HIPAA Business Associate Agreements for Dental Offices
Unsure which vendors need a BAA? DDS Rescue explains HIPAA BAA rules for dental offices, AI tools & labs — and exactly what to do if you're exposed!
Key Takeaways
- A Business Associate Agreement (BAA) is a HIPAA-required contract that must be signed before any vendor can create, receive, maintain, or transmit protected health information (PHI) on behalf of a dental practice.
- Use a three-question framework to determine BAA necessity: Does the vendor touch PHI, is it a true conduit, or is it a treatment provider? Most vendors such as IT support, cloud backup, and practice management software require a BAA.
- Consumer AI tools like free ChatGPT cannot be used with patient data because they do not offer BAAs. Only enterprise versions with signed agreements can support HIPAA-compliant use.
- A signed BAA is only half the job. Practices must also conduct annual Security Risk Assessments to verify vendors are actually implementing required safeguards and controls.
- DDS Rescue performs HIPAA Security Risk Assessments on the live network, supplies all required BAAs and documentation, and provides ongoing compliance support for dental practices.
The BAA On Your Desk: A Plain-English Definition
A Business Associate Agreement (BAA) is the contract HIPAA requires before an outside company can create, receive, maintain, or transmit PHI on a dental practice’s behalf. Signing one makes that company legally responsible for protecting it, and operating without one when required creates a compliance gap even if a breach never occurs.
HHS’s Sample Business Associate Agreement Provisions set out sample contractual language to help covered entities and business associates comply with BAA requirements. These provisions include obligations not to use or disclose PHI other than as permitted, to apply appropriate safeguards under 45 CFR Part 164 Subpart C, to report breaches and security incidents, and to make PHI available for access, amendment, and accounting of disclosures. A vendor’s BAA should cover the same ground. A missing BAA is independently actionable under HIPAA, and a breach does not need to occur for the missing agreement to constitute a violation.
Who Needs A BAA In A Dental Practice? The Three-Question Framework
Run every vendor through these three questions in order.
- Does the vendor create, receive, maintain, or transmit PHI? If yes, a BAA is required. This is the operative test under 45 CFR § 164.504.
- Is the vendor a mere conduit that transmits data incidentally without accessing it? A postal carrier or basic internet service provider falls here. HHS reads this exception narrowly. A cloud storage provider that can access the content it holds does not qualify. If the vendor is a true conduit, no BAA is required.
- Is the vendor a treatment provider? A dental lab fabricating a restoration pursuant to a prescription is generally classified as a healthcare provider under the treatment exception. The classification is fact-specific and depends on whether the lab meets the covered-entity definition. No BAA is required for that treatment relationship. See the section below for when this analysis shifts.
The following table applies the framework to vendors a dental practice actually uses. Notice the pattern: any vendor with access to PHI needs a BAA, and the only consistent exceptions are true conduits and treatment providers.
| Vendor Category | BAA Required? | Why? |
|---|---|---|
| IT Support / MSP | Yes | Administrative access to systems holding ePHI triggers the business associate definition, even if no one opens a chart. |
| Cloud Backup | Yes | HHS holds that a cloud provider maintaining ePHI is a business associate even when data is encrypted and the provider does not hold the decryption key. |
| Practice Management Software | Yes | Software that stores, processes, or transmits patient data on the practice’s behalf requires a signed BAA. |
| Billing / Claims Clearinghouse | Yes | HHS lists billing and claims processing as a straightforward business associate relationship. |
| Dental Lab | Generally No | A lab fabricating a prescribed restoration is generally a treatment provider. See the section below for exceptions. |
| AI Tools (Consumer) | No BAA Available | Consumer versions of the major AI tools do not offer BAAs and cannot lawfully touch patient data. |
| AI Tools (Enterprise) | Yes, If Properly Configured | Enterprise plans from major AI vendors can provide BAA coverage, but the BAA must cover the specific product, plan, and features in use. |
Beyond the categories in the table, patient communication tools, scheduling platforms, and legal or accounting firms that access PHI in the course of their work all fall under Question 1. Most popular scheduling tools in the small business market do not offer a BAA at all, which creates a common gap practices do not realize they have.
