Brewster Law Firm Legal Insights

What Is a Business Associate Agreement (BAA), and When Does a Healthcare Practice Need One?

Fri, 28 Aug 2026 00:53:55 GMT

What Is a Business Associate Agreement?

A Business Associate Agreement (BAA) is a written contract or other arrangement used when a HIPAA-covered entity works with a business associate that creates, receives, maintains, or transmits protected health information (PHI) on its behalf.

For healthcare practices, BAAs can be an important part of managing relationships with outside companies and service providers that handle PHI.

The U.S. Department of Health and Human Services (HHS) explains that when a covered entity engages a business associate to help perform healthcare activities or functions, the parties generally must have a written business associate contract or other arrangement establishing the business associate's responsibilities for protecting PHI.

But not every vendor relationship automatically requires a BAA.

Understanding who qualifies as a business associate, what information is involved, and what services are being performed is an important part of evaluating whether a BAA is required.

Who Is Considered a Business Associate Under HIPAA?

A business associate is generally a person or organization that performs certain functions or provides certain services for a covered entity that involve PHI.

HHS identifies examples of services that may create business associate relationships, including legal, consulting, management, billing, claims processing, data analysis, and certain administrative services when the applicable requirements are met.

For a healthcare practice, potential business associates might include certain:

Billing companies
IT and technology providers
Cloud service providers
Practice management vendors
Consultants
Legal or professional service providers
Data processing companies
Other vendors that create, receive, maintain, or transmit PHI on the practice's behalf

The important question is not simply what the vendor calls itself.

The actual services being performed and the vendor's relationship to PHI matter.

For example, HHS explains that simply selling software to a healthcare provider does not necessarily make the software company a business associate. If the vendor needs access to PHI to provide its services, however, a business associate relationship may arise.

When Does a Healthcare Practice Need a BAA?

A healthcare practice subject to HIPAA generally needs an appropriate written BAA when it engages a business associate to perform applicable functions or services involving PHI on the practice's behalf.

For example, imagine a healthcare practice hires an outside company to host software containing patient information.

If the company creates, receives, maintains, or transmits electronic PHI on behalf of the practice, HHS states that the covered entity must enter into a HIPAA-compliant BAA with the cloud service provider and otherwise comply with the HIPAA Rules.

The same analysis can arise with other vendors.

Before entering into a relationship involving patient information, a healthcare practice should consider:

What service is the vendor providing?

Will the vendor create, receive, maintain, or transmit PHI?

Is it doing so on behalf of the healthcare practice?

Does the relationship meet HIPAA's definition of a business associate?

Is an appropriate BAA already in place?

These questions should be considered as part of vendor contracting and compliance—not after PHI has already been shared.

What Should a Business Associate Agreement Address?

A BAA isn't simply a document stating that both parties will “comply with HIPAA.”

HIPAA requires particular provisions.

According to HHS, a BAA must address matters including the permitted and required uses and disclosures of PHI and restrict the business associate from using or disclosing PHI in ways not permitted by the agreement or required by law.

HHS's guidance on business associate contracts identifies additional required elements, including provisions addressing:

Permitted and required uses and disclosures of PHI
Appropriate safeguards
Reporting certain unauthorized uses, disclosures, and breaches
Access to PHI where required
Amendments and accountings where applicable
Compliance with applicable Privacy Rule obligations undertaken for the covered entity
Access by HHS to relevant records for compliance purposes
Return or destruction of PHI at termination when feasible
Applicable subcontractor obligations
Termination when a material BAA term is violated

HHS provides sample BAA provisions, but it also cautions that its sample language may need to be adapted to the actual business arrangement and may not, by itself, be sufficient to create a binding contract under state law.

That last point is important.

A BAA should reflect the actual relationship between the parties, not simply exist as a generic form in a compliance folder.

Related Legal Service: Healthcare Compliance & Regulations →

What About Business Associate Subcontractors?

BAA obligations do not necessarily stop with the healthcare practice's direct vendor.

A business associate may engage a subcontractor that also creates, receives, maintains, or transmits PHI on the business associate's behalf.

