A BAA Is Not a Compliance Certificate

In healthcare procurement, “will you sign a BAA?” gets asked first and is often treated as the finish line. It’s the starting line.

What a BAA actually does

A business associate agreement is a contract. Under HIPAA, it requires the vendor to safeguard protected health information, use it only for permitted purposes, report breaches, and pass the same obligations down to its own subcontractors. That’s valuable. It creates accountability and a clear line of responsibility.

What it doesn’t do

A signed BAA doesn’t verify that the safeguards exist. It isn’t a certification. HHS doesn’t certify products or vendors as HIPAA compliant, so any badge that claims otherwise is marketing, not a regulator’s seal. Two vendors can sign identical agreements while running very different security in practice.

The subcontractor chain in voice AI

A single phone call can pass through telephony, speech-to-text, a language model, and a text-to-speech service. If a patient says anything identifying, each of those layers may touch PHI, and each needs to be covered. “We have a BAA with you” means little if the audio travels through three vendors who don’t have one with us.

Questions worth asking

Where is audio processed and stored? Which subprocessors handle it? How long are recordings and transcripts retained, and who can access them? What are the audit logs, and how fast will you be told about a breach?

A vendor who answers those clearly has done the work. A vendor who points back to the signature has only done the paperwork.

Oleksii Kocherev

CEO, Optima Voice

AI Voice Agents for Business, Education & Government

Originally published on Medium.