Business Associate Agreements in Behavioral Health: Reconciling the BAA File Against the Vendors You Actually Pay

Most behavioral health programs can produce a folder of business associate agreements on request. Far fewer can produce a folder that matches the vendors they actually pay. That gap, between the BAA binder and the accounts payable ledger, is where privacy findings, breach-response delays and payer audit questions tend to start. This guide is for operators who want a vendor file that answers one question: who else touches our client records?

This is operational guidance, not legal advice. Agreement language should be reviewed by counsel familiar with HIPAA and, for substance use disorder programs, 42 CFR Part 2.

What a Business Associate Agreement Actually Has to Do

A business associate is any person or company that creates, receives, maintains or transmits protected health information on your behalf to perform a function or service for you. In a behavioral health program, that usually means the EHR vendor, the billing company, the IT managed service provider, the cloud backup or email host, the answering service, the document shredding company and, increasingly, the marketing agency running call tracking. HIPAA requires a written agreement with each of them before PHI changes hands. The U.S. Department of Health and Human Services publishes guidance on business associates and sample business associate agreement provisions that are a useful baseline for checking what your templates contain.

In general terms, the agreement has to describe what the vendor may and may not do with the information, require appropriate safeguards, require the vendor to report breaches and other security incidents back to you, require the vendor to push the same obligations down to its own subcontractors, and address what happens to the information when the relationship ends.

The 60-day ceiling most programs misread: Under the HIPAA Breach Notification Rule, a business associate that discovers a breach of unsecured protected health information must notify the covered entity without unreasonable delay and no later than 60 calendar days after discovery. For a behavioral health program, that 60 days is an outer limit, not a reasonable target, because the program has its own obligation to notify affected clients without unreasonable delay, and where the vendor is acting as the program’s agent, the vendor’s discovery date can be treated as the program’s discovery date. A BAA that simply repeats “60 days” can leave the program learning about a breach with little or no time left on its own clock, which is why many operators negotiate a much shorter vendor reporting window in the agreement itself.

Where BAA Files Break in Behavioral Health

When we reconcile vendor agreements, the failures repeat. They are filing and ownership problems, not exotic legal questions.

• Vendor sprawl without intake: New tools are bought on a department credit card, such as a texting platform, an e-fax line or a scheduling app, and nobody routes the purchase through compliance before PHI starts flowing.
• Click-through agreements nobody saved: Many software vendors offer a BAA only as an online acceptance or an account setting, and the program cannot later show who accepted it, when, or which version applied.
• Agreements signed by an entity that no longer exists: After an acquisition, rebrand or change of ownership, the BAA is still in the name of the old legal entity, or the vendor has been acquired and its paper still references the former company.
• Template language that ignores Part 2: A standard HIPAA BAA does not, by itself, contain the commitments required when the vendor receives substance use disorder treatment records protected by 42 CFR Part 2.
• Breach reporting buried in boilerplate: The reporting window, the contact to notify and the information the vendor must provide are left vague, so a real incident turns into a scramble to interpret the contract.

The Part 2 Layer: Qualified Service Organization Agreements

If your program is a federally assisted substance use disorder program, records that identify a client as receiving SUD treatment carry protections under 42 CFR Part 2 that sit on top of HIPAA. When a vendor provides services to the program, such as billing, data processing, lab analysis or IT support, and needs access to those records, the usual mechanism is a qualified service organization agreement. In general terms, the vendor must acknowledge in writing that it is fully bound by Part 2 when handling the records and agree to resist efforts in judicial proceedings to obtain access to them except as Part 2 permits.

HHS finalized significant revisions to Part 2 in 2024 that aligned many of its provisions more closely with HIPAA, with a compliance date of February 16, 2026. The HHS fact sheet on the Part 2 final rule is the right starting point for what changed. Alignment did not make the QSOA disappear. In practice, the cleanest approach we see is a single combined agreement, a BAA with a Part 2 QSO addendum, for every vendor that touches SUD records, rather than two separate documents that drift out of sync.

What We See When We Pull the Vendor List

The single most useful exercise in this area is also the least glamorous: compare the BAA folder against twelve months of accounts payable. It almost always surfaces vendors nobody thought of as business associates. The ones we most commonly find without a current agreement are the after-hours answering service, the e-fax provider that receives referral packets, the shredding company, the IT contractor who has administrator access to the EHR, and the marketing or call tracking vendor that records inbound calls where prospective clients describe their substance use and insurance details.

That last category deserves attention. A recorded admissions call in which a caller names a drug, a diagnosis and a payer is health information about an identifiable person. Programs that would never send a chart to a marketing agency are sometimes sending something close to it every day through call recordings, and the agency’s standard contract is a marketing services agreement with no privacy terms at all.

The other inconvenient finding is ownership. In most programs we review, no one person is named as accountable for the vendor agreement inventory. The office manager signs some, the CFO signs others, IT accepts click-throughs, and the compliance officer learns about a new vendor when it appears in an incident report.

The Vendor Reconciliation to Run This Week

Most single-site programs can finish this in an afternoon.

1. Pull twelve months of vendor payments from accounts payable and corporate card statements, and export the list of active users and integrations from your EHR.
2. Flag every vendor that could see, store or transmit client information, including phone, fax, texting, email, backup, IT support, billing, transcription, shredding, call tracking and any AI documentation tools.
3. Match each flagged vendor to a signed agreement and record the signing entity, the date, the version and where the executed copy lives. If the BAA was a click-through, take a dated screenshot of the account setting or acceptance record and file it.
4. Check the breach reporting clause in each agreement: the reporting timeframe, who at your program gets notified, and what details the vendor must provide.
5. For SUD programs, confirm Part 2 language for every vendor that receives SUD records, either in a QSOA or a combined BAA and QSO addendum.
6. Name one owner for the inventory and add a rule that no vendor receives client information until that owner confirms the agreement is on file.

Not Every Vendor Needs a BAA

Disclosures to another health care provider for treatment purposes, such as an outside psychiatrist or a hospital accepting a transfer, generally do not require a BAA, although Part 2 consent rules may still apply to SUD records. Entities that merely transport information without accessing it in the ordinary course, the classic example being the postal service, are treated differently from vendors that store or process it. Cloud and software vendors that store PHI, even in encrypted form, are generally business associates. When a vendor’s status is unclear, document the reasoning and the date you reached it so a surveyor or investigator can see the decision was deliberate.

Keeping the File Fixed

HIPAA generally requires covered entities to retain required documentation for six years from the date it was created or last in effect, whichever is later. For vendor agreements, that means keeping the executed BAA, any amendments and the termination record for six years after the relationship ends, not deleting the file when the vendor is replaced. Build the reconciliation into your annual compliance calendar, tie new vendor onboarding to a short intake form, and re-check the inventory after any change of ownership, EHR migration or new service line.

If you want a second set of eyes on your agreement inventory, Circa Behavioral’s compliance services team runs this reconciliation as part of privacy program reviews, and our fractional compliance officer service can own the vendor intake process on an ongoing basis. You can also start with our HIPAA compliance checklist. To talk through your current vendor list, call (888) 458-6619.

Talk to a Compliance Specialist

A vendor agreement gap rarely surfaces before an incident, an audit or a sale. Call Circa Behavioral at (888) 458-6619 or contact our team to schedule a privacy program review.