, not bad intent. - **The BAA folder stops at the EHR.** Agreements exist for the vendors that sold themselves as healthcare vendors. General IT vendors with deeper access never got asked. - **Backup bought on a card.** A backup or file sync tool was purchased online under click-through terms, with no BAA offered or requested. - **Invisible subcontractors.** The IT provider signed a BAA, but nobody asked which platforms it uses for backup, remote access, and monitoring, or whether those vendors signed BAAs with it. - **PHI in the help desk.** Staff attach screenshots of charts or schedules to support tickets, which puts PHI inside a ticketing system nobody reviewed. - **Former vendors with live access.** A previous IT company or software vendor still has an active remote access account, or still holds old backups nobody asked them to return or destroy.   ## What Should You Ask an IT Vendor Before Sharing PHI? > **Short answer:** Ask whether the vendor will sign a BAA, which subcontractors will touch your data, where the data is stored and backed up, how fast it reports security incidents, and what happens to your data when the contract ends. Then ask for evidence, not just a signature. 1. Will you sign our BAA, or provide yours, before you receive any PHI? 2. Which subcontractors will create, receive, store, or transmit our data, and do you hold BAAs with each of them? 3. Where is our data stored, where are the backups, and who can access both? 4. How quickly will you notify us of a security incident, and what will the notice include? 5. How do we get our data back, and how do you destroy your copies, when the contract ends? 6. What evidence can you share that your safeguards are in place, such as your most recent risk analysis summary, MFA coverage, and encryption standards?   ## Do You Know Every Vendor That Can Touch Your Patient Data? If you just counted your vendors and the number with BAAs came up short, you are not alone, and it is fixable. Five Nines Technology Group reviews healthcare vendor relationships the way an auditor would, starting from access instead of contracts. The review identifies: - Every vendor and tool that holds, reaches, or moves PHI, including subcontractors behind your IT provider - Which of those vendors have a signed BAA, and which BAAs are missing or outdated - Where backups and cloud data actually live, and who can reach them - Former vendors that still hold data or active access - The contract terms to fix first: incident notice, data return, and evidence of safeguards You leave with your organization's own PHI Access Map and a prioritized BAA gap list your compliance lead can act on. ***The vendor you worry about probably has a BAA. The risk is the one nobody thought to ask.*** ![Graphic 3 Your Vendors Have Vendors@1x](https://blog.fivenines.com/hs-fs/hubfs/Graphic%203%20Your%20Vendors%20Have%20Vendors@1x.png?width=1200&height=1358&name=Graphic%203%20Your%20Vendors%20Have%20Vendors@1x.png) ## Frequently Asked Questions Does my email provider need to sign a BAA? Yes, if email holds PHI. An email platform stores messages on its servers, which makes it a business associate under HIPAA. Confirm the BAA covers the specific services your staff use, and that encryption and access settings are configured to match it. Is my managed IT provider a business associate under HIPAA? Generally, yes. A managed IT provider with administrative or remote access to systems holding PHI has the routine access that makes it a business associate. Five Nines Technology Group signs BAAs with healthcare clients and treats the subcontractors in its own stack the same way. What happens if a clinic uses a vendor without a BAA? HHS states that using a vendor to maintain PHI without a BAA is a HIPAA violation by the covered entity. Does our internet service provider need a BAA? Usually not. An internet provider that only carries data, with no storage beyond what delivery requires, falls under HIPAA's conduit exception. If the same company also hosts email, stores files, or keeps backups for you, it is a business associate for those services. Do my vendors' subcontractors need BAAs too? Yes. HHS treats any subcontractor that creates, receives, maintains, or transmits PHI for a business associate as a business associate itself. The BAA runs between your vendor and its subcontractor, so ask your vendor to confirm those agreements exist. ## Related Blog Posts ## Let's get in touch   [**(402) 817-2630**](tel:402-817-2630) [help@fivenines.com](mailto:help@fivenines.com) [Lincoln, NE](https://fivenines.com/contact/lincoln) [Omaha, NE](https://fivenines.com/contact/omaha) [Kearney, NE](https://fivenines.com/contact/kearney) [Central City, NE](https://fivenines.com/contact/central-city) [St. Louis, MO](https://fivenines.com/st-louis) ![cyberverify-1](https://blog.fivenines.com/hs-fs/hubfs/cyberverify-1.png?width=110&height=110&name=cyberverify-1.png)![aicpa](https://blog.fivenines.com/hs-fs/hubfs/aicpa.png?width=110&height=110&name=aicpa.png) ### Are we a good fit? [![Schedule Consultation](https://no-cache.hubspot.com/cta/default/1857420/interactive-196258273705.png)](https://blog.fivenines.com/hs/cta/wi/redirect?encryptedPayload=AVxigLKvf5Sb9VzyvJx1h8RghyUxdVMNSThsNlj7L1XUpswShoIZbZqIIuf6Qhay5nRC4yVCWIDmIbWKvabtOrLMApXcaKWQcfeAL9kOJJ%2FjiOi4KV0fvUfX3xuP%2FAge7u5qAEpuVckugY3WGXWRnpxfCCDxjklvVjjzYWarbIAIuZyMOgH90fywNdIeR%2BRyRrv1lBN0cw%3D%3D&webInteractiveContentId=196258273705&portalId=1857420)   - [Privacy Policy](https://fivenines.com/privacy-policy/) - [HTML Sitemap](https://fivenines.com/html-sitemap/) © 2026 Five Nines Technology Group | 5617 Thompson Creek Blvd Lincoln, NE 68516 [Facebook](https://www.facebook.com/gonines)[Linkedin](https://www.linkedin.com/company/five-nines-technology-group/) [Blog](https://blog.gonines.com/?__hstc=143714730.45718742b0726c421d8592d7ea71f58b.1757514685996.1758029308186.1758134756251.4&__hssc=143714730.31.1758134756251&__hsfp=1745665186)   [Client Support](https://fivenines.com/client-login/) Return to top ```json { "@context" : "https://schema.org", "@type" : "FAQPage", "mainEntity" : [ { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Yes, if email holds PHI. An email platform stores messages on its servers, which makes it a business associate under HIPAA. Confirm the BAA covers the specific services your staff use, and that encryption and access settings are configured to match it." }, "name" : "Does my email provider need to sign a BAA?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Generally, yes. A managed IT provider with administrative or remote access to systems holding PHI has the routine access that makes it a business associate. Five Nines Technology Group signs BAAs with healthcare clients and treats the subcontractors in its own stack the same way." }, "name" : "Is my managed IT provider a business associate under HIPAA?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "HHS states that using a vendor to maintain PHI without a BAA is a HIPAA violation by the covered entity." }, "name" : "What happens if a clinic uses a vendor without a BAA?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Usually not. An internet provider that only carries data, with no storage beyond what delivery requires, falls under HIPAA's conduit exception. If the same company also hosts email, stores files, or keeps backups for you, it is a business associate for those services." }, "name" : "Does our internet service provider need a BAA?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Yes. HHS treats any subcontractor that creates, receives, maintains, or transmits PHI for a business associate as a business associate itself. The BAA runs between your vendor and its subcontractor, so ask your vendor to confirm those agreements exist." }, "name" : "Do my vendors' subcontractors need BAAs too?" } ] } ```