Dental Labs And BAAs: When Treatment Becomes Administration
For most lab relationships, no BAA is required. Under 45 CFR § 164.506 and § 164.502(e)(1), a dental lab fabricating a prescribed restoration is participating in the treatment of the patient, not performing an administrative function on the practice’s behalf. The ADA, the National Association of Dental Laboratories, and HHS guidance all recognize this treatment exception. HHS Office for Civil Rights has confirmed that dental laboratories are correctly classified as healthcare providers for this purpose.
The analysis shifts when the lab’s role expands beyond fabrication. If a dental lab provides digital scanning, cloud case-management software, or data storage that involves PHI outside the treatment relationship, it may be functioning as a business associate for that portion of the work, because the ADA states that a health care provider performing a non-treatment function involving PHI on behalf of a practice requires a business associate agreement. The key question is whether the lab is acting as an independent treating provider or performing a covered administrative function on the practice’s behalf. When the answer is uncertain, document the analysis and consider executing an agreement.
AI Tools, ChatGPT, And BAAs In Dental Practices
AI tools create one of the newest and most active BAA gaps in dental practices. This gap exists today in many offices, often without the owner’s knowledge.
Consumer versions of the major AI platforms do not offer Business Associate Agreements, so using them with patient data puts the practice out of compliance. The moment a staff member pastes patient information into a free AI account, the practice is out of compliance. Netskope’s Healthcare 2025 report found 71% of healthcare workers still use personal AI accounts for work purposes, and Paubox’s Shadow AI Report found that 62% of healthcare organizations had observed staff experimenting with tools like ChatGPT without organizational approval.
Staff already use these tools for scheduling language, patient letters, and insurance appeal drafts, often without formal approval. Enterprise versions of the major platforms can be configured for HIPAA-compliant use, but the details matter:
- OpenAI offers a BAA for ChatGPT Enterprise, ChatGPT for Healthcare, and the API with Modified Retention, but not for Free, Plus, Pro, or Team plans.
- Anthropic offers a BAA for Claude Enterprise after the Primary Owner activates HIPAA, not for Free, Pro, Max, or Team plans.
- Google offers a BAA for the Gemini app and Gemini in Google Workspace after an admin accepts Google’s BAA, and consumer Gemini is never eligible.
The practical answer for a dental practice: to use AI tools with PHI, it needs three things. The practice must use the enterprise version of the tool, have a signed BAA in place, and configure the system correctly before any patient data touches it. When those conditions are missing, the tool cannot lawfully touch patient data. Staff using free accounts for anything involving patient information create a compliance event, not a gray area.
For a deeper look at the software side of HIPAA compliance, see Dental HIPAA Compliance Portal: A Buyer’s Guide.
How To Review A Vendor’s BAA Before You Sign
This section provides a practical checklist of what to look for before you sign. It does not replace legal advice. A vendor’s BAA should address all of the following. HHS publishes sample BAA provisions that cover the same ground.
- Permitted uses and disclosures of PHI. The agreement should define exactly what the vendor is allowed to do with patient data and prohibit everything else. Under 45 CFR 164.504(e), the BAA must prohibit the vendor from using or disclosing PHI beyond what the contract or law allows.
- Safeguard obligations. The vendor must commit to implementing administrative, physical, and technical safeguards for electronic PHI. A BAA that covers only Privacy Rule provisions and omits Security Rule safeguards is missing half of what HIPAA requires, which often happens when a legal team drafts from an old template.
- Breach notification timing. The regulatory maximum is 60 days, and OCR has treated sitting on a known breach as its own violation even when notice fell inside 60 days. A BAA that lets a vendor take most of that window leaves the practice almost no time to meet its own deadline. Negotiate a specific number of days rather than accepting a restatement of the regulatory maximum.
- Subcontractor flow-down requirements. Since the 2013 HIPAA Omnibus Rule, subcontractors of business associates are themselves directly liable under HIPAA. The BAA should require the vendor to pass equivalent obligations to any subcontractor that touches PHI.
- Termination and data return or destruction. At termination, the vendor must return or destroy all PHI, or if that is infeasible, extend the BAA’s protections indefinitely to retained information. Confirm this clause is present and specific.
A general non-disclosure agreement cannot substitute for a BAA. An NDA only restricts sharing, while a BAA makes the vendor directly accountable under HIPAA and commits it to implementing safeguards, reporting breaches, and extending obligations to subcontractors.
