Do You Need a BAA for a Photo App?

Yes, in almost every case. This applies to clinics covered by HIPAA. If a clinical photo app stores, receives or sends your patient photos, the company that runs it (the vendor) is your “business associate.” You’ll want a signed BAA with that vendor before the first photo goes in. A BAA is a contract in which the vendor agrees to protect patient data.

HIPAA’s Privacy Rule requires this contract in 45 CFR 164.502(e). The Security Rule requires it for electronic patient data in 45 CFR 164.308(b).

Encryption doesn’t replace the BAA. HHS says a cloud service that stores encrypted patient data still needs one, even without the decryption key.

HIPAA calls a company a business associate when it “creates, receives, maintains, or transmits” protected health information (PHI) for your clinic (45 CFR 160.103). A patient photo is PHI when it is tied to care and could identify the patient. Our post “Is a phone gallery HIPAA compliant?” explains why most clinical photos are PHI.

HHS gives two examples of business associates. Both describe how clinical photo apps work:

• A cloud service that stores or processes electronic PHI for a clinic.
• A company that provides a health app to a clinic for its patients to use.

To check any app, look at what it does with your clinical photos. The table below shows what that looks like.

HIPAA applies to most US clinics that bill insurance electronically. If you are unsure whether your clinic needs to follow HIPAA, contact the US Department of Health and Human Services (HHS) for guidance.

No. HHS’s cloud computing guidance says a cloud provider that stores your encrypted patient data is still a business associate, even if it doesn’t have the decryption key.

Encryption keeps the wrong person from seeing the photo. A BAA is the vendor’s written promise to protect your patient data under HIPAA. One doesn’t replace the other, so you need both.

HHS lists a few narrow exceptions. These are the three a clinic is most likely to meet:

• Sharing for treatment. Sending a photo to another provider for the patient’s care, such as a second opinion, doesn’t need a BAA with that provider. The email, messaging app or clinical photo app you send it through is a separate question, and it may still need a BAA with your clinic.
• A true conduit. A service that only carries data from one place to another, such as the postal service or a courier, isn’t a business associate. A service that keeps a copy of your photos is different. HHS says a cloud service that stores your data is generally not a conduit, so it still needs a BAA.
• Services that don’t work with patient data. A cleaning service or an electrician doesn’t need a BAA, because the job has nothing to do with patient records or photos. If they happen to see patient data, it must be by chance only, and you still need safeguards in place.

A patient may use their own app to photograph their own condition. If your clinic has no link to that app, you don’t need a BAA with it. If your clinic picks an app and asks patients to send photos through it, the app company is working for your clinic, and you do need a BAA.

HHS sets out the required terms in 45 CFR 164.504(e), and the Security Rule adds more in 164.314(a). In plain terms, the BAA must:

• Say how the vendor may use and share PHI, and bar any other use.
• Require safeguards that protect the data, as the HIPAA Security Rule requires.
• Require the vendor to tell you about misuse, security incidents and breaches.
• Help you meet patients’ rights to see, correct and track their records.
• Let HHS check the vendor’s records about your PHI.
• Make any subcontractor that handles your PHI agree to the same terms.
• Return or destroy your PHI when the contract ends, if that’s possible.
• Let you end the contract if the vendor breaks a key term.

HHS publishes sample BAA wording. When a vendor sends you its BAA, compare it with the sample and check that it covers each point in the list above.

A vendor’s website may mention “HIPAA” a lot, but that doesn’t tell you what the contract says. These questions get you facts you can check:

• Will you sign a BAA before we upload any patient photo? Ask to see the document, not just a promise.
• Does the BAA cover the plan we’re buying? Check that it names the exact service your team will use.
• Which subcontractors touch our photos? For example, the cloud provider or the tools the vendor’s support team uses. Ask whether the vendor has a BAA with each one (45 CFR 164.502(e)(1)(ii)).
• How fast will you tell us about a breach? HIPAA requires a business associate to tell you without unreasonable delay, and no later than 60 days after it discovers a breach (45 CFR 164.410). Many clinics ask for a shorter deadline in the contract.
• What happens to our photos if we leave? Ask how you export them and when the vendor deletes its own copies.
• Do photos stay out of staff phone galleries? If the app saves to the camera roll, photos can sync to personal cloud accounts that have no BAA.
• Does each person get their own login, and is there an audit trail (a record of who viewed or shared each photo)? You’ll need both to meet your own HIPAA duties.

A signed BAA doesn’t make your clinic compliant. It covers only what the vendor does with your photos. Everything else is still your clinic’s job.

That includes your risk analysis (45 CFR 164.308(a)(1)(ii)(A)), staff training (164.308(a)(5)) and rules for staff phones and other devices. It also includes getting a patient’s written authorization before you use an identifiable photo in marketing (164.508(a)(3)).

