Vendor BAA vs DPA picker

FAQ

When is a HIPAA business associate agreement (BAA) required?

Under the HIPAA Privacy Rule, a covered entity (or business associate) may disclose protected health information to a business associate only if it obtains satisfactory assurances, typically documented in a business associate agreement, that the PHI will be appropriately safeguarded (see 45 CFR 164.502(e) and 164.504(e)). If a vendor creates, receives, maintains or transmits PHI for you, treat a BAA as mandatory until counsel says otherwise.

When is a GDPR Article 28 DPA required?

When a processor processes personal data on behalf of a controller, GDPR Article 28 requires a binding contract (a data processing agreement) that sets out the subject matter, duration, nature and purpose of processing, types of data, categories of data subjects, and the processor’s obligations. EEA (and often UK) personal data in your stack usually triggers this analysis even when HIPAA also applies.

Can the same vendor need both a BAA and a DPA?

Yes. US PHI and EEA personal data in one product commonly need both instruments, plus a transfer tool (such as SCCs) when personal data leaves the EEA/UK. Map controller vs processor vs business associate roles before merging templates.

Does de-identification remove the need for a BAA?

Only if the data truly meet HIPAA de-identification standards (Safe Harbor or expert determination) and the vendor never receives PHI. Hashing names or dropping direct identifiers without a full Safe Harbor analysis often still leaves PHI. Confirm with counsel and your HIPAA policies.

What if there is no PHI and no EEA personal data?

You may not need a BAA or Art. 28 DPA, but confidentiality, security, breach notice and audit clauses still belong in the MSA or a security addendum. Skipping review because HIPAA/GDPR boxes are unchecked is a common contracting failure mode.

Is this picker legal advice?

No. It is an educational first pass for manufacturer and vendor contracting discussions. Applicability depends on factual data flows, entity status and jurisdiction — have qualified counsel review before signature.