HHS states that the HIPAA Privacy and Security Rules establish BAA requirements not only between covered entities and business associates but also between business associates and their applicable subcontractors.

This means healthcare organizations should understand not only their immediate vendor relationships but also how PHI may move through the broader service arrangement.

Are All Vendors Business Associates?

No.

This is an important distinction because a BAA should not automatically be used for every outside relationship.

Whether a company or individual is a business associate depends on the function or service being performed and the relationship to PHI.

For example, HHS explains that an app receiving information solely at an individual's direction does not automatically become a business associate. But if the app creates, receives, maintains, or transmits ePHI on behalf of the covered entity, a BAA may be required.

Similarly, certain disclosures between healthcare providers for treatment purposes do not create a business associate relationship simply because PHI is exchanged.

The correct analysis therefore begins with the relationship, not with the assumption that every third party touching healthcare information requires the same contract.

Why Healthcare Practices Should Review Existing BAAs

Healthcare practices shouldn't think about BAAs only when opening a new practice.

Existing agreements may also deserve review when:

A vendor's services change
A vendor begins handling PHI in a new way
New technology is introduced
A practice changes vendors
Subcontractors become involved
The underlying service agreement changes
The practice expands or restructures
An agreement no longer reflects the actual business relationship

This is particularly relevant as healthcare practices adopt cloud platforms, digital tools, patient communication systems, and other technology.

HHS's current Security Rule guidance emphasizes evaluating safeguards as the security environment changes, including when new technology is adopted or new risks are recognized.

A BAA Is Part of a Larger Business Relationship

A BAA addresses HIPAA-related responsibilities, but it may exist alongside a broader service agreement, such as a Master Service Agreement.

These documents should not be considered in isolation.

For example, a healthcare practice may have:

A service agreement defining the commercial relationship, services, payment obligations, responsibilities, and other business terms.

and

A BAA addressing the parties' responsibilities concerning PHI and applicable HIPAA requirements.

HHS expressly notes that BAA provisions may be incorporated into a broader services agreement or placed in a separate agreement.

Reviewing the documents together can help identify inconsistencies between the underlying business relationship and the healthcare privacy obligations.

Related Legal Service: Corporate Contracting & Transactional Law →

Key Takeaways

A Business Associate Agreement is more than a standard form added to a vendor contract.

For healthcare practices, the important questions are:

Does the third party qualify as a business associate?

What PHI will it create, receive, maintain, or transmit?

Does the BAA contain the required provisions?

Does the agreement accurately reflect the actual business relationship?

Are applicable subcontractor relationships addressed?

Do the BAA and underlying service agreement work together?

Reviewing these issues before PHI is shared can help a healthcare practice build stronger contractual and compliance foundations.

Sources & References

HHS — Business Associates

HHS — Business Associate Contracts & Sample Provisions

HHS — Covered Entities and Business Associates

HHS — Summary of the HIPAA Security Rule

FAQs

Frequently Asked Questions

About Business Associate Agreements

What does BAA stand for?

BAA stands for Business Associate Agreement. It is commonly used to describe the written contract or arrangement required in applicable relationships between HIPAA-covered entities and business associates, and between business associates and applicable subcontractors.

Does every healthcare vendor need a BAA?

No. Whether a BAA is required depends on the vendor's function, the information involved, and whether the vendor qualifies as a business associate under HIPAA.

Does a software company need to sign a BAA?

It depends. HHS explains that merely selling software does not necessarily create a business associate relationship. A vendor that needs access to PHI to provide services may qualify as a business associate.

Does a cloud provider need a BAA?

When a cloud service provider creates, receives, maintains, or transmits ePHI on behalf of a covered entity or business associate, HHS states that a HIPAA-compliant BAA is required.

Can I use a standard BAA template?

HHS provides sample provisions, but it specifically notes that its sample language may be modified to reflect the actual business arrangement and may not alone be sufficient to create a binding contract under state law.

Is a business associate directly responsible for HIPAA compliance?

Business associates are directly liable for compliance with certain provisions of the HIPAA Rules, including specified Security Rule, breach-notification, and PHI-use requirements.

Still have a question?

Need Help With a Business Associate Agreement?

