A business associate agreement (BAA) is the contract that binds a vendor to HIPAA’s privacy and security rules when it handles protected health information (PHI) for a covered entity, such as a health system, clinic or health plan. For AI medical interpreting, that contract carries extra weight because every conversation the platform hears is spoken PHI: diagnoses, medications, names and family details. A signed BAA is necessary, yet it is only the starting point. Health systems also need to know where audio and transcripts travel, which subcontractors touch them and how long they stay. This guide covers what to require, what to verify and who should own each step.
TL;DR: An AI medical interpreting vendor that processes spoken PHI is a business associate and needs a signed BAA. The BAA should define permitted uses (including model training), bind every subcontractor, set incident reporting timelines and require return or destruction of data at contract end. A BAA alone does not prove security, so health systems should also request independent attestation such as SOC 2 Type II and confirm how the platform is governed day to day.
Do AI medical interpreting vendors need a business associate agreement?
Yes, when the vendor creates, receives, maintains or transmits PHI on the health system’s behalf, which an AI interpreting platform does by design. Legal counsel should confirm the specifics for each deployment.
When an AI platform becomes a business associate
HHS describes a business associate as an organization that performs a function or service for a covered entity involving PHI (HHS guidance on business associates). Its separate cloud computing guidance confirms that cloud providers storing PHI qualify as well, even when they cannot view the data. An AI interpreting platform goes further than storage: it listens to the encounter, converts speech in real time and may produce transcripts or bilingual documents. Each of those functions touches PHI, so the business associate relationship applies from the first conversation.
Why the subcontractor chain matters
HHS treats a subcontractor that handles PHI for a business associate as a business associate itself. The business associate must sign a BAA with that subcontractor before sharing PHI, while the covered entity does not need a direct contract with each one. For AI interpreting, speech recognition, language models and cloud hosting may each sit in that chain. The health system sees the chain only if the vendor discloses it, so the question belongs in procurement from day one.
What should a BAA for an AI interpreting vendor say?
A strong BAA defines permitted uses of PHI and requires safeguards that match the HIPAA Security Rule. It also binds subcontractors to the same terms, sets incident reporting duties and states what happens to data when the contract ends. HHS publishes sample provisions covering each of these areas (HHS sample business associate agreement provisions). They are a reference point rather than mandatory language. State law may add requirements.
What HIPAA requires in every BAA
The HIPAA Privacy Rule sets the minimum content of a BAA in 45 CFR 164.504(e). The agreement must state the permitted uses of PHI and require the vendor to use appropriate safeguards. It must also require the vendor to report unauthorized uses and breaches and to bind subcontractors to the same terms. The vendor must make PHI available for patient access, amendment and accounting requests and open its records to HHS. Finally, the BAA must require return or destruction of PHI at contract end and let the covered entity terminate the agreement for a material violation. The sections below cover where AI interpreting needs more than this minimum.
Permitted uses and model training
The agreement should say exactly what the vendor may do with PHI. For AI platforms, one point deserves its own sentence in the contract: whether audio, transcripts or data derived from them may be used to train or improve models. If the answer is no, the BAA should say so in plain language. If the answer is yes, the health system should know the conditions and who approves the use.
Subcontractors and AI model providers
Ask for a current list of every subcontractor that touches PHI, with the function each one performs. Confirm that each has accepted the same restrictions through its own BAA. Ask how the vendor notifies customers before adding a new one so the list stays accurate after signature.
Incident reporting
The HHS sample provisions require the business associate to report unauthorized uses or disclosures, including breaches of unsecured PHI and security incidents. They also let the parties agree on a stricter timeline. A health system’s privacy officer can set that timeline to match its own breach response process so the vendor’s clock and the organization’s clock agree.
Return or destruction at contract end
HHS notes that the business associate should return or destroy PHI at termination if feasible and that its obligations survive the contract. Ask what “feasible” means for audio files, transcripts and logs. Request written confirmation when deletion is complete.
Four gaps to check before signature
Four gaps are easy to miss when a review focuses only on the template.
