A business associate agreement (BAA) is necessary when a cloud service handles electronic protected health information (ePHI) for a HIPAA-regulated organization, but signing one does not make the service or the customer’s deployment compliant by itself. Your organization still needs to understand the service, assess risks to ePHI, implement the safeguards applicable to its role, and document how responsibilities are divided with the cloud provider.
Who must meet HIPAA’s requirements?
HIPAA applies to covered entities and business associates as defined by the law—not automatically to every company that handles health-related data. A healthcare organization’s status depends on its role and activities. A business associate is generally a person or organization that creates, receives, maintains, or transmits protected health information (PHI) on behalf of a covered entity or another business associate.
As an Amazon Associate I earn from qualifying purchases.
When assessing a cloud arrangement, identify the data and services involved, the parties’ roles, and whether the provider handles PHI on behalf of a regulated organization. The fact that a product is marketed as “healthcare” or “HIPAA-ready” does not establish that a particular company is covered, or that a particular deployment satisfies HIPAA.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallWhat does a BAA do—and what remains your responsibility?
A BAA sets permitted and required uses and disclosures of PHI, requires appropriate safeguards, and establishes certain obligations between the parties. It is a contractual foundation for the relationship, not a compliance certificate and not a transfer of every HIPAA duty to the cloud service provider (CSP).
#1 Best Overall
Covered entities and business associates remain responsible for the requirements that apply to them. Both must analyze risks and vulnerabilities to the confidentiality, integrity, and availability of the ePHI they handle, and take appropriate steps to manage those risks. HHS OCR describes the Security Rule as “flexible, scalable, and technology neutral.” That flexibility lets organizations choose measures suited to their circumstances; it does not remove the obligation to assess risk and implement applicable safeguards.
The division of work depends on the parties’ roles, the service design, the results of risk analysis, and the written agreements. A customer may manage its users’ authentication while a provider protects the provider’s administrative systems. Neither task, by itself, accounts for every safeguard relevant to the arrangement.
Is a cloud provider a business associate if it stores only encrypted ePHI?
Generally, yes, if the CSP maintains ePHI on behalf of a covered entity or business associate. The provider does not have to read the information or possess the decryption key to meet the business associate definition. HHS OCR’s Guidance on HIPAA & Cloud Computing, last reviewed December 23, 2022, states: “Lacking an encryption key does not exempt a CSP from business associate status and associated obligations under the HIPAA Rules.”
Recommended Free Tools
Why the conduit exception usually does not fit cloud storage
The conduit exception is narrow. It concerns a service that transmits PHI, with only transient storage incidental to transmission. A cloud service that persistently stores ePHI is not equivalent to a postal service merely because the provider cannot decrypt the data.
How should you divide cloud security responsibilities?
HIPAA allows public, hybrid, and private cloud arrangements when the required agreements and applicable safeguards are in place. The architecture itself does not determine compliance: the service boundary, access model, data flows, and each party’s controls affect the risk analysis and the work required. HHS does not prescribe one universal cloud stack or architecture.
Use a written responsibility matrix for each service as a planning aid—not as an official HHS checklist or an exhaustive statement of legal requirements. Identify who performs each relevant task, what evidence or service commitment supports it, and how unresolved gaps will be handled.
Rank #3
| Area to document | Questions for the customer and CSP |
|---|---|
| Service and data scope | Which service, components, data flows, and ePHI are in scope? Which party creates, receives, maintains, or transmits the information? |
| Identity and access | Who controls customer-user accounts and authentication? Who limits and reviews provider personnel’s administrative access? |
| Encryption and keys | Which party applies encryption, controls keys, and addresses access to systems that manage the service? |
| Logging and monitoring | Which party records relevant activity, monitors it, and provides information needed to investigate a concern? |
| Availability and recovery | What backup, restoration, and recovery services are provided, and what does the customer need to configure or test? |
| Incidents and notifications | How will the parties identify, report, investigate, and coordinate on security incidents and potential breaches? |
| Subcontractors | Which downstream providers handle PHI, and what agreements and safeguards apply to those services? |
| Location and exit | Where may data be stored or processed? How will the customer access, export, return, and address deletion of ePHI when service ends? |
For example, a customer may be responsible for authenticating its own users, while the CSP is responsible for controls over its management tools and personnel access. The provider must consider risks to those systems, including unauthorized administrative access and unpatched or obsolete tools. A “no-view” service does not make those provider-side risks disappear.
