A Business Associate Agreement is the contractual backbone of HIPAA-compliant AI deployment. Most vendor BAAs are adequate. Some are aggressive. A few are dangerous. This post is about what a healthy BAA actually looks like and which clauses deserve careful attention before signing.
What a BAA does
A BAA binds the vendor (the "business associate") to HIPAA's Privacy and Security Rules for PHI they handle on behalf of the practice (the "covered entity"). Without one, a vendor that touches PHI is out of compliance, full stop.
The essential clauses every BAA needs
- Scope of permitted uses and disclosures.
- Safeguarding requirements (administrative, physical, technical).
- Breach notification timeline — ideally 24-72 hours from discovery.
- Subcontractor flow-down — subcontractors inherit the BAA terms.
- Audit rights for the covered entity.
- Termination provisions including data return or destruction.
AI-specific clauses that matter
For an AI vendor, the BAA should specifically address:
- No training on PHI. The vendor will not use PHI to train, improve, or evaluate its general models. This should be explicit, not inferred.
- Model deployment location. Where the model physically runs — public inference, dedicated tenant, private cloud, or on-premise.
- Retention and deletion. How long the vendor retains PHI, how deletion works, how deletion is verified.
- Access logs. Who at the vendor can see PHI, and audit trails available to the covered entity.
- Subcontractor AI vendors. If the primary vendor uses an underlying AI provider (Azure OpenAI, AWS Bedrock, Anthropic, OpenAI), the BAA needs to address that flow-down.
Red flags in vendor BAAs
- Vague data-use language — "for service improvement" without defining limits.
- Unlimited retention.
- No breach-notification timeline.
- Broad indemnification that shifts risk to the covered entity.
- No audit rights.
- Silence on subcontractors.
What we sign
For our healthcare engagements, our BAA specifically addresses every item above, with no training on PHI, bounded retention, 24-hour breach notification, subcontractor flow-down, and audit rights. For the broader HIPAA vendor-evaluation frame see The HIPAA AI vendor checklist.
Have a vendor BAA you'd like a second set of eyes on? Scope a conversation. Nothing here is legal advice; your counsel reviews the final contract.