Free HIPAA tool

Do I need a BAA with this vendor? A four-question checker

Every vendor that handles patient information for you needs a business associate agreement before it gets the data. Most practices have more of those vendors than they think, and a few they'd never guess. Answer four questions about any vendor, then check our list of who signs.

Take the 3-minute Cyber Hygiene Test

By the AccuSights compliance team. Updated October 2026. Every figure is quoted from a source listed at the end of the page.

Who signs, and who doesn't

From the vendors' own documentation, checked in October 2026. Terms change; confirm with the vendor before relying on any line.

Whether common vendors offer a HIPAA business associate agreement
Vendor	BAA?	Condition
Microsoft 365, Azure	Yes	Included by default in the Data Protection Addendum for covered entities and business associates
Google Workspace, Google Cloud	Yes	Accepted by a super admin in the Admin console; not the legacy free edition, non-admin users or consumer Gmail
AWS	Yes	Self-service through AWS Artifact; PHI only in HIPAA-eligible services
Zoom	Yes	A standard BAA exists; plan eligibility isn't stated publicly, so ask
Slack	Yes	Enterprise plan only, and not for communicating with patients
Dropbox	Yes	Standard, Business, Advanced, Business Plus and Enterprise; not consumer plans
Box	Yes	Enterprise, Enterprise Plus and Enterprise Advanced accounts
Notion	Yes	Enterprise plan only
HubSpot	Yes	Enterprise subscriptions with Sensitive Data enabled; accepted in-product
Twilio	Yes	Security or Enterprise edition, HIPAA-eligible products only
DocuSign	Yes, by agreement	DocuSign describes itself as a business associate for healthcare customers; the plan isn't stated publicly, so ask
Calendly	No	Calendly says it doesn't offer a BAA and isn't intended for PHI
Mailchimp	No	Terms put HIPAA suitability on you and disclaim liability; no BAA is offered on its site
Stripe	No	Its agreement prohibits sending it PHI
Zapier	No	States it doesn't offer a BAA
Canva	No public BAA	Nothing on its compliance pages; assume no

The vendors practices forget

The e-fax service. It stores every fax. Business associate.
The copier lessor, if it services the machine and can access the drive.
The appointment reminder and review-request platform. It has the patient list.
The answering service that takes after-hours calls.
The accountant or lawyer who sees records in the course of their work.
Your own subcontractors, if you're a business associate. The chain doesn't stop at you.

What goes in the agreement

HHS publishes sample provisions, and most large vendors have their own form. Either way it must cover permitted uses and disclosures, safeguards and Security Rule compliance, reporting of breaches and incidents, flow-down to subcontractors, support for patient rights, return or destruction of PHI at the end, and termination for breach. The negotiable parts are the reporting window, audit rights, insurance and indemnities. See HIPAA for business associates for the vendor's side of the table.

With AccuSights: the business associate inventory lives in the platform with the agreement, the owner and the renewal date for each vendor, reminders go out before anything lapses, and the whole list is one tab of the documentation pack when OCR or a customer asks.

Quick questions

What is a business associate agreement?

A contract required by HIPAA between a covered entity and any vendor that handles its protected health information, or between a business associate and its subcontractors. It sets out permitted uses, safeguards, breach reporting, patient rights support, subcontractor flow-down and what happens to the data at termination. The required terms are in 45 CFR 164.504(e) and 164.314(a).

Do I need a BAA with my cloud provider?

Yes. HHS's cloud guidance says a cloud service provider that stores ePHI is a business associate even if the data is encrypted and the provider holds no key. AWS, Microsoft and Google all provide BAAs; using them without one is a violation on its own.

Which vendors won't sign a BAA?

Among common tools, Calendly, Mailchimp, Stripe (which prohibits sending it PHI), Zapier and Canva don't offer one. Slack and Notion offer BAAs only on Enterprise plans; HubSpot on Enterprise with sensitive data enabled; Twilio on its Security or Enterprise editions; Box on Enterprise plans; Dropbox on Standard and above. Check the vendor's current terms before relying on this list.

Is my IT company a business associate?

Yes, if it has administrative access to systems holding patient information, runs your backups, or hosts your data, even if it never opens a record. The same applies to a managed service provider, a remote support vendor and a cloud backup service.

Do I need a BAA with another doctor's office?

No. Disclosures between covered entities for treatment don't require a BAA; both are directly bound by HIPAA. A BAA is for vendors acting on your behalf, not for other providers caring for the same patient.

Three on the same thread, then every HIPAA guide.

you're in the pond tooHIPAA for business associates the BAA is in the admin console, not the inboxGoogle Workspace and HIPAA the BAA ships in the box; the settings don'tMicrosoft 365 and HIPAA

Who it applies to

Rules, risk and OCR

Costs, software and tools

Security Rule, clause by clause

The HIPAA overview

Sources

Rules, figures and enforcement examples on this page were checked against these in October 2026. Regulations and prices change, so confirm before you rely on them.

Written by the AccuSights compliance team and updated October 2026. Figures are quoted from the sources named here and were current when checked. This page is general information, not legal advice.

Next step

Want your whole vendor list sorted and the BAAs tracked?

A business associate inventory with the agreement, owner and renewal date for each, built with your engineer. One fixed fee.