Dental practices routinely share patient information with outside vendorsβbilling services, cloud software providers, IT support, and answering services. Whenever one of these vendors creates, receives, maintains, or transmits protected health information (PHI) on a practice's behalf, HIPAA requires a written Business Associate Agreement (BAA) before that sharing occurs. This is one of the most frequently overlooked compliance obligations in dental offices, and getting it wrongβin either directionβcreates liability.
What Counts as a Business Associate?
Under HIPAA, dentists must have a compliant written business associate agreement in place with each of their HIPAA business associates, defined as an outside person or entity that does something for or on behalf of a covered entity that requires access to patient information. Common examples include dental practice management software vendors, cloud storage providers, billing companies, and IT support contractors.
A frequently misunderstood exception involves dental labs. Under HHS OCR guidance, dental labs are classified as healthcare providers rather than business associates, so a BAA is not required to share PHI with a lab for patient treatment purposes. Similarly, referring practices and janitorial staff who don't access PHI as part of their role generally fall outside the BA definition.
What the Agreement Must Include
A BAA is not just a formalityβit establishes legal obligations. A typical BAA outlines the permitted uses and disclosures of PHI, required safeguards for protecting it, breach and security incident reporting obligations, the requirement to comply with applicable HIPAA regulations, assurance that subcontractors will also comply, and the process for terminating the agreement and returning or destroying PHI.
Vendors aren't off the hook once the relationship ends, either. Upon the end of a business associate agreement, the associate must return or destroy PHI, retaining no copies unless it's infeasible.
Why This Matters: Shared Liability
Since the HITECH Act, business associates face direct accountability. Business associates are now subject to the same civil and criminal penalties as covered entities for HIPAA violations and must comply with many HIPAA requirements. That doesn't remove responsibility from the practice, thoughβif a vendor is breached, the dental office still owns much of the response.
Email and Digital Communication
Many practices unknowingly violate HIPAA through everyday communication tools. Standard consumer email platforms are not HIPAA-compliant by default, and to use email for ePHI the provider must sign a Business Associate Agreement and offer end-to-end encryption; Google Workspace and Microsoft 365 both offer compliant configurations, but default consumer versions do not qualify.
Breach Notification Timelines
BAAs should also spell out what happens when something goes wrong. If a business associate such as a billing company, IT provider, or cloud storage service discovers a breach involving a practice's patients, it must notify the practice within 60 days of discovery, after which the practice owns the notification obligation to patients and OCR.
Practical Steps for Compliance
- Inventory every vendor that touches patient data, including software, billing, and storage providers.
- Confirm a signed, current BAA exists for each qualifying vendor before sharing PHI.
- Include specific breach notification timelines directly in the agreement language.
- Retain signed BAAs and related compliance documentation as part of your HIPAA records.
- Review vendor relationships periodically, since staffing and software changes can quietly create new business associates.
A missing or outdated BAA rarely causes problems until a vendor breach occursβat which point the absence of a clear agreement can significantly complicate a practice's liability and response obligations. Building a routine vendor review into your compliance calendar is a straightforward way to close this gap before it becomes a costly one.