Business Associate Agreements for Dental Practices: Which Vendors Need One and Who Holds Your Patient Data

A new patient-texting platform sends its onboarding packet, and page three asks whether "your BAA" is attached. The same week, a billing vendor's security notice lands in the practice inbox, and the doctor asks a fair question at the morning huddle: which of our vendors actually have our patients' information, and what did each of them sign? Nobody at the front desk is sure where the paperwork lives.

This guide answers the follow-up questions in order: what a business associate agreement is, which dental vendors need one (a table of more than twenty vendor types), what the regulation says the agreement must contain, how to build a vendor register, and how to get your data back when a vendor leaves. It quotes the regulation directly, it is not legal advice, and every reading ends the same way: confirm it with your compliance adviser or attorney. If you would rather have help putting the paperwork in order, Legend's page on HIPAA compliance support for dental practices is the place to start; for the wider security picture, see the dental cybersecurity checklist.

What is a business associate agreement?

A business associate agreement (BAA) is a contract HIPAA requires a dental practice to sign with each outside company that creates, receives, maintains or transmits its patients' protected health information on the practice's behalf. It limits what the vendor may do with the data, requires safeguards and breach reporting, and says what happens to the data when the relationship ends.

The definition comes from 45 CFR 160.103. A business associate is a person or company that, "on behalf of" a covered entity and other than as a member of its workforce, "creates, receives, maintains, or transmits protected health information" for a regulated function, a list that includes "billing", "practice management" and "data analysis, processing or administration" (45 CFR 160.103, eCFR, read 13 November 2026). The same definition adds anyone who provides "legal, actuarial, accounting, consulting … management, administrative" or financial services where the service involves disclosing patient information to them.

The agreement itself is required in two places. The Privacy Rule lets a practice share information with a business associate only if it "obtains satisfactory assurance that the business associate will appropriately safeguard the information", and says those assurances "must be documented through a written contract or other written agreement or arrangement" (45 CFR 164.502(e)). The Security Rule says the same for electronic records at 45 CFR 164.308(b). The contents are set out in 45 CFR 164.504(e), covered below.

The four verbs, in a dental office

The test turns on four verbs. If a vendor does any one of them with your patients' information, for your practice, it is probably a business associate.

Your vendors' vendors are business associates too

The chain doesn't stop at the first company. The 160.103 definition includes "a subcontractor that creates, receives, maintains, or transmits protected health information on behalf of the business associate". Your IT provider's remote-support tool, your cloud software's hosting company and your answering service's call platform can all sit in that second link. The practice signs with its vendor; the vendor is responsible for signing with its own subcontractors under 45 CFR 164.502(e)(1)(ii). You can still ask who those subcontractors are, and you should.

Business associates have duties of their own

The rules also apply to the vendor directly. The Security Rule says "A covered entity or business associate must comply with the applicable standards" (45 CFR 164.302). The Privacy Rule says a business associate "may use or disclose protected health information only as permitted or required by its business associate contract or other arrangement" or as required by law (45 CFR 164.502(a)(3)), and 45 CFR 164.410 gives it its own duty to report breaches to the practice. That doesn't take the practice off the hook: the practice still has to have the agreement before the data flows.

Which dental vendors need a business associate agreement?

A dental vendor needs a business associate agreement when it handles your patients' information to do work for the practice: software support, IT, backup, email, billing, clearinghouses, patient messaging, answering services, AI tools, accountants and shredding. Treatment providers such as your lab and specialists, your own staff, and pure carriers such as the internet provider usually don't.

The American Dental Association puts it in one line: business associates "might be lawyers, accountants, consultants, insurance companies, clearinghouses, billing services or computer support services" (ADA, FAQ on HIPAA Business Associates, read 13 November 2026). The table below applies that test to the vendors a typical dental office actually pays. "Usually" is deliberate: the answer depends on what the vendor does for you, not on its name, so confirm each edge case with your compliance adviser.

Who usually doesn't need one

Three groups sit outside the business associate rule most of the time. First, treatment providers. The 160.103 definition says a business associate does not include "A health care provider, with respect to disclosures by a covered entity to the health care provider concerning the treatment of the individual", and the ADA applies the same reasoning to dental labs. The exception covers treatment only. The ADA adds that if a provider "is performing a function on behalf of your practice that involves PHI, and not treatment of an individual, a business associate agreement is required." A lab that also hosts your scan files in its portal for other purposes, or a specialist group that does your billing, is a different question for your adviser.

