HIPAA business associate agreement (BAA)

What it is

Under the United States Health Insurance Portability and Accountability Act, a covered entity (a provider, health plan or clearinghouse) may share protected health information with a business associate only under a written agreement that binds the associate to the Privacy and Security Rules. A voice agent answering a clinic's phone hears names, dates of birth, reasons for visits and insurance details. That makes the agent vendor a business associate, and it makes the vendor's own sub-processors (speech recognition, language model, text-to-speech, telephony, hosting) sub-contractors that must be bound by equivalent terms.

The agreement covers permitted uses, safeguards, breach notification, return or destruction of data, and flow-down to subcontractors.

Why it matters when buying

Two failure modes are common. A vendor signs an agreement but a component in the audio path (often the speech or language-model provider) is on consumer terms with no agreement and a right to train on the data. Or the agreement exists but the recordings and transcripts are stored in a region or a manner the clinic's security policy does not allow. Either way, the clinic is the covered entity and carries the exposure. This page is informational and not legal advice.

What to ask

Ask for the agreement with the full sub-processor list attached, and for confirmation that each sub-processor is bound. Ask for a no-training clause on patient audio and transcripts. Ask where recordings and transcripts are stored, for how long, and how they are deleted. Ask how the agent redacts sensitive data in logs. Hesitation on any of these ends the evaluation.