Which AI Tools for Medical Practices Require a Business Associate Agreement?

Most practice owners find out about Business Associate Agreements at the wrong time. A vendor asks them to sign one, they forward it to their attorney, and two weeks later they're still waiting.

Understanding which AI vendors require a BAA before you start evaluating them saves time and changes how you think about the entire market.

What Makes a Vendor a Business Associate

Under HIPAA, a Business Associate is any organization that creates, receives, maintains, or transmits Protected Health Information (PHI) on behalf of a covered entity.

The covered entity is your practice. You are responsible for patient data under HIPAA. Any vendor you work with that handles that data inherits a portion of that responsibility. You formalize it with a Business Associate Agreement.

The BAA sets out what the vendor can do with your patient data, how they protect it, what happens if there's a breach, and what their liability is if something goes wrong.

This is not bureaucratic paperwork. It is the legal document that defines who is responsible for your patients' data when it leaves your building.

The Architecture Question

Whether a vendor is a Business Associate comes down to one question: where does the patient data live?

If a vendor pulls your patient data into their own servers to run their product, they are a Business Associate. Your data lives in their environment, on their infrastructure, under their control. A BAA is required.

If a vendor's product runs inside your own infrastructure, using your own systems, and your patient data never leaves your environment, the vendor is not receiving or maintaining PHI. A BAA is not required.

This is an architectural difference. It is not a privacy policy choice or a marketing claim. It is determined by how the product is built.

Which AI Vendors Require a BAA

Here is a breakdown of the major AI vendors in the independent practice and med spa market, organized by BAA requirement:

What Signing a BAA Actually Means for Your Practice

When you sign a BAA, you are doing a few things at once.

First, you are acknowledging that the vendor has access to your patient data and is handling it on your behalf. If that vendor experiences a breach, your practice may have reporting obligations. Your patients may need to be notified.

Second, you are accepting that if the vendor violates the agreement and PHI is exposed, your practice may share in the liability, depending on how the breach is categorized and whether you exercised appropriate due diligence in selecting the vendor.

Third, you are agreeing to monitor the vendor's compliance, at least in principle. Most small practices never actually do this, which is itself a compliance gap.

None of this means you should avoid every vendor that requires a BAA. Most of the vendors in the table above have strong security practices, and a well-negotiated BAA can adequately protect your practice. What it does mean is that signing a BAA is not a formality. It carries real obligations on both sides.

Five Questions to Ask Before You Sign

If a vendor requires a BAA, these are the questions your attorney should be asking before you sign:

The Alternative Architecture

One way to avoid BAA requirements entirely is to use AI that runs inside your own infrastructure, not a vendor's cloud.

This is how ZxAI is built. ZxAI's AI staff members are deployed inside the practice's own cloud environment, using the practice's own credentials. They authenticate against the practice's systems directly. Patient data never moves to ZxAI's servers because ZxAI does not have servers that receive it.

Under HIPAA's definition, ZxAI is not creating, receiving, maintaining, or transmitting PHI. The practice's systems are doing that. ZxAI is the logic running inside those systems.

This is not the right architecture for every practice. It requires that you already have, or are willing to set up, the infrastructure for the AI to run in. But for practices where data control and compliance posture matter, it eliminates the BAA conversation entirely.

What to Do With This Information

If you are evaluating AI vendors for your practice, start with the architecture question before you get into features or pricing.

Ask each vendor: does your product run on your servers, or mine?

If the answer is theirs, ask to see their BAA before your next conversation. Have your attorney review it. Understand what you are agreeing to before you agree to it.

If the answer is yours, verify it. Ask them to explain, in plain language, where your patient data lives during normal operations, during support interactions, and during billing.

The vendors who answer these questions directly are the ones worth talking to further. The vendors who cannot give a clear answer to where your data lives are the ones to watch closely.