Second, your own workforce. The definition covers work done "other than in the capacity of a member of the workforce of such covered entity". Associate dentists, hygienists and temps working under your direction follow your policies and get your HIPAA training instead.

Third, carriers and trades whose work doesn't involve patient information. The definition reaches a data-transmission service only when it "requires access on a routine basis" to patient information, so an internet provider or courier that only carries data or packages usually sits outside it, as does a cleaner or electrician who never handles records. Confirm the edge cases with your compliance adviser.

The grey zone: phones, answering services, AI and marketing

Most of the uncertainty in dental offices is in four places: phone systems, answering services, AI tools and marketing platforms. The working rule is the same for each: if the service can see, hear or store patient information, ask for a business associate agreement before you switch it on, and confirm the edge cases with your compliance adviser.

• • Phones. A carrier that only connects calls looks like a conduit. A cloud phone system that stores recordings, transcribes voicemail or emails it to the front desk is maintaining patient information. Our guide to VoIP phone systems for dental offices covers the features that create those recordings.
• • Answering services. The service writes down who called, why and how urgent it is. That is creating patient information for you.
• • AI tools. An AI receptionist, call summariser or scribe hears and stores patient conversations. Before you sign, run it through an AI vendor questionnaire, including what it keeps and whether it trains on your recordings.
• • Marketing and reviews. A platform that pulls patient names and phone numbers from your schedule to send review requests is receiving patient information. An agency that only runs ads on your website without touching patient lists usually isn't.

Does encryption get a cloud vendor out of it?

Usually not. The 160.103 test is whether the vendor "creates, receives, maintains, or transmits" patient information for you, and a cloud service that stores your records maintains them, whether or not it holds the encryption key. The definition makes no exception for encrypted data, so ask your compliance adviser before treating any storage vendor as outside it. That matters for cloud practice software, cloud imaging and every cloud backup. Encryption is still worth having; it just doesn't replace the agreement.

What must a business associate agreement include?

HIPAA lists the required terms at 45 CFR 164.504(e)(2). The agreement must limit the vendor to permitted uses, require safeguards, require it to report misuse and breaches, bind its subcontractors, support patients' access and amendment rights, open its records to HHS, return or destroy your data at the end, and let you terminate if it breaks a material term.

The table below puts each required term in plain words, next to the paragraph it comes from in 45 CFR 164.504(e) and the Security Rule's matching terms in 45 CFR 164.314(a). Use it as a reading aid when a vendor sends its paper; whether a given clause meets the rule is your adviser's call.

Is there an official template?

The regulation sets out what the agreement must contain (45 CFR 164.504(e)(2), the table above), not a form to fill in. Large vendors usually send their own standard agreement rather than sign yours. Either way, your attorney decides which paper to use. We don't publish a template of our own, and this page doesn't draft clauses.

What's negotiable

The ADA notes that "Many of the terms of a business associate agreement are required by HIPAA, but others, such as indemnification and insurance provisions, can be negotiated by the parties." Two more to raise: a reporting timeframe shorter than the rule's outer limit, and whether the vendor handles any notifications on the practice's behalf. Those are topics to raise with your attorney, not wording to copy from a blog.

What a BAA doesn't do

A signed agreement is a promise, not an inspection. It doesn't tell you whether the vendor uses multi-factor authentication, where its backups are kept or who on its staff can open your records. It doesn't move your own HIPAA duties to the vendor: the practice still runs its own risk analysis and safeguards. And it doesn't reach data the vendor was never supposed to have. Treat the agreement as the floor, then ask the vendor how it actually protects your data.

How do you build a vendor register (and keep the signed copies)?

A vendor register is one list of every company that touches your patients' information: what it touches, how it connects, and where its signed agreement is filed. Build it from what you pay and what you log in to, review it yearly, and keep the documentation six years. Reach for it first when a vendor reports a problem.