What Happens If You Do Not Have A BAA?
HIPAA requires the agreement, and operating without one when required creates a clear compliance gap. A missing BAA with a single vendor across a year of operations can constitute hundreds of individual HIPAA violations, one per patient record or transaction. As noted earlier, the violation exists regardless of whether a breach occurs.
The response should follow a calm, documented process. Document what happened, remediate, and get the agreement in place. Retroactive BAAs do not cure violations that already occurred, but signing one after the fact can help limit ongoing exposure.
If a vendor will not sign a BAA, the practice cannot use that vendor for PHI. Because the stakes are high, the conversation can be straightforward: explain that HIPAA requires the agreement before patient data can be shared, and ask whether the vendor has a BAA or a HIPAA-compliant version of their service. If a vendor refuses to sign, the dental practice cannot legally use that vendor for PHI storage or transmission, and verbal assurances do not change that. The practical answer is to find an alternative vendor or restructure the service so PHI is never shared.
Keep signed BAAs on file for at least six years. HIPAA requires covered entities to retain each BAA for at least six years under 45 CFR § 164.530(j), including BAAs for vendors no longer in use.
The BAA Is The Contract And The Security Risk Assessment Is The Proof
A signed BAA is a promise, and the annual HIPAA Security Risk Assessment is the evidence that the promise is being kept. A signed BAA with a vendor whose security you have never assessed creates a false sense of compliance.
A BAA says what a vendor is obligated to do but does not tell the practice whether the provider has actually configured systems appropriately, restricted administrative access, protected accounts with multifactor authentication, or tested backups. The practice needs both the agreement and the controls behind it. A signed BAA is a contract. It is not a risk assessment, and it does not transfer your obligation to evaluate the vendor.
A real risk assessment looks very different from a questionnaire. Under 45 CFR 164.308(a)(1)(ii)(A), the HIPAA Security Rule requires an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic PHI. This assessment must cover all electronic equipment, data systems, programs, and applications. That means someone actually looks at what is installed. They check the firewall type, Windows update status, server condition, EDR presence (endpoint detection and response, security software that watches each computer for attacks in progress rather than just scanning for known viruses), and email configuration. A questionnaire filled in by a dental assistant who has no way to answer it accurately does not meet that standard, and failure to conduct an accurate and thorough risk analysis is the single most frequently cited finding in OCR enforcement actions.
That gap between what a BAA promises and what a vendor actually does is where DDS Rescue is built differently. DDS Rescue performs the HIPAA Security Risk Assessment by remoting into the practice’s actual network and validating what is really there, rather than relying on staff-completed forms. The assessment confirms the firewall type, Windows update status, server condition, EDR presence, and email configuration. The practice receives an evidence of compliance report, a policies and procedures manual, all required forms including BAAs and patient-facing documents, and initial and annual staff training. The risk assessment is included with DDS Rescue backup service and is also available on its own for practices whose backup is elsewhere.
When something goes wrong and an HHS letter arrives, DDS Rescue’s response has two halves. Ray Dillon, CISSP (Certified Information Systems Security Professional, the senior credential in information security, requiring at least five years of hands-on security work), runs the forensic analysis to determine what actually happened and whether it constitutes a breach. Access to an on-staff HIPAA attorney who spent ten years at the HHS Office for Civil Rights, including service as its HIPAA Team Lead, is included in the HIPAA plan. That support turns a stack of documents into real accountability.
Frequently Asked Questions About BAAs In Dental Practices
How Do I Get A BAA From A Vendor?
Contact the vendor directly and ask whether they offer a Business Associate Agreement. Most established healthcare-facing vendors have a standard BAA ready to send. For software platforms, the BAA is often in the account settings or legal documentation section, but it is rarely automatic. You must request it, review it, and execute it before any patient data enters the system. If the vendor says they do not have one or do not know what it is, that signals the practice cannot use that vendor for PHI. Keep a copy of every executed BAA in your HIPAA documentation file for at least six years.
What Is An Example Of A HIPAA Violation In A Dental Office?
