> ## Documentation Index
> Fetch the complete documentation index at: https://mso.getlemma.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Put a BAA in place between MSO and PC

> Why the MSO is a business associate, what the BAA must contain under 45 CFR 164.504(e), subcontractor BAAs, and building a BAA inventory.

The PC is a HIPAA covered entity. The MSO handles protected health information on the PC's behalf, which makes it a **business associate**, and a written **business associate agreement (BAA)** is required before the MSO touches any PHI.

## Prerequisites

* Both entities formed
* A privacy officer identified for the PC
* An inventory of every vendor that will handle PHI

## Who needs a BAA with whom

```mermaid theme={null}
graph TB
    PC["PC, covered entity"]
    MSO["MSO, business associate"]
    EHR["EHR vendor"]
    CH["Clearinghouse"]
    BILL["Billing service"]
    HOST["Hosting / cloud"]
    STMT["Statement vendor"]
    BANK["Bank, generally NOT a BA<br/>for payment processing"]

    PC -->|BAA| MSO
    MSO -->|subcontractor BAA| EHR
    MSO -->|subcontractor BAA| CH
    MSO -->|subcontractor BAA| BILL
    MSO -->|subcontractor BAA| HOST
    MSO -->|subcontractor BAA| STMT
    PC -.no BAA needed.-> BANK
```

<Tip>
  **Banks are generally not business associates for ordinary payment processing.** HIPAA excludes financial institutions' payment activities from the business associate definition. That is why you don't need a BAA to receive payer EFTs, and also why you must **never put PHI in a bank memo field**, because the exclusion covers processing payments, not receiving clinical data.
</Tip>

## What the BAA must contain

The required elements are specified at 45 C.F.R. § 164.504(e).<sup>1</sup> A compliant BAA must:

| Requirement                                                                                                                                                           |
| --------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Establish the **permitted and required uses and disclosures** of PHI by the business associate                                                                        |
| Provide that the BA will **not use or disclose** PHI other than as permitted or required by the contract or by law                                                    |
| Require the BA to use **appropriate safeguards**, and to comply with the Security Rule with respect to electronic PHI                                                 |
| Require the BA to **report** to the covered entity any use or disclosure not provided for by the contract, including breaches of unsecured PHI and security incidents |
| Require the BA to ensure that **subcontractors** that create, receive, maintain, or transmit PHI agree to the same restrictions and conditions                        |
| Require the BA to make PHI available for **individual access**, **amendment**, and **accounting of disclosures** as required                                          |
| Require the BA to make its internal practices, books, and records available to **HHS** for compliance determination                                                   |
| Require **return or destruction** of PHI at termination, where feasible                                                                                               |
| Authorize **termination** by the covered entity if the BA violates a material term                                                                                    |

## Steps

<Steps>
  <Step title="Execute the MSO–PC BAA before the first patient">
    Not after go-live. The MSO handles PHI from the moment it operates scheduling or billing.

    **One BAA per PC.** Each professional entity is a separate covered entity. A ten-PC group has ten BAAs with the MSO.
  </Step>

  <Step title="Inventory every vendor that touches PHI">
    Walk the data flow:

    * EHR / practice management
    * Clearinghouse
    * Billing service or RCM vendor
    * Cloud hosting and infrastructure
    * Patient statement and communication vendors
    * Answering service, transcription, interpretation
    * Analytics and data warehouse tooling
    * **AI and LLM providers, and any model gateway or proxy**
    * Document storage and shredding
    * Collections agency
    * IT support with system access

    **A denial analytics warehouse built from 835 data holds PHI.** Teams building it as a finance project routinely miss the BAA, the encryption requirement, and its inclusion in the risk analysis. See [HIPAA for MSO-PC operators](/concepts/compliance/hipaa-fundamentals).
  </Step>

  <Step title="Execute subcontractor BAAs">
    The MSO, as a business associate, must have BAAs with its own subcontractors. Those subcontractors are business associates in their own right and are **directly liable** under HIPAA.
  </Step>

  <Step title="Read the vendor's BAA rather than signing it unread">
    Most vendors present their own form. Check:

    * Breach notification timeline — **is it short enough for the PC to meet its own 60-day deadline?**
    * Whether the vendor may use PHI for its own purposes such as product improvement, and whether that is acceptable
    * Indemnification and liability caps
    * Whether subcontractors are permitted and how they're controlled
    * Return or destruction obligations at termination
    * Where data is stored, including offshore
  </Step>

  <Step title="Build the BAA inventory">
    A single register: vendor, what PHI they handle, BAA execution date, renewal or review date, breach notification window, and the internal owner.
  </Step>

  <Step title="Review annually and on every new vendor">
    Add to the compliance calendar. See [Set up your compliance calendar](/start/first-90-days/compliance-calendar).
  </Step>
</Steps>

## Verify it worked

* [ ] A BAA between the MSO and **each** PC, executed before PHI was handled
* [ ] All nine required elements present
* [ ] Every PHI-handling vendor identified
* [ ] Subcontractor BAAs executed
* [ ] Breach notification windows short enough to meet the covered entity's deadline
* [ ] BAA inventory maintained with review dates
* [ ] Analytics and data warehouse infrastructure included
* [ ] No BAA sought with the bank for ordinary payment processing, and no PHI in bank fields

## Common failure modes

| Failure                             | Consequence                                       |
| ----------------------------------- | ------------------------------------------------- |
| BAA signed after go-live            | PHI handled without an agreement in place         |
| One BAA for a multi-PC group        | Each PC is a separate covered entity              |
| Vendor BAAs signed unread           | Long breach windows; PHI used for vendor purposes |
| Breach notification window too long | The PC cannot meet its own 60-day deadline        |
| Subcontractors missed               | Gaps in the chain                                 |
| Analytics warehouse omitted         | Unprotected PHI store                             |
| No inventory                        | Nobody knows the gaps until a breach              |

## Sources

1. 45 C.F.R. § 164.504(e). [eCFR](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.504). HHS OCR, [Business Associate Contracts](https://www.hhs.gov/hipaa/for-professionals/covered-entities/sample-business-associate-agreement-provisions/index.html).


## Related topics

- [Build a minimum viable HIPAA program](/guides/compliance/build-a-hipaa-program.md)
- [Draft the management services agreement (MSA)](/guides/agreements/draft-a-management-services-agreement.md)
- [HIPAA for MSO-PC operators](/concepts/compliance/hipaa-fundamentals.md)
- [LLMs, zero data retention, and HIPAA](/concepts/compliance/llms-and-zero-data-retention.md)
- [The complete agreement stack (checklist)](/reference/legal/agreement-stack-checklist.md)