Your IT Company Never Signed a BAA: How to Fix This HIPAA Exposure

Your IT company has had remote access to your server for years. They manage your network, troubleshoot your EHR, reset passwords, and probably have admin credentials to everything. And you just realized — or someone just pointed out — that you never signed a Business Associate Agreement with them. If this describes your practice, you are not alone. Missing IT vendor BAAs are one of the most common HIPAA gaps we encounter, and they represent one of the most straightforward violations for OCR to identify and penalize.

Why Your IT Company Is a Business Associate

Under 45 CFR 164.502(e), a business associate is any person or entity that performs functions or activities on behalf of a covered entity involving the use or disclosure of PHI. Your IT support company almost certainly qualifies because they:

• Have remote or physical access to servers, workstations, and network devices that store or process ePHI
• May access, view, or interact with ePHI during troubleshooting, maintenance, or system administration
• Manage backups that contain ePHI
• Configure security settings that control access to ePHI
• May have access to email systems that contain patient communications

The argument that “they don’t look at patient records” does not eliminate the BAA requirement. The standard is whether PHI is accessible to them, not whether they routinely view it. If an IT technician can see a patient name on a screen while troubleshooting, the BAA requirement is triggered. OCR has been explicit on this point.

The Violation You Already Have

Operating without a BAA where one is required is a standalone HIPAA violation under 45 CFR 164.502(e). It does not require a breach to occur. The absence of the agreement itself is the violation. OCR settlements for missing BAAs have ranged from tens of thousands to millions of dollars, depending on the scope and duration of the relationship.

In the 2024 settlement with Doctors’ Management Services, OCR specifically cited the failure to have appropriate business associate agreements as a contributing factor in a multi-million-dollar enforcement action. The message is clear: this is not a technical paperwork issue — it is a substantive compliance failure that OCR actively pursues.

How to Assess Your Current Exposure

Before you can fix the gap, you need to understand its scope. Work through these questions as part of your risk assessment:

1. How long has the IT company had access to systems containing ePHI? The duration of the relationship without a BAA affects your exposure level.
2. What level of access do they have? Administrative credentials to your EHR, remote desktop access to workstations, backup management, email administration — catalog everything.
3. Has there been any security incident during the relationship? If the IT company experienced a breach or security event while operating without a BAA, your liability is compounded.
4. Do they subcontract any work? If your IT company uses subcontractors who also access your systems, those entities are subcontractors under the BAA chain and need their own agreements.
5. What security controls does the IT company maintain? Encryption, access logging, employee background checks, security training — evaluate whether they meet HIPAA Security Rule standards.

The Remediation Plan: Step by Step

Fixing a missing BAA is not just about getting a signature on a document. It requires a structured approach:

Step 1: Execute the BAA Immediately

Draft or obtain a compliant BAA and get it signed. Do not use a one-page template you found online. The BAA must address all required elements under 45 CFR 164.504(e), including permitted uses and disclosures, safeguarding obligations, breach notification requirements, return or destruction of PHI at termination, and the obligation to make records available for an HHS audit.

Step 2: Conduct Due Diligence on the Vendor

Signing a BAA does not absolve you of the obligation to evaluate whether the business associate can actually comply with HIPAA. Request documentation of their security practices: encryption policies, access controls, employee training, incident response procedures, and insurance coverage. If they cannot demonstrate basic security competence, the BAA is not sufficient protection.

Step 3: Document the Gap and Your Remediation

Create a written record of the compliance gap, when it was identified, and every step taken to remediate it. This documentation is critical if OCR ever investigates. A practice that discovers a gap and promptly remediates it is treated very differently from one that ignored a known problem. File this documentation in your compliance program records.

Step 4: Review All Other Vendor Relationships

If your IT company was missing a BAA, there is a strong probability that other vendors are as well. Conduct a comprehensive vendor inventory: cloud fax services, answering services, cloud storage providers, billing companies, consultants, shredding services, and anyone else who may access PHI. Build a BAA tracking system so this gap does not recur.

Step 5: Evaluate Whether a Breach Has Occurred

The absence of a BAA does not automatically mean a breach occurred. However, if the IT company’s access to PHI was unauthorized under your policies (which it technically was, without a BAA), you may need to conduct a breach risk assessment to determine whether notification is required. Consult with legal counsel on this analysis.

What If the IT Company Refuses to Sign?

Some IT companies, particularly smaller local providers, may resist signing a BAA because they do not want to accept the compliance obligations it imposes. If your IT company refuses to sign a BAA, you have two options: find a new IT company that will sign, or accept ongoing HIPAA exposure. There is no third option. You cannot continue to allow an entity to access ePHI without a BAA in place, regardless of how long you have worked with them or how much you trust them.

In practice, most reputable IT companies that serve healthcare clients are familiar with BAAs and willing to sign. Resistance is often a signal that the vendor does not have the security infrastructure to support HIPAA compliance — which is itself a risk factor your practice should take seriously.

Preventing Future Gaps

Build vendor management into your ongoing compliance program. Maintain a centralized vendor inventory with BAA status, expiration dates, and last-reviewed dates. Include vendor due diligence in your annual risk assessment. Train staff to recognize when a new vendor relationship triggers a BAA requirement — before the vendor is given access, not after.

Frequently Asked Questions