Blog · HIPAA · Problem 8 of 93
A hospital wants a signed BAA and your HIPAA policies before the pilot starts.
· 2 min read · By Case Jones
Your product will touch patient information for the first time. The hospital’s privacy office sent a Business Associate Agreement to sign and asked for your HIPAA policies, a risk assessment and proof of workforce training.
What it costs to leave it
Signing a BAA without the policies and practices behind it means promising things you can’t show, and HIPAA breaches carry real penalties. Not signing means no pilot.
How to get ready to sign
A BAA is a contract that says you will protect patient information the way HIPAA requires. Get advice from someone who knows HIPAA before you sign; this guide is a starting point, not legal advice.
- 1
Read what the BAA actually asks
Look for breach notification deadlines, rules on subcontractors, return or destruction of data at the end, and audit rights. Note each promise and who in your team would keep it.
- 2
Do a risk assessment first
HIPAA expects you to know where patient information lives, who can reach it, and what could go wrong. Write it down, with what you do about each risk. Most other HIPAA work follows from this.
- 3
Write the core policies
Access control, encryption, audit logging, incident and breach response, workforce training and sanctions, device and media handling, and vendor management. Each should say who does what and when.
- 4
Check your own vendors
Every vendor that will store or process patient information for you needs its own BAA with you, often called a subcontractor BAA. Your cloud host, email provider and support tools come up first.
- 5
Train the people who will touch the data
HIPAA expects workforce training with a record of who completed it. Train before the pilot, not after, and keep the record.
Example
One breach-notification line, made concrete
Policy: “The Security Officer is told of any suspected incident involving patient information within one hour. We assess it within 24 hours and notify the covered entity within the time our BAA sets, with what happened, what data, and what we are doing.”
Or start the HIPAA work in 93 Compliance
The policy builder works out which documents you need, and an AI policy assistant writes and customises them, researching as it writes. Each document can be tested against HIPAA, and the gaps show up as requirements to fix.
Risks go in a risk register with tests, and vendors in a vendors register with review dates, so the subcontractor question has an answer.
Training records are $10 per employee per year: each policy becomes a short audiobook and study games, with a record of who heard which version and acknowledged it. Everything else is free.
- HIPAA policies drafted and tested against HIPAA
- Risk register with test results
- Vendors register with review dates
- Training records per employee
Start my HIPAA policies
The policies, the questionnaire check, procedures and audits are free. Training records are $10 per employee per year.
Start freeWritten by Case Jones, who built 93 Compliance. Former VP of Information Security who took doxy.me from zero to SOC 2 Type 2, through a SOC 2 Type 1 audit, two Type 2 audits and a positive HIPAA assessment. doxy.me is not affiliated with 93 Compliance and has not endorsed it.
Questions
Do we have to sign the hospital’s BAA as written?
Not always. Many are negotiable on notification times and audit terms. Have someone who knows HIPAA read it with you before you sign.
Does using a HIPAA-eligible cloud make us compliant?
No. It covers the provider’s part, under its own BAA with you. Your access controls, policies, training and incident response are still yours.
Is there a HIPAA certification we can get?
There is no official HIPAA certification. Some companies get an outside assessment to show their work, but it is a report, not a government certificate.