Brewster Law Firm drafts and reviews Business Associate Agreements for healthcare organizations and businesses navigating healthcare privacy, compliance, and contractual relationships.

Whether you're establishing a new vendor relationship, reviewing an agreement you've been asked to sign, or evaluating an existing BAA, Brewster Law Firm can help you understand the legal considerations involved.

LLC vs. PLLC in Texas: What Healthcare Professionals Should Know Before Choosing a Business Structure

Wed, 19 Aug 2026 00:31:46 GMT

LLC or PLLC? The Right Structure Depends on More Than the Name

For healthcare professionals starting a business or private practice in Texas, choosing a legal entity is one of the first important decisions.

Two structures you may encounter are the Limited Liability Company (LLC) and the Professional Limited Liability Company (PLLC).

While the names sound similar, they are not necessarily interchangeable.

Texas recognizes a PLLC as a limited liability company formed to provide a professional service. Under the Texas Business Organizations Code, a professional service includes services that require a Texas license, including services provided by physicians, dentists, attorneys, and other licensed professionals.

The appropriate entity can depend on your profession, ownership structure, services, licensing requirements, and long-term business plans.

What Is an LLC in Texas?

A Limited Liability Company, or LLC, is a business entity governed primarily by Chapter 101 of the Texas Business Organizations Code.

The owners of an LLC are called members, and an LLC may have one or more members. Texas's Secretary of State explains that members can generally include individuals and various types of legal entities.

LLCs are widely used by businesses because they provide flexibility in areas such as ownership and management.

For healthcare professionals, however, the analysis doesn't necessarily end with deciding that an LLC is desirable.

The nature of the professional services being provided also matters.

What Is a PLLC in Texas?

A Professional Limited Liability Company, or PLLC, is a type of limited liability company specifically formed to provide professional services.

The Texas Business Organizations Code defines a professional limited liability company as an LLC formed for the purpose of providing a professional service and governed as a professional entity.

This distinction becomes particularly important for licensed professionals.

The Texas Secretary of State explains that if a business will perform professional services and its owners want to organize it as a corporation or LLC, they may be required to form a professional entity.

In other words, deciding between an LLC and PLLC shouldn't be based simply on which name sounds better or which form is easiest to file.

What Is the Difference Between an LLC and a PLLC in Texas?

At a high level:

An LLC is a limited liability company that can be used for many types of businesses.

A PLLC is a limited liability company formed specifically to provide professional services.

But for healthcare professionals, one of the most important distinctions involves who can own and govern the entity.

Texas imposes particular requirements on professional entities. According to the Texas Secretary of State, owners and governing persons of a PLLC generally must be professional individuals or qualifying professional organizations, while officers must be professional individuals. The exact rules depend on the entity and professional services involved.

This is why healthcare professionals should evaluate the proposed ownership structure before forming the entity.

Can Healthcare Professionals Form a PLLC in Texas?

Potentially, yes—but the answer depends on the profession and the services being provided.

Texas law defines “professional service” broadly to include services requiring a state license and specifically identifies professions such as medicine and dentistry among its examples.

However, different licensed professions can be subject to different rules.

For example, Texas Secretary of State guidance specifically states that an entity formed to provide medical services may use a professional association or professional limited liability company, while a professional corporation cannot be formed for the practice of medicine.

There are also specific rules governing when certain types of licensed professionals may jointly own a professional entity.

That makes it important to analyze the particular profession rather than assuming the same entity structure works for every healthcare provider.

Why Ownership Matters When Choosing a Healthcare Business Structure

Healthcare professionals sometimes begin their formation analysis by asking:

“Should I choose an LLC or PLLC?”

A better starting point may be:

Who will own the business, what professional services will it provide, and how will it operate?

Those questions can affect the available structure.

Before forming the entity, consider:

Who will own the practice?

What professional licenses do the owners hold?

Will there be one owner or multiple owners?

Will professionals from different disciplines own the business together?

Who will manage the entity?

Will additional owners be added later?

What happens if an owner leaves?

How does the proposed structure support future growth?

These considerations can become especially important for clinical founders who anticipate bringing additional professionals into the business later.

