Which of your marketing vendors actually needs a BAA

Most practice owners know they need a Business Associate Agreement with their practice management software. Fewer have thought carefully about the recall vendor, the answering service, the review tool, or the company printing their postcards.

The test is not whether a company feels like a healthcare company. It is whether they create, receive, maintain or transmit protected health information on your behalf.

What counts as patient information here

This trips people up because the data involved looks harmless. A spreadsheet of names and phone numbers does not feel like a medical record.

But a list of your patients is, by itself, protected. The fact that a named person is a patient of your practice is health information. Add “overdue for a cleaning” and you have told the recipient something about their care.

So the recall list you hand a vendor is PHI. The appointment reminder with a name and a date is PHI. The mailing file that goes to a print shop is PHI.

Walk your own vendor list

Sit down with whoever runs your front office and go through every system that touches a patient name. For each one, ask two questions. Does this vendor hold or move patient data? And do we have a signed BAA with them?

The usual suspects in a dental practice:

• Practice management software. Almost always covered. Check anyway.
• Recall and reactivation vendor. They have your overdue list. Needs one.
• Answering service or AI receptionist. Callers say their names and why they are calling. Needs one.
• Review request tool. It knows who was seen and when. Needs one.
• Print and mail vendor. Your mailing file is a patient list. Needs one.
• Any AI model in the chain. If a vendor pipes call transcripts or patient names through a language model, that model’s provider is part of the chain too. This one gets missed constantly.

That last point is the newest and the least discussed. A vendor can hold a perfectly good BAA with you and still be sending your patients’ details to a subprocessor that has not signed anything.

The question worth asking out loud

Ask any vendor pitching you: “Will you sign a BAA, and will you show me that every subprocessor in the chain is covered by one?”

A vendor who answers quickly and specifically has done the work. A vendor who says “we’re HIPAA-compliant” and moves on has told you nothing. There is no certification body. The phrase is not a credential, it is a claim about practices.

We hold ourselves to the same standard. Our own BAA chain has to be complete before we make that claim publicly, which is why you will not see a compliance badge anywhere on this site.

Where the real risk shows up

The expensive mistakes are usually not data breaches. They are ordinary moments of helpfulness.

New Vision Dental, a California practice, settled with the HHS Office for Civil Rights for $23,000 after responding to Yelp reviews with details about the reviewers. The intent was to correct the record. The effect was disclosing patient information in public.

The rule that prevents it is simple enough to put on a card by the front desk computer. Never confirm in public that someone is a patient. Not in a review reply, not in a social media comment, not in a response to a complaint. Every specific response happens by phone.

What to do this week

Pull your vendor list. Find the ones without a signed BAA. Email each of them and ask for one.

Then ask your recall vendor and your phone vendor who else in their chain touches the data. If they cannot answer in a sentence, that is your answer.

We sign a BAA with every practice before we touch patient data, and the report on this site deliberately asks for counts only so that there is nothing sensitive in it at all.

Not legal advice

This is a practical walkthrough, not legal guidance. HIPAA obligations depend on your specific arrangements. Your attorney and your compliance adviser should see your actual vendor list.