Start from money, not memory. Export twelve months of payments from accounts payable and the practice credit card, and mark every company that could see patient information. Then walk the software list on a front-desk computer and the server, the logins saved in browsers, the remote-access tools installed, and the phone and texting systems. Our HIPAA compliance checklist for dental practices has a vendor section that fits alongside this, and missing agreements show up regularly among common HIPAA violations in dental practices.

How long should you keep the signed agreements?

The Security Rule's documentation standard says to retain required documentation "for 6 years from the date of its creation or the date when it last was in effect, whichever is later" (45 CFR 164.316(b)(2)). Read against "the date when it last was in effect", that means a terminated vendor's agreement stays in the file for six years after you leave it. Confirm your retention period, including any longer state rule, with your compliance adviser.

For the IT side of HIPAA, see Legend's page on HIPAA compliance support for dental practices. The agreements themselves are reviewed by your attorney or compliance adviser.

What happens to your patient data when you leave a vendor?

Your patients' information doesn't leave with you automatically. The business associate agreement should require the vendor to return or destroy it "if feasible", and to keep protecting anything it can't. Export your data first, cut the vendor's access the day service ends, ask for written confirmation of return or destruction, and record it in your register.

A dental practice's records rarely sit in one place. Each vendor holds its own copy, and copies multiply inside the vendor too: in its live system, its backups, its subcontractors, and sometimes in exports someone emailed months ago. HIPAA's answer is paragraph (ii)(J) of 164.504(e): at termination the vendor must, "if feasible, return or destroy all protected health information … that the business associate still maintains in any form and retain no copies", or, if that isn't feasible, "extend the protections of the contract to the information" and limit further use.

Two practical points follow. Before you sign with a cloud vendor, ask how your data will be returned at the end, in what format and how quickly, and make sure nothing in the terms stops you reaching your own records. An agreement can also say the vendor will send the data straight to your next vendor at termination, which is how a move between software vendors usually works; your attorney decides the wording.

The same steps apply when you change IT companies, which is where access tends to linger longest; our guide to switching IT providers covers the handover itself. If you are buying a practice, every one of these vendors comes with it, so ask for the register during IT due diligence when buying a practice. For the password side of offboarding, see our guide to password management for dental offices, and for the copies you keep yourself, the dental data backup and recovery guide.

What should you do when a vendor reports a breach?

When a vendor reports a breach, the business associate agreement is where its duties live. Read the agreement, write down when and how you were told, change any credentials the vendor could use, and ask for findings specific to your practice. Then bring in your compliance adviser or attorney, because the practice, not the vendor, usually notifies patients and HHS.

The rule sets an outer limit for the vendor's report: "without unreasonable delay and in no case later than 60 calendar days after discovery of a breach", including, "to the extent possible", the identity of each affected patient (45 CFR 164.410). The ADA summarises the next step: "It is the responsibility of the covered entity to notify the individual(s), the U.S. Department of Health & Human Services (HHS), and in some cases, the media."

A recent dental example shows how this looks in practice. On 9 September 2026 the Georgia Dental Association published an advisory after eAssist Dental Solutions, a billing vendor, told customers on 8 September that it was "investigating a potential information security incident." The GDA noted that eAssist had not confirmed any patient data was accessed and that a ransomware group's claim was unverified, and the advisory passed on advice to change practice-software, clearinghouse, claims-software and portal passwords, to keep all communications from eAssist, and to consult HIPAA compliance or legal advisers (GDA advisory). Our post on the eAssist billing-vendor incident walks through that case. Whether any vendor incident becomes a reportable breach for your practice is a question for your adviser, not for this page.

What to ask your IT provider about business associate agreements

Your IT provider is usually the vendor with the widest access, and often the one that knows which other vendors connect to your systems. Ask for short written answers, and read the same questions against any IT company you are considering; our comparison of dental IT support and general IT support explains why dental-specific answers matter here.

How Legend Networking can help

Legend Networking has 22+ years in dental IT (since 2004) and works with in-house engineers, with no outsourced first-level triage. On the IT side, the Free Dental IT Assessment reviews your computers, software, network security, backups and performance, with written findings and prioritized recommendations. We don't draft or review contracts; your attorney or compliance adviser does that.

The author, Ian Lynch, has 22 years in dental IT and oversees the NOC, onsite dispatch and client technology roadmaps. Legend holds a 4.8 rating from 173 Google reviews.