Formation Is Only the Beginning

Filing a certificate of formation establishes the entity, but it does not address every legal issue involved in creating a strong business structure.

Healthcare professionals should also consider how the entity will actually operate.

Depending on the circumstances, that can involve:

Ownership and governance

Who owns the company and how important decisions will be made.

Operating or company agreements

How ownership, governance, responsibilities, and other internal business matters will be addressed.

Provider and contractor relationships

How physicians, providers, nurses, contractors, and other professionals will work with the organization.

Healthcare compliance

How the entity's operations interact with applicable healthcare regulatory requirements.

Long-term planning

How the structure will accommodate growth, new owners, changes in operations, or future transactions.

This broader approach is why choosing an entity should be part of the practice's overall legal strategy rather than viewed as a filing exercise.

Related Legal Service: Business Formation & Structuring →

LLC vs. PLLC: Questions to Consider Before Choosing

Rather than selecting an entity based on a generic online comparison, healthcare professionals should consider questions specific to their situation.

1. What professional services will the business provide?

The services being provided can affect which Texas entity structures are available.

2. Who will own the entity?

Professional entities can have specific ownership requirements.

3. Will there be multiple licensed professionals?

If several professionals will own the organization, their licenses and professional disciplines may affect the analysis.

4. How will the business be governed?

Ownership and management aren't necessarily the same thing. The governing documents should clearly address how important decisions will be made.

5. What are the long-term plans for the practice?

An entity should support not only today's ownership structure but also reasonably anticipated growth and changes.

Key Takeaways

An LLC and PLLC are related structures, but they are not interchangeable for every Texas healthcare professional.

The appropriate choice can depend on:

Your profession
The professional services provided
Who will own the entity
How the business will be governed
Applicable licensing requirements
Your long-term plans

The goal should not simply be to create an entity.

It should be to create a business structure that supports the legal, professional, and operational realities of the healthcare practice.

Sources & References:

Texas Secretary of State — Formation of Texas Entities FAQs

Texas Business Organizations Code

Texas Secretary of State — Professional Corporation Formation Guidance

FAQs

Frequently Asked Questions

About LLCs and PLLCs in Texas

Is an LLC the same as a PLLC in Texas?

No. A PLLC is a type of limited liability company formed for the purpose of providing professional services and is governed as a professional entity under Texas law.

Does every healthcare professional in Texas need a PLLC?

Not necessarily. The appropriate entity depends on the profession, services being provided, ownership structure, and applicable professional regulations. Texas provides different rules for different types of professional entities and professions.

Can a physician form a PLLC in Texas?

Texas Secretary of State guidance states that when an entity's purpose is to provide medical services, the professional may form either a professional association or a professional limited liability company.

Can different healthcare professionals own the same PLLC?

Sometimes, but Texas has specific rules governing joint ownership by certain professionals. The answer depends on the professions involved and the professional services the entity will provide.

Does forming a PLLC protect a healthcare professional from malpractice liability?

A PLLC should not be viewed as a substitute for professional liability protection or insurance. Entity-level liability considerations and an individual professional's responsibility for their own professional services are separate legal issues. This is an area where the article should avoid making broad promises and where Elissa should review the final wording before publication.

Do I need an operating agreement for my healthcare business?

The governing documents are an important part of establishing how a business will operate. Depending on the entity and circumstances, they can address ownership, governance, decision-making, responsibilities, and changes among owners.

Still have a question?

Building a Healthcare Business in Texas?

Brewster Law Firm helps healthcare professionals and business owners evaluate entity formation, ownership, governance, organizational agreements, and broader business-structuring considerations.

Whether you're establishing a new practice, bringing in additional owners, or reconsidering an existing structure, legal guidance can help you understand your options before important decisions are made.

Starting a Healthcare Practice in Texas: Legal Considerations for Physicians, Nurse Practitioners & Clinical Founders

Fri, 07 Aug 2026 23:40:59 GMT

Starting your own healthcare practice can be an exciting step in your professional career. It also means becoming a business owner in a highly regulated industry.

Before opening your doors, healthcare professionals should consider how their practice will be structured, who may own or manage the entity, what agreements may be needed, how regulatory requirements affect operations, and how those decisions fit together.

