“Will you sign a BAA?” is usually the first question a health company asks a texting vendor, and it’s the right one to start with. The trouble is that a yes can feel like the end of the HIPAA conversation. It’s closer to the beginning.
What follows is general information in plain language, not legal advice. For questions about your own company, your compliance advisor or a healthcare attorney is the right person to ask.
Who needs one, and why a texting vendor counts
HIPAA applies to covered entities: health plans, clearinghouses and health care providers that handle certain transactions electronically, such as billing insurance. Clinics, pharmacies, labs, imaging centers and home health agencies that bill insurers are usually covered entities. Other companies in health, like some staffing agencies, wellness brands or software firms, may not be, or may be business associates of someone else. Where your company sits is a question for your advisor, and it’s worth asking before you choose a texting setup.
For a covered entity, a vendor that creates, receives, keeps or transmits protected health information on its behalf is a business associate. A texting vendor fits that description. A text that ties a person’s name and number to an appointment, a prescription or a home visit is health information about that person, and the vendor’s systems carry it.
HIPAA requires a written agreement with a business associate before protected health information is shared with it. That agreement is the BAA.
What the agreement asks of the vendor
The wording varies, but HIPAA sets out what a BAA has to cover. In plain terms, the vendor agrees to:
- use and disclose health information only as the agreement allows, which means for the work you hired it to do
- put safeguards in place to protect electronic health information, as the HIPAA Security Rule requires
- report to you any use or disclosure the agreement doesn’t allow, including breaches
- get the same commitments from its own subcontractors that handle the data
- make information available when you need it to answer a person’s request to see or correct their records
- return or destroy the information when the relationship ends, where that’s feasible
Since HHS updated the HIPAA rules in 2013, business associates have also been directly responsible under the law for some of these requirements. A vendor that signs a BAA takes on real obligations. That’s one reason some general texting tools only offer one on a higher priced plan, charge an extra fee for it or don’t say whether they sign one at all.
What it leaves with your company
This is the part that tends to get skipped. A BAA covers what the vendor does. It says nothing about the rest of your HIPAA program, and it can’t.
Your own program comes first. Your risk analysis, written policies, staff training and the person responsible for privacy are all still yours, and a vendor’s BAA doesn’t stand in for any of them.
What your staff write is also yours. The vendor protects a message in transit and in storage. It can’t stop a pharmacy tech from typing a medication name into a refill notice, or a scheduler from putting a client’s diagnosis in a shift request. What goes into a text is a training question, not a contract question.
Texts sent outside the vendor aren’t covered. The agreement applies to messages that go through the vendor’s system. A staff member who answers someone from a personal phone is outside it, and so is a manager texting caregivers from a consumer app.
People’s preferences matter too. HIPAA gives patients the right to ask for communications by other means or at other locations, for example not by text, or only at a different number. Covered entities have to accommodate reasonable requests, and your team needs a way to see them.
Finally, texting has rules beyond HIPAA. Text messages also fall under carrier rules and federal telephone consumer law, both of which deal with consent and opting out. A BAA doesn’t address either. That’s why a consent record for each contact, automatic STOP handling and quiet hours matter separately from the agreement.
Why “HIPAA certified” deserves a question
HHS doesn’t certify vendors as HIPAA compliant, and there’s no official HIPAA certification for software. Some vendors hold third-party security audits, which can be worth asking about, but those aren’t a HIPAA certification either. When a vendor uses the phrase, ask what it means by it. A signed BAA and a clear description of safeguards tell you more.
Questions to ask before you sign
A short list covers most of what matters:
- Do you sign a BAA on the plan we’re buying, or only on a higher tier, and is there an extra charge?
- When is it signed, and who signs it on your side?
- Which subcontractors handle our texts?
- How will you tell us about a breach, and how quickly? The HIPAA rules set an outer limit of 60 days from discovery for a business associate to notify a covered entity, and many agreements promise sooner.
- What happens to our message history if we cancel?
- If your product uses AI, can it send anything to a patient, client or employee on its own?
The last question isn’t in any HIPAA rule. Ask it anyway, because a message nobody on your team read is a message nobody can stand behind.
A BAA is the floor
A BAA is a promise from the vendor about how it treats the health information in your texts. You need one, and you shouldn’t text patients or clients through a vendor that won’t sign it. It also binds exactly one party. Your policies, your training and the habits of the people typing the texts are still the bigger share of the work.
SMSWell signs a BAA with every customer on every plan at no extra charge, keeps a consent record for each contact and stops texting anyone who replies STOP. Read how SMSWell protects your texts.