iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
No. A business associate agreement (BAA) is a required part of many cloud arrangements involving electronic protected health information (ePHI), but signing one does not make a deployment HIPAA compliant or transfer every security duty to the cloud provider. The covered entity or business associate using the service still has to understand the arrangement, assess its risks, and meet the obligations that apply to its role.
HIPAA applies to covered entities and business associates, not automatically to every company that handles health-related data. The analysis below is about U.S. HIPAA obligations; the duties of each party depend on what it does, which services are in scope, the risks involved, and the written agreements.
May a HIPAA covered entity or business associate use a cloud service to store or process ePHI?
Yes. HHS permits covered entities and business associates to use public, hybrid, or private cloud services for ePHI when they meet the applicable HIPAA requirements, including entering into a BAA with a cloud service provider (CSP) when the provider is acting as a business associate. The deployment still needs safeguards suited to its services and risks; choosing a cloud model does not settle that work.
Recommended Free Tools
A company’s marketing description of a product as “HIPAA-ready” is not a certification of your particular setup. HHS’s cloud guidance says OCR does not endorse, certify, or recommend specific cloud technologies or products. Evaluate the actual service, configuration, contract, and responsibilities rather than relying on a label.
#1 Best Overall
When is a cloud provider a business associate?
A CSP that creates, receives, maintains, or transmits ePHI on behalf of a covered entity or another business associate generally meets the HIPAA definition of a business associate. That can include a provider whose service is limited to storing data; the provider need not inspect or use the information for the status to apply.
Does encrypted storage without the key change the answer?
No. HHS OCR’s Guidance on HIPAA & Cloud Computing, last reviewed December 23, 2022, states: “Lacking an encryption key does not exempt a CSP from business associate status and associated obligations under the HIPAA Rules.” Encryption may reduce some risks, but it does not by itself remove the provider’s role or the duties attached to it.
Can a CSP be considered to be a “conduit” like the postal service?
The conduit exception is narrow. It applies to a transmission-only service with transient storage incidental to transmission—not to a service that persistently stores ePHI. A cloud service retaining data should not be treated as a conduit merely because the provider does not view it.
Free tools Windows power users keep installed
One-click scans. No signup required.
What does the BAA do—and what remains your responsibility?
The BAA sets permitted and required uses and disclosures of PHI, requires appropriate safeguards, and establishes obligations between the parties. It is a contractual instrument, not a compliance certificate, a substitute for risk management, or a guarantee that a particular product configuration meets the Security Rule.
Both covered entities and business associates must analyze risks and vulnerabilities to the confidentiality, integrity, and availability of the ePHI they handle. The HHS OCR Summary of the HIPAA Security Rule describes the rule as “flexible, scalable, and technology neutral.” That flexibility affects how an organization selects and implements safeguards; it does not excuse risk analysis or applicable safeguards.
HHS says the selection of security measures should take account of factors such as:
- Organization size, complexity, and capabilities.
- Infrastructure and the systems and services involved.
- The costs of security measures.
- The probability and criticality of risks to ePHI.
There is no single HHS-prescribed cloud architecture or universal security stack. A customer’s risk analysis and risk-management plan need to reflect the service actually used, including what the CSP controls and what the customer configures.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →How should teams divide cloud security responsibilities?
Responsibility is arrangement-specific. Some controls may be implemented by the customer, some by the CSP, and some through coordinated work. For example, a customer may manage user authentication while the CSP protects administrative tools and systems used to operate the service. Customer control of user accounts does not eliminate the provider’s need to consider risks such as unauthorized administrative access or unpatched or obsolete management tools.
Rank #3
Use a service-by-service responsibility matrix to make the boundary concrete. The table below is a planning aid derived from HHS guidance, not a regulator-prescribed checklist or an exhaustive statement of legal duties. Name the accountable party and the evidence or process for each item in the relevant written agreements and operational records.
| Area to map | Questions for the customer and CSP to resolve | What to document |
|---|---|---|
| Data and service scope | Which service handles ePHI, and does it create, receive, maintain, or transmit that data? | Service, data types, purposes, and systems in scope. |
| Access and identity | Who controls user access, authentication, and privileged administrative access? | Which party operates each control and how access is reviewed. |
| Encryption and keys | Where is encryption applied, and who manages or can access the keys? | Control boundaries and key-management responsibilities. |
| Logging and monitoring | Who generates, protects, reviews, and acts on relevant security events? | Available records, monitoring responsibilities, and escalation route. |
| Backup, recovery, and availability | Who provides backups and recovery, and what service commitments apply? | Roles, recovery arrangements, availability terms, and customer access. |
| Incidents and notifications | How will the parties detect, report, investigate, and coordinate on incidents? | Contacts, reporting detail, frequency, format, and response process. |
| Subcontractors | Which downstream services handle PHI, and who puts required agreements in place? | Relevant vendors, services, and contractual coverage. |
| Location and end of service | Where is ePHI handled, and how can the customer retrieve it when the service ends? | Locations, export and return steps, and applicable deletion terms. |
Why encryption is not a complete security program
Encryption is one safeguard, not a replacement for the full set of applicable Security Rule obligations. HHS specifically cautions that encryption alone does not maintain the integrity and availability of ePHI, and does not replace contingency planning, administrative risk analysis, or physical safeguards.
Teams should therefore consider more than whether