Texas law also places particular requirements on professional entities. Depending on the professional services being provided, an ordinary business entity may not always be the appropriate structure. The Texas Secretary of State specifically advises that businesses performing professional services may be required to organize as professional entities.

For physicians and other clinical founders, the goal should therefore be more than simply filing formation documents. It should be creating a legal foundation that supports the way the practice will actually operate.

What Legal Issues Should You Consider Before Starting a Healthcare Practice in Texas?

Although every practice is different, several legal considerations commonly arise during the planning and formation process.

These include:

Business entity selection and formation
Ownership and governance
Professional licensing considerations
Healthcare regulatory compliance
Operating or company agreements
Physician, provider, or nursing services agreements
Independent contractor agreements
Business Associate Agreements (BAAs)
HIPAA-related consents and waivers
Other contracts supporting the practice's operations

Addressing these issues together can help avoid creating a business structure that does not align with the practice's professional, operational, or regulatory needs.

1. Choosing the Appropriate Business Structure

One of the first decisions when establishing a healthcare practice is determining the appropriate legal entity.

Business owners frequently hear terms such as LLC, PLLC, professional association, and professional corporation, but healthcare professionals should not assume that every structure is available or appropriate for their profession.

Under the Texas Business Organizations Code, a professional limited liability company is an LLC formed to provide a professional service, and “professional service” includes services requiring a Texas license, including medicine and other licensed professions.

Texas also imposes profession-specific rules. For example, the Secretary of State explains that an entity formed to provide medical services may use a professional association or professional limited liability company rather than a professional corporation.

Why does entity selection matter?

The entity you establish can affect matters such as:

Ownership
Governance
Management
Liability considerations
Internal decision-making
Future changes in ownership
Business relationships
Long-term growth planning

For that reason, formation should be viewed as part of a broader legal strategy rather than simply an administrative filing.

Related Legal Service: Business Formation & Structuring →

2. Understanding Ownership and Governance

Determining who owns the practice and who has authority to make decisions is another important part of establishing the business.

This becomes particularly important when there are multiple founders, investors, healthcare professionals, or other parties involved.

Texas professional entities can be subject to restrictions regarding ownership and management depending on the profession and entity involved. For example, Texas law and Secretary of State guidance impose specific requirements on professional entities and certain combinations of licensed professionals.

The practice's governing documents should therefore reflect more than percentages of ownership.

Depending on the circumstances, they may need to address issues such as decision-making authority, responsibilities among owners, changes in ownership, governance, and what happens when the business or professional relationships change.

3. Building Healthcare Compliance Into the Practice

Compliance should not be something a healthcare practice considers only after it begins seeing patients.

A new practice may need to evaluate how healthcare regulations affect its business model, documentation, relationships, information practices, and day-to-day operations.

For practices subject to HIPAA, for example, relationships with outside individuals or organizations that create, receive, maintain, or transmit protected health information may trigger Business Associate Agreement requirements. HHS explains that covered entities generally need appropriate written assurances from business associates concerning the safeguarding and permitted use of PHI.

Depending on the practice, compliance planning may involve:

HIPAA and privacy considerations

How patient information will be handled and which outside relationships involve protected health information.

Business Associate Agreements

Whether vendors or other parties qualify as business associates and whether appropriate agreements are in place.

Consents and waivers

Whether the practice's documents appropriately reflect its operations and applicable healthcare requirements.

Operational compliance

How the practice's business arrangements and processes interact with healthcare regulatory requirements.

The specific requirements depend on the practice, profession, services provided, and business relationships involved.

Related Legal Service: Healthcare Compliance & Regulations →

4. Identifying the Contracts Your Healthcare Practice May Need

A healthcare practice operates through relationships—with owners, providers, contractors, vendors, service companies, and other organizations.

Those relationships often require carefully structured agreements.

Depending on the practice, these may include:

Physician and provider agreements
Nursing services agreements
Independent contractor agreements
Master Service Agreements (MSAs)
Business Associate Agreements (BAAs)
Operating agreements
Company agreements
Non-Disclosure Agreements (NDAs)

The appropriate agreement depends on the relationship and the role each party will have.

