BAA Checklist for Martech and Customer Data Vendors

A business associate agreement (BAA) is the contract HIPAA requires before a vendor handles protected health information (PHI) for you, and a signature alone proves little. Test what is covered, which fields may hold PHI, sub-processors, key custody, logging, breach-notice speed, exit terms and the vendor's own use of your data, including AI training. Our 19-item BAA checklist (CSV) gives each question a good answer, a red flag and a HIPAA reference.

Who this is for: procurement, privacy, security and marketing operations teams evaluating a customer data platform (CDP), email, analytics, CRM or AI vendor. The healthcare hub links the related guides.

Why a signed BAA is the start, not the finish

A vendor that creates, receives, maintains or transmits PHI for you is a business associate 1. You may disclose PHI to it only with satisfactory assurance in a written contract that contains the terms of 45 CFR 164.504(e) 23. HHS runs no HIPAA certification program 1416, so "HIPAA compliant" on a website is a claim, not a credential. What vendors do publish is the scope of their BAAs, and the limits are instructive.

For AI-specific terms, see HIPAA-compliant ChatGPT and private LLM options.

How to use the checklist

1. Decide whether the vendor touches PHI. If you can redesign a flow to send only de-identified data 6, document that decision; no BAA is needed for data that is not PHI.
2. Attach the checklist to your RFP or security questionnaire. The customer data platform RFP template has a place for it.
3. Ask for documents, not answers: the signed BAA, covered-products list, sub-processor list, latest SOC 2 or ISO report, penetration-test summary, incident history and insurance certificate.
4. Score each item green, amber or red. Treat a red on items 1, 2, 4, 9, 10 or 12 as a block on signature.
5. Assign owners. Privacy: 1, 3, 11, 12, 14, 16. Security: 5 to 8, 13, 15. Legal and procurement: 9, 10, 17, 18. Vendor management: 4, 19.
6. Re-run at renewal and when scope changes. Salesforce changed its covered-services list on 18 March, 31 July and 30 September 2026 10.

The checklist at a glance

The CSV adds the reason each item matters, what a good answer looks like and the HIPAA reference. Download it from the BAA checklist page.

Common BAA negotiation points

Breach notice: contract versus the 60-day rule

HIPAA sets an outer limit: a business associate must notify the covered entity without unreasonable delay and no later than 60 calendar days after discovery 5. Your own notice to individuals has the same 60-day limit, and a breach is treated as discovered when it is known to a workforce member or agent, so a vendor acting as your agent can start your clock 5. Ask for 24 to 72 hours for confirmed breaches, define "security incident" (the Security Rule requires the contract to cover them 4), and specify what the notice must contain.

Sub-processors

Subcontractors must accept the same restrictions and conditions as the vendor 34. Ask for the list, the flow-down language, advance notice of changes and a right to object.

The vendor's own use of PHI

A business associate may use or disclose PHI only as the contract permits or the law requires 2. A BAA may allow use for the vendor's proper management and administration and legal responsibilities, and data aggregation services relating to your health care operations 3. Leave out de-identification for the vendor's own purposes unless you decide to allow it, and prohibit model training in the BAA itself, not only in a privacy page.

Exit

The BAA must provide for return or destruction at termination where feasible, and extended protections where not 3. Add a time limit, open export formats, destruction of backups, a certificate and no export fees. The cloud exit strategy template and vendor lock-in clauses cover the commercial side.

Liability and insurance

HIPAA is silent here, so it is commercial. Push for a separate, higher cap or an uncapped indemnity for data breaches, reimbursement of notification and monitoring costs, and evidence of cyber insurance.

Location and offshore access

OCR's 2016 cloud guidance, as summarised by Mintz, says HIPAA does not prohibit storing ePHI abroad but the risk analysis should account for it 8. Name regions and approved support locations in the contract.

Order of precedence and scope drift

Make the BAA prevail over the master agreement and data protection addendum for PHI. Require notice when the covered-products list changes, and a right to terminate if coverage shrinks.

If the vendor will not sign

No BAA, no PHI. Your options are to redesign the flow so no PHI reaches the vendor; to de-identify under Safe Harbor or Expert Determination, or share a limited data set under a data use agreement for permitted purposes 6; to choose a vendor that signs; or to host the system yourself. Self-hosting removes the vendor from the PHI path, but a third party that hosts the hardware is still a business associate, and the conduit exception is narrow 7. See HIPAA-compliant customer data platforms for how deployment models differ, and pixels after the HHS guidance for the tracking case.

Checked 2026-10-17 unless noted.

Download the BAA checklist (CSV) and attach it to your next vendor review. Return to the healthcare hub for related guides.