The first BAA makes you a business associate. Now every client — and every subcontractor — needs one.
Every covered-entity client and every subcontractor that touches PHI now needs a BAA before work starts — and you must be able to produce each one.
Where this goes.
Your first clinic, practice or billing client asks for a BAA before you touch their systems. You get one drafted; it goes out as an attachment.
The office manager forwards it, someone signs a version, and the next client gets the same document the same way. Your own subcontractors need one from you too.
OCR made vendor accountability its 2026 enforcement priority. The HIPAA Security Rule update is still proposed, not final — if it lands, it adds more to re-paper. Either way the question is the same: which contract, which date, which text.
A client’s compliance officer, or an OCR investigator, asks for the BAA — its date, and its exact text.
Or nobody waits: the migration starts anyway, on no BAA at all.
“Accept terms” is not “Sign.”
Same terms, a different reflex. A request to sign enters legal routing and invites redlines; a page your client accepts says “standard”, and the business owner who said yes stays the owner.
Your clients already do this every day — Meta, Google and TikTok Ads terms are accepted by click. See the same DPA sent both ways →
Three things to do before the next client.
Keep the negotiated BAA for the hospital system that imposed its own — that is a contract.
Put your standard BAA on a page: the text you would send any practice, and the one you send your subcontractors. No PHI enters Pacts — only the agreement and who accepted it.
Send the next client a link, not an attachment; the record is written before access is granted, and the board shows who is covered.
Put one standard agreement on Pacts today. Free for 3 standard terms and 5 clients — no card, no time limit.