Common examples include using a scheduling tool that has never signed a BAA, storing patient intake forms on a generic online form platform without HIPAA-compliant encryption, staff pasting patient information into a free AI tool like consumer ChatGPT, sharing patient records with a third party without proper authorization, and failing to conduct a documented Security Risk Assessment. Physical violations also count, such as unsecured paper records, shared login credentials on front-desk computers, and screens visible to waiting room patients. A dental practice in Pennsylvania paid $140,000 to HHS after OCR found patient records stored in unsecured locations and no formal HIPAA training for staff.
Are There New HIPAA Rules For Dental Offices?
The existing HIPAA Privacy Rule, Security Rule, and Breach Notification Rule remain fully in force and apply to dental practices. HHS published a proposed update to the Security Rule in January 2025 that would make significant changes, including mandatory encryption, multi-factor authentication, and annual vendor verification, but as of October 2026, that proposed rule has been moved to HHS’s Long-Term Actions list with anticipated final action in July 2027. Nothing has been rolled back. The current rules are fully enforceable, and OCR’s enforcement activity in 2026 has continued at a steady pace. Dental practices should operate against the existing requirements now and monitor the proposed update as it moves toward finalization.
What Should I Do If A Vendor Will Not Sign A BAA?
If a vendor refuses to sign a BAA, the practice cannot legally use that vendor for any function involving PHI. Start by confirming whether the vendor has a HIPAA-compliant version of their service. Some vendors offer a separate enterprise or healthcare tier that includes a BAA, while their standard product does not. If no BAA is available at any tier, the options are to find an alternative vendor that will sign one or to restructure the service so patient data is never shared with that vendor. Verbal assurances, security certifications, and general claims of being “HIPAA compliant” do not substitute for a signed agreement. Document the conversation and your decision either way.
How Often Should We Review Our BAAs?
At minimum, review your BAAs annually as part of your HIPAA Security Risk Assessment cycle. Four events should trigger an immediate review regardless of the scheduled cycle: a vendor expanding the scope of services involving PHI, a vendor acquisition or ownership change, a breach involving the vendor, and any regulatory changes to HIPAA guidance. It is also worth reviewing BAAs when a vendor updates their terms of service, since changes to data handling terms can affect the agreement’s adequacy. Keep a running inventory of all vendors with access to PHI and the status of each BAA. This list is what OCR will ask for first if a complaint or breach investigation is opened.
What Should I Do If I Discover We Have Been Using A Vendor Without A BAA?
Document the discovery, including when you found out, how long the vendor has had access to PHI, and what type of data was involved. Then get the BAA executed as quickly as possible. A retroactive agreement does not cure the prior period of non-compliance, but it stops the ongoing exposure. Assess whether the situation rises to the level of a reportable breach under HIPAA’s four-factor breach risk assessment. If you are unsure, that determination should involve someone with actual HIPAA expertise, not a general attorney who does not work in healthcare privacy. Do not assume the situation is minor without a proper analysis. Going forward, build a vendor onboarding checklist that requires a signed BAA before any PHI is shared.
Conclusion: Getting BAA Compliance Off Your Desk
The BAA question becomes manageable when broken into steps. Run every vendor through the three-question framework: determine whether the vendor touches PHI, qualifies as a true conduit, or acts as a treatment provider. That framework resolves most cases without ambiguity. For the vendors that remain, such as AI tools, scheduling platforms, and billing services, the answer is almost always that a BAA is required and the vendor either has one or the practice cannot use them for patient data.
Once the agreements are in place, the work continues. A signed BAA is a promise, and the Security Risk Assessment is the evidence that the promise is being kept. Pull the list of vendors that touch PHI. Check which ones have signed BAAs on file. Review the agreements against the clause checklist in this article. Then arrange a real risk assessment where someone remotes into the network and confirms what is installed, so the promises in those agreements rest on evidence instead of assumption.
DDS Rescue has been protecting dental practices nationwide for more than 15 years. Over 1,000 practices nationwide work with DDS Rescue. The HIPAA Security Risk Assessment is performed by remoting into the practice’s actual network. BAAs and all required patient-facing documents are supplied. When HHS sends a letter, a CISSP-led IT team and access to an on-staff HIPAA attorney are already in place. For current service details and pricing, you can view current pricing.
Talk To DDS Rescue About Your BAAs
