Does a free app need a BAA for patient photos?

Yes, if it stores, receives or sends patient photos for your clinic. The rule depends on what the app does with PHI, not on what you pay for it.

Do I need a separate BAA with the cloud provider the vendor (clinical photo app) uses?

No. Your vendor must have its own BAA with any subcontractor that handles your PHI. HHS says your clinic doesn’t need to sign one directly with that subcontractor.

Can I send a patient photo to another surgeon without a BAA?

Yes, when it’s for the patient’s treatment. The other surgeon isn’t your business associate. The app or service you use to send the photo may still need a BAA with your clinic.

What if a clinical photo app vendor won’t sign a BAA?

Choose a different app for patient photos. HIPAA requires a signed BAA before you share PHI with a business associate, so look for a clinical photo app vendor that will sign one.