Contracts should not be viewed simply as documents to sign. They establish responsibilities, expectations, obligations, and risk between the parties.

Having agreements reviewed or drafted in the context of the practice's broader business and healthcare operations can help ensure that contracts support rather than conflict with the legal structure of the practice.

Related Legal Service: Corporate Contracting & Transactional Law →

5. Don't Treat Formation, Compliance, and Contracts as Separate Decisions

One of the most important considerations for a clinical founder is that these legal issues often overlap.

Your entity structure affects ownership.

Ownership affects governance.

Governance affects decision-making.

Your relationships with providers, contractors, vendors, and other organizations create contractual obligations.

Some of those relationships may also create healthcare compliance or privacy considerations.

This is why establishing a healthcare practice should involve looking at the whole legal structure of the business, rather than addressing each document independently.

A well-planned legal foundation should support both the professional requirements of the practice and the owner's long-term business objectives.

6. When Should You Speak With a Healthcare Business Attorney?

Ideally, legal planning begins before the practice is formed or major agreements are signed.

Consider seeking legal guidance when you are:

Preparing to open a new healthcare practice
Deciding between potential entity structures
Bringing another owner or provider into the practice
Drafting governing documents
Reviewing physician, provider, nursing, or contractor agreements
Establishing relationships with vendors that may handle protected health information
Restructuring an existing practice
Preparing for significant growth or a change in ownership

Addressing legal questions earlier can make it easier to structure the business intentionally rather than trying to correct disconnected decisions later.

Key Takeaways

Starting a healthcare practice in Texas involves more than registering a business name and filing formation documents.

Healthcare professionals should consider business structure, ownership, governance, regulatory compliance, contracts, privacy obligations, and long-term business objectives as interconnected parts of the practice's legal foundation.

Taking a coordinated approach at the beginning can help create a structure designed not only to open the practice, but also to support its operations and future growth.

Sources & References

Texas Secretary of State — Formation of Texas Entities FAQs

Texas Business Organizations Code

U.S. Department of Health & Human Services — Business Associate Guidance

FAQs

Frequently Asked Questions

About Starting a Healthcare Practice in Texas

Do I need an LLC or PLLC to start a healthcare practice in Texas?

Not every healthcare professional or practice will use the same entity type. Texas places specific requirements on professional entities, and the appropriate structure can depend on the profession, ownership, and services being provided. The Texas Secretary of State notes that those performing professional services may be required to use a professional entity when organizing as a corporation or LLC.

Can a healthcare professional form a PLLC in Texas?

This is the text area for this paragraph. To change it, simply click and start typing. Describe the item or answer the question so that site visitors who are interested get more information. You can emphasize this text with bullets, italics or bold, and add links. Once you've added your content, you can customize its design.

Can a healthcare professional form a PLLC in Texas?

Texas law recognizes professional limited liability companies for the provision of professional services, but the permissible entity structure and ownership requirements depend on the profession involved.

What contracts might a new healthcare practice need?

The answer depends on how the practice operates. Agreements may include operating or company agreements, physician and provider agreements, nursing services agreements, independent contractor agreements, MSAs, BAAs, NDAs, and other agreements relevant to the practice's business relationships.

When does a healthcare practice need a Business Associate Agreement?

Generally, a BAA may be required when a HIPAA-covered entity engages a business associate to perform functions or services involving protected health information. HHS also requires BAAs in applicable business-associate/subcontractor relationships.

Should I speak with an attorney before forming my healthcare practice?

Getting advice before formation can help a clinical founder evaluate entity structure, ownership, governance, contracts, and healthcare regulatory considerations together rather than addressing each issue separately after the business has already been established.

Still have a question?

Starting or Growing a Healthcare Practice in Texas?

Brewster Law Firm provides strategic legal guidance to healthcare professionals and clinical founders navigating the legal considerations involved in starting, structuring, operating, and growing healthcare practices in Texas.

From business formation and structuring to healthcare compliance and contract drafting and review, Brewster Law Firm helps clients understand their options and build stronger legal foundations for their practices.