Vendors and business associate agreements

Modern practice marketing runs on vendors: an agency, a website host, an email platform, a texting service, call tracking, review software, online booking. Some of them never see patient information. Others handle it every day, and those relationships need to be set up properly.

Which marketing vendors are business associates

Under HIPAA, a vendor that creates, receives, stores or transmits protected health information on the practice’s behalf is generally a business associate, and the practice needs a signed business associate agreement (BAA) before sharing that information. In marketing, that commonly includes:

• Email and texting platforms that hold your patient list.
• Call-tracking and recording services, since callers share names, insurance and symptoms.
• Review-request software connected to your practice software.
• Online booking, form and intake tools, and website hosts that store form submissions.
• Agencies that see patient lists, call recordings, form leads or your practice software.

A vendor that never touches patient information, such as a photographer shooting an empty office or a designer working on your logo, generally isn’t a business associate. When you aren’t sure, ask your privacy officer, and assume yes until someone has checked.

What a BAA does, and doesn’t do

A BAA is a contract in which the vendor agrees to protect the information, use it only for the services it provides you, report problems to you and pass the same obligations on to its own subcontractors. It is required, but it isn’t a guarantee. A BAA doesn’t make a vendor’s product appropriate for every use, doesn’t cover features you set up carelessly, and doesn’t remove the practice’s own responsibilities. A vendor that says it is “HIPAA compliant” but won’t sign a BAA shouldn’t receive patient information. Contract terms and ownership of your accounts are covered in the agency guide’s contracts and ownership chapter.

Keep a vendor list

A one-page list prevents most surprises. For each marketing vendor, record what it does, what patient information it touches, whether a BAA is signed and where it is filed, who at the practice manages it, and who has logins. Review it at least once a year and whenever you add or drop a vendor. When a relationship ends, remove the vendor’s access and ask for patient information to be returned or deleted, in writing.

When something goes wrong

Mistakes happen: a reply that says too much, a list sent to the wrong vendor, a pixel discovered on the booking page. Make it easy for staff to report them right away without fear, and have the privacy officer handle them:

1. Stop the problem: take the post down, remove the tag, cut off access.
2. Write down what happened, when, what information was involved and who saw it.
3. Talk to your privacy officer and a healthcare attorney promptly. HIPAA has breach notification rules, and state laws may add their own; whether and how they apply depends on the facts.
4. Fix the cause, update your policies and retrain the team.

This guide is general information, not legal advice. For your practice’s situation, talk to a healthcare attorney. The other compliance guides are on the compliance hub, and the free HIPAA marketing privacy checklist covers this guide on one page.