A real case shows what this looks like. In 2016, Raleigh Orthopaedic Clinic in North Carolina handed the x-ray films and health information of about 17,300 patients to a company that promised to digitize them. The clinic and the company never signed a BAA. The clinic later agreed to pay $750,000 to HHS to settle the case.

HHS said a BAA is “more than a mere check-the-box paperwork exercise.” The signed contract has to be in place before any patient information is shared. As part of the settlement, the clinic had to put three fixes in place:

• Name one person responsible for making sure a BAA is signed before PHI is shared.
• Use a standard BAA template.
• Keep its BAA records for at least 6 years after it stops working with each vendor.

“BAA” is a US term. Other countries use different contracts and rules. Each law below applies only in its own country.

United Kingdom. Under UK GDPR Article 28, your clinic is the “controller” (it decides how patient data is used). Any company that handles that data for you, such as a clinical photo app vendor, is a “processor”. The two must have a written contract. The Information Commissioner’s Office (ICO), the UK data regulator, lists what the contract must cover, including documented instructions, security, sub-processors (subcontractors) and what happens to the data when the contract ends. The ICO says this guidance is under review after the Data (Use and Access) Act.

European Union. EU GDPR Article 28 sets the same duty for clinics in the EU. A clinic needs a written contract with any company that handles patient data for it, such as a clinical photo app vendor.

United Arab Emirates. Federal Law No. 2 of 2019 covers the use of information and communication technology (ICT) in health fields. Its Article 13 says health data from services in the UAE generally may not be stored, processed or transferred outside the country, except in cases the rules allow. So ask a clinical photo app vendor in writing where your photos are stored. Also check the rules of your emirate’s health regulator.

Australia. The Privacy Act 1988 has no BAA. Its Australian Privacy Principles (APPs) include APP 8, which applies when you send personal information, such as patient photos, to a recipient overseas. An example is a clinical photo app vendor that stores photos outside Australia. Before you do, you must take reasonable steps to make sure that recipient doesn’t breach the APPs. Under section 16C of the Act, your clinic can still be held responsible for what that recipient does with the information.

Saudi Arabia. The Personal Data Protection Law (PDPL), Article 8, says your clinic, as the “controller” (it decides how patient data is used), “shall only select Processors providing the necessary guarantees”. A processor is a company that handles the data for you, such as a clinical photo app vendor. The clinic must also keep checking that the processor follows the law.

☐ List every app and service that touches patient photos. Include camera apps, cloud backup, upload links and messaging tools.

☐ For each one, ask: does it store, receive or send photos for us?

☐ If yes, find the signed BAA. No BAA on file? Stop new uploads to that service today, then ask the vendor for one.

☐ Ask each vendor which subcontractors handle your photos and how quickly they would tell you about a breach. Write down the answers.

☐ Keep every signed BAA where your compliance lead can find it.

☐ Outside the US, get the local contract (the equivalent of a BAA) instead, such as a UK GDPR Article 28 processor contract.

☐ Review this list once a year and whenever you add a new app or service. You can do it as part of your HIPAA risk analysis, the clinic’s review of where patient information could be at risk.

☐ Check each BAA against the 7 points above.

CureCast provides a BAA, which covers CureCast’s side of how patient photos are handled. Your own policies, staff training and patient authorizations stay with your clinic, because compliance belongs to the practice. CureCast supports HIPAA-compliant workflows, including encryption and an audit trail. Our HIPAA guide for clinical photos shows how.

Does a free app need a BAA for patient photos?

Yes, if it stores, receives or sends patient photos for your clinic. The rule depends on what the app does with PHI, not on what you pay for it.

Do I need a separate BAA with the cloud provider the vendor (clinical photo app) uses?

No. Your vendor must have its own BAA with any subcontractor that handles your PHI. HHS says your clinic doesn’t need to sign one directly with that subcontractor.

Can I send a patient photo to another surgeon without a BAA?

Yes, when it’s for the patient’s treatment. The other surgeon isn’t your business associate. The app or service you use to send the photo may still need a BAA with your clinic.

What if a clinical photo app vendor won’t sign a BAA?

Choose a different app for patient photos. HIPAA requires a signed BAA before you share PHI with a business associate, so look for a clinical photo app vendor that will sign one.

This post is general information about HIPAA and similar laws in other countries. It is not legal advice. Check your own situation with your compliance lead or counsel.

References: 45 CFR 160.103 (eCFR) · 45 CFR Part 164 (eCFR) · HHS: Business Associates · HHS: Sample BAA provisions · HHS: HIPAA and Cloud Computing · HHS: $750,000 settlement and BAAs · ICO: What needs to be included in the contract? · UK GDPR Article 28 · EU GDPR · UAE Federal Law No. 2 of 2019 · OAIC: APP 8 · Australia: Privacy Act 1988 · Saudi Arabia: PDPL