- The model training clause is missing. Standard templates were written before AI platforms existed, so they may not address training or improvement uses at all.
- The subcontractor list is out of date. A list attached at signing can age quickly. Ask for a notification process, not only a snapshot.
- Encounter scope is undefined. A BAA that does not match how the platform will really be used, such as front desk calls or telehealth, leaves room for disagreement later.
- Exit terms are vague. Contract end is the moment when data handling matters most, so it deserves specific language and a named confirmation step.
What does a signed BAA not tell you?
A BAA assigns responsibility. It does not prove that the vendor’s controls work. Health systems close that gap with independent evidence and with the safeguards the HIPAA Security Rule expects for electronic PHI, which span administrative, physical and technical measures (HHS summary of the HIPAA Security Rule).
Independent attestation
A SOC 2 Type II report comes from an independent auditor who tests a vendor’s controls over a period of time, not only on a single day. It gives security teams something concrete to read. No Barrier delivers AI-first medical interpreting in the same interface on a flat monthly subscription that replaces per-minute billing. The platform is deployed across 300+ medical sites in 17 US states. It is HIPAA compliant and SOC 2 Type II certified. No Barrier signs a BAA with its customers and deletes encounter content automatically after 7 days unless otherwise agreed with the customer. The security page explains how the platform is protected.
Customer-level governance
Contracts describe intent. Governance describes daily use. No Barrier includes a customer-level governance layer so each organization shapes how the platform is used across its sites. Health systems can ask any vendor what comparable controls exist and who in the customer’s team manages them.
What the proposed Security Rule update could change
HHS proposed the first major update to the HIPAA Security Rule in January 2025. Among other changes, it would ask covered entities to obtain written verification, at least once a year, that business associates have deployed the required technical safeguards. The proposal is not final: the federal regulatory agenda now lists July 2027 for final action. The current Security Rule remains in force. Health systems that collect attestation evidence today are already working the way the proposal describes.
Which questions should a security review ask an AI interpreting vendor?
Ten questions cover the core of a security review. Each should be answered in writing before go-live.
Ten questions to answer in writing
- Which entities handle PHI and does each have a BAA with the vendor?
- Is audio retained? If so, for how long and where?
- Are transcripts stored and who can access them?
- Is any customer data used to train or improve models?
- How are access rights assigned and reviewed?
- What is the incident reporting timeline and who is the named contact?
- Which independent attestations exist and can the full report be shared under NDA?
- How does the vendor test and document dialect and terminology quality?
- What happens to all data at contract end and how is deletion confirmed?
- Who from the vendor’s team supports the customer’s security review?
What a strong answer looks like
Strong answers are specific: a named subcontractor list instead of a category, a retention period in days instead of “as needed” and a deletion process with a written confirmation step. Vague answers are a signal to ask again before the contract stage. The HIPAA page shows how No Barrier frames its own answers. Quality and privacy questions belong together, so teams that want a wider procurement frame can pair this list with the executive checklist for choosing an AI interpreter vendor.
Who should own the BAA review and in what order?
Four owners cover the work inside the health system. Running the first three steps in parallel keeps the review from stalling at contract stage.
Four internal owners
- Privacy officer: reviews BAA terms against the HHS sample provisions and sets the incident reporting timeline.
- Security lead: reads the attestation report and the answers to the ten questions above.
- Language access manager: maps which encounters the platform will cover, from inpatient rooms to calls and telehealth, so the review matches real use.
- Procurement or legal: finalizes the contract, including the training and data-use language.
Bring the vendor in early
The vendor’s team should join before the contract stage, not after it. Early access to the attestation report and the subcontractor list lets the security lead and the privacy officer work in parallel. No Barrier has a dedicated Customer Success team that supports this kind of review.
Close with a decision record
A short written record of what was asked, what was answered and who approved it lets the next review start from this one, not from zero. It also gives the privacy officer a ready reference when the subcontractor list or the Security Rule changes.
The takeaway for operations teams: the BAA sets the rules, security evidence proves the controls work and governance shows how the platform is used every day. Health systems that ask for all three before go-live spend less time reopening agreements later.
.svg){kind=small}