Why an MSP Needs One Before Day One
A BAA is not paperwork that follows the work. It precedes it. The moment your tools, your technicians or your backups can reach a healthcare client's patient data, you are a business associate under HIPAA, and starting without a signed agreement is a failure in its own right, separate from anything going wrong. It is also trivially easy to prove after the fact: the ticket history shows you working, and the contract file shows nothing.
The common trap is treating the BAA as the client's document to produce. A small dental practice may never have seen one and will happily let you start on Monday; a hospital system will send you its own and expect you to have read it. Either way the exposure is yours, so keep your own template ready and make it part of the 30 day onboarding checklist, before the RMM agent goes out.
What the Agreement Commits Your MSP To
Read a BAA as a list of operating promises your service desk has to keep, not as legal boilerplate. The clauses that change how you run the account are usually these:
- Using patient information only to deliver the services in your agreement, and never for your own purposes.
- Running the safeguards the Security Rule expects: access control, audit logging, encryption and a documented risk process.
- Reporting a breach or security incident to the client within the window the agreement sets, which may be shorter than you expect.
- Returning or destroying the data when the relationship ends, including backups and old drives.
- Flowing the same obligations down to anyone you pass the data to.
That last clause is the one MSPs miss. Your backup vendor, your MDR provider and any offshore help desk that can see client data are your subcontractors, and HHS guidance lists failing to sign BAAs with subcontractors as something a business associate is directly liable for.
Where MSPs Get Caught Out
| Situation | What to do |
|---|---|
| Client says they do not need one | Sign one anyway; your liability does not depend on their awareness. |
| Client sends a hospital template | Check the breach notice window and indemnity before signing, then set your ticket escalations to match. |
| You add a new security tool | Confirm the vendor will sign a BAA with you before it touches client endpoints. |
| The client leaves | Follow the return or destroy clause and record that you did. |
Also watch the indemnity and insurance clauses. Larger clients often ask you to cover their costs after a breach you caused, and that promise should be priced into the contract and checked against your cyber policy, not discovered at renewal. If healthcare is a vertical you want, see how HIPAA applies to MSPs for the wider obligations the BAA sits inside.
Common Questions
Do I need a BAA with my backup vendor?
Yes, if the vendor stores or can access client data containing patient information. You are responsible for flowing the obligations down to anyone you pass that data to.
Can I use my own BAA template?
Yes. Many smaller practices have none, and your own template lets you set terms your service desk can actually meet. Larger clients will usually insist on theirs.
Does a BAA replace my master services agreement?
No. The BAA sits alongside your MSA and covers patient information specifically. Keep them consistent, especially on liability and termination.
Should the BAA change my price?
Often it should. Faster breach notice, audit cooperation and indemnity all carry cost, and healthcare accounts are usually priced above a comparable general client.