Free tools Windows power users keep installed
One-click scans. No signup required.
What should the BAA and service terms address?
Review the BAA alongside the service-level agreement (SLA) and other applicable contract documents. HHS identifies operational topics that can matter to a cloud arrangement, including availability, backup and recovery, security responsibility, access to and return of data at termination, and limits on use, retention, and disclosure. Terms should be consistent with the BAA and HIPAA requirements, and should not prevent the regulated organization from accessing ePHI when needed.
Incident reporting and breach obligations
Business associates must address security incidents and report incidents of which they become aware to the covered entity or other business associate they serve. The BAA can specify the report’s format, level of detail, and frequency. Breaches of unsecured PHI are also subject to separate Breach Notification Rule requirements; contract terms do not override those requirements.
Rank #4
Security documentation and audit rights
HIPAA does not expressly require a CSP to provide customers with security documentation or to allow them to audit its security practices. That does not make assurance irrelevant: based on its risk analysis and compliance needs, a customer can negotiate for documentation, audit rights, or other assurances in the BAA, SLA, or related documents. HHS OCR’s cloud-provider documentation and audit FAQ distinguishes what HIPAA expressly requires from additional assurances the parties may agree to.
Subcontractors and downstream services
A business associate’s subcontractor that creates, receives, maintains, or transmits PHI on its behalf is also a business associate. The upstream business associate must establish an appropriate BAA with that subcontractor before disclosing PHI for the work. Map the downstream services that handle PHI instead of assuming that a top-level cloud agreement automatically covers every component.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Overseas cloud storage
HIPAA does not categorically prohibit overseas cloud storage. However, data location can affect risk and practical enforceability, so parties should include location-specific considerations in their risk analysis and risk-management plans. The rules do not establish a blanket U.S.-only data-residency requirement.
Best Value
What should a health-tech team do before relying on a cloud service?
- Define the HIPAA relationship. Determine whether your organization is acting as a covered entity, business associate, or neither for the activity, and establish whether the CSP handles PHI on your behalf.
- Map the service and data flows. Identify the ePHI involved, where it is created, transmitted, maintained, or accessed, and which service components and downstream providers are in scope.
- Complete your risk analysis. Assess threats and vulnerabilities affecting ePHI confidentiality, integrity, and availability in the context of your organization’s size, complexity, capabilities, infrastructure, costs, and the probability and criticality of risks.
- Agree on the responsibility boundary. Document which party addresses each applicable control, including customer-user access, provider administrative access, encryption and keys, monitoring, recovery, and incident coordination.
- Put operational terms in writing. Confirm that the BAA, SLA, and related terms cover the service accurately, including permitted data use, incidents, service availability, downstream providers, and data return at termination.
- Check that the arrangement works in practice. Confirm that your team can perform its assigned tasks and obtain the information it needs from the CSP. Resolve gaps rather than treating a signed BAA as proof that controls are operating.
HHS identifies the joint ASTP/ONC and OCR Security Risk Assessment Tool as a resource that may be useful to small and medium-sized healthcare practices and business associates. It is a government assessment tool, not an endorsement or certification of any cloud product.
What is the current status of proposed Security Rule changes?
HHS’s Security Rule history page, last reviewed March 19, 2026, lists the “HIPAA Security Rule to Strengthen the Cybersecurity of Electronic Protected Health Information” dated January 6, 2025, as a proposed rule. The page separately lists the January 25, 2013 Omnibus HIPAA Final Rule. The 2025 item should therefore be described as a proposal based on that page; a proposal is not itself an effective final rule. Check HHS’s current rulemaking information for any later status change before relying on this distinction for a compliance decision.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
