Go away for a week and hand a neighbor your house key, and the arrangement is a handshake. Feed the cat, water the plants, don't throw a party. Hire a house sitter through a service and you get it in writing instead: which rooms they can go into, what they do if a pipe bursts, that anyone they bring along follows the same rules, and that the key comes back when the job's done.
A business associate agreement is that written arrangement for health information. It's also the piece of paper a paid AI plan doesn't automatically come with, and that gap is where a lot of agencies are standing right now.
What a business associate agreement is
Under HIPAA, a health plan is a covered entity. A business associate is a person or company outside the plan that creates, receives, maintains or transmits protected health information on the plan's behalf. The business associate agreement, or BAA, is the contract that sets the rules for what they do with it.
The regulation spells out what that contract has to say. It sets which uses and disclosures of the information are allowed. It requires appropriate safeguards, and a report back when the information is used or disclosed in a way the contract doesn't allow. It makes any subcontractor agree to the same restrictions. And when the contract ends, the information is returned or destroyed where that's feasible. That's the house sitter's agreement, clause for clause.
Where your agency fits
HHS guidance talks plainly about insurance agents that are business associates of a health plan. Whether that describes your agency depends on what you handle and for whom, and your carrier and FMO agreements are where to look before you assume either way.
The rule that follows matters more for AI than anything else here. A subcontractor that handles that information on a business associate's behalf is a business associate too, and you need written assurances from it before you hand anything over. HHS puts it in one line: all such downstream subcontractors are also business associates. The moment a client's health details go into an AI tool, that tool's vendor is the subcontractor.
It doesn't help that the vendor can't read the data. HHS's cloud computing guidance says a provider that stores only encrypted health information, without the key, is still a business associate and still needs a BAA.
A paid plan isn't a BAA
This is the assumption worth checking, because the plan names don't tell you. Here's where the major vendors stand, read from each vendor's own page in early October 2026.
OpenAI will sign a BAA for most of its API services, and for ChatGPT Enterprise and Edu customers with a sales-managed account. Its help page says it doesn't offer one for ChatGPT Business.
Anthropic offers a BAA for its API, with conditions, and for Claude Enterprise. Enterprise coverage isn't on until the organization's Primary Owner turns it on, and some features sit outside it, including Skills and connectors.
Google lets Workspace customers accept its BAA in the Admin console, and Gemini in Workspace is on its list of covered functionality. Google's other services outside Workspace aren't covered by those terms. What Google's HIPAA Coverage for Gemini Actually Means for Insurance Agents walks through that one in detail.
Microsoft includes a BAA for in-scope services in its standard terms, and its HIPAA page lists Microsoft Copilot and Copilot Chat for commercial customers. Check the exact product your agency licenses against that list rather than going by the name on the invoice.
These pages change, and they don't all change on the same day. Treat this list as accurate the week I wrote it and worth checking again before you rely on it. Meeting tools belong on the same list, and Is Your AI Notetaker HIPAA Compliant? covers the recorder sitting in your client calls.
The question to ask every AI vendor
Before any client's health details go into a tool, ask the vendor one question in writing: will you sign a business associate agreement that covers the plan and the features we'll actually use?
A yes needs three things behind it. The plan you're on has to be the one the BAA covers. The features inside that plan have to be covered too, which is why Anthropic's list of exclusions is worth reading even if you never use Claude. And the agreement has to be signed and on file, not a sales rep's email saying you're fine.
A no, or a "we're HIPAA compliant" with no BAA behind it, still leaves the tool useful on public plan documents and your own templates. Client details stay out.
On a Digital Crew, that answer becomes a Flight Rule written before the agent ever runs: no client health information goes into a seat that isn't covered by a signed BAA. Writing it down once beats deciding it again every time someone's in a hurry.
I'm not a lawyer, and this isn't legal advice. The rules above come from the regulation text and HHS's own guidance, and your carrier agreements and compliance counsel decide how they apply to your agency.
Start with what's already in use
The harder question is usually which tools your team is already pasting client details into, since those got picked before anyone asked about a BAA.
If you suspect that's happening at your agency, that's normal, and it's where the Shadow AI Governance Launchpad starts. It's a free kit with an amnesty email script, a three-question survey, a traffic-light data guide and an AI use policy template, so you can find out what's in use before you decide what's allowed.
Frequently asked questions
Is a BAA the same thing as a vendor being HIPAA compliant? No. A vendor can describe a product as HIPAA ready and still not sign a BAA for the plan you're on. The signed agreement is what puts the regulation's required terms in place between you and the vendor.
When is a business associate agreement required? Before the information changes hands. HHS requires the satisfactory assurances, in a written contract or arrangement, before a business associate passes protected health information to a subcontractor, so the BAA comes first and the client details come second.
Does Zoom sign a business associate agreement? Yes, on its Pro, Business, Business Plus and Enterprise plans. Pro customers can accept it at checkout, and Business and above go through Zoom's sales team. Zoom also notes that certain AI features may not be available once a BAA is in place, so check the ones you rely on.
