Answered by Noah Watson · Updated 2026-10-15
Do I need a BAA to use AI tools in my practice?
Only if protected health information reaches the tool. If the workflow never sends identifying patient data, the workflow itself is what keeps you safe, and the agreement never comes into it.
What a BAA actually does
A Business Associate Agreement is a contract in which a vendor agrees to protect the patient information you share with it. HIPAA requires one with any vendor that handles protected health information on your behalf.
There is no government certification for HIPAA compliant software. When a vendor calls itself compliant, what it usually means is that it will sign a BAA. That matters, but only for data you actually send it.
When you need one
You need a BAA when the tool stores, reads or processes patient information: an AI scribe, a tool that drafts replies to patient messages, a system that reads intake forms.
You do not need one for work that never touches a patient record: marketing, content, internal policies, scheduling templates, training material.
The safer design
The strongest setup is one where identifying information is removed before anything reaches an AI tool, so the practice is not depending on a contract to cover a mistake. That is how I build everything.
It also means I never handle patient information myself, so I am not a business associate of the practice and do not sign BAAs. If a practice does need a tool that reads patient records, such as an AI scribe, the practice signs the BAA directly with that vendor.
Want this set up for your practice? See how I do it.