If an IT provider creates, receives, maintains, or transmits protected health information on behalf of your dental practice, the relationship may require a Business Associate Agreement (BAA).
For dental practices with 10-40 employees, this is an important question because IT companies can potentially have access to servers, backups, workstations, email, dental software, and other systems containing patient information.
Use this four-step framework:
Identify → Verify → Document → Review
1. Identify Which Vendors May Access Patient Information
Start by identifying outside companies that interact with systems containing protected health information.
For a dental practice, that may include providers supporting:
- Dentrix, Open Dental, or Eaglesoft
- Dexis and imaging systems
- Servers
- Backup systems
- Microsoft 365
- Cloud applications
- Remote-access tools
- Cybersecurity systems
Don't assume that a vendor doesn't matter simply because its primary job is "IT."
The important question is what information or systems the vendor can access as part of the services it provides.
2. Determine Whether a BAA Is Appropriate
A BAA establishes responsibilities for protecting PHI when working with a business associate.
Questions to ask include:
- Can the vendor access systems containing PHI?
- Does the vendor maintain or back up PHI?
- Does it transmit PHI?
- Does it provide services involving PHI on behalf of the practice?
- What safeguards does the vendor use?
Your practice should evaluate these relationships rather than assuming every technology contract automatically addresses HIPAA requirements.
When you're unsure whether a specific relationship requires a BAA, consult an appropriate HIPAA compliance or legal professional.
3. Document the Relationship
A signed agreement shouldn't be the end of the process.
Maintain documentation showing:
- Which vendors are business associates
- Which agreements are in place
- What services each vendor provides
- What systems they can access
- Who is responsible for reviewing the relationship
This becomes especially important as vendors change.
A dental practice might add a new cloud application, backup provider, imaging platform, or IT service without realizing that the change also affects its HIPAA documentation.
4. Review Vendors Regularly
Vendor access can change over time.
Review business-associate relationships when:
- Changing IT providers
- Adding new cloud software
- Changing backup systems
- Implementing new dental technology
- Adding remote-access tools
- Opening another location
- Replacing major systems
Also remember to remove unnecessary access when a vendor relationship ends.
The objective is simple:
Know who has access, why they have it, and what protections are in place.
The 6-Question Dental Vendor Check
Ask:
- Which vendors can access systems containing PHI?
- Which vendors maintain or transmit PHI for us?
- Have we determined which relationships require a BAA?
- Are the appropriate agreements documented?
- Do we understand how each vendor protects access?
- Do former vendors still have accounts or remote access?
If several answers are unclear, your vendor relationships deserve a closer review.
A BAA Does Not Automatically Make You HIPAA Compliant
Signing a Business Associate Agreement is not the same as completing a HIPAA compliance program.
Dental practices still need to address areas such as:
Risk Analysis + Access Controls + Employee Procedures + Cybersecurity + Backup + Policies + Vendor Management
Likewise, hiring an IT company that understands HIPAA does not transfer the practice's overall compliance responsibilities to the IT provider.
The BAA is one piece of a larger risk-management process.
Why Dental Practices Choose IT Services of Utah
IT Services of Utah has supported businesses for more than 30 years and works with dental practices throughout St. George and Washington County, Utah.
Our team understands dental environments involving Dentrix, Dexis, Open Dental, Eaglesoft, Microsoft 365, servers, backups, networks, remote access, and cybersecurity.
We help dental practices evaluate the technical safeguards and vendor-access issues that should be considered as part of a broader HIPAA security program.
Frequently Asked Questions
Does every dental vendor need a BAA?
Not necessarily. Whether a BAA is required depends on the vendor's role and its relationship to protected health information.
Does my dental IT company need a BAA?
It may. If the IT provider qualifies as a business associate because of the services it performs involving PHI, an appropriate BAA may be required.
Is having a BAA enough for HIPAA compliance?
No. A BAA addresses the business-associate relationship, but HIPAA compliance involves broader administrative, physical, and technical safeguards.
Do You Know Which Vendors Have Access to Patient Information?
Don't wait for a security incident to create a list.
Remember:
Identify. Verify. Document. Review.
For dental practices with 10-40 employees in St. George and Washington County, Utah, IT Services of Utah can help review vendor access, remote connections, user accounts, backups, and other technical safeguards affecting your dental environment.
Schedule a Dental IT & Cybersecurity Assessment with IT Services of Utah to identify who has access to your systems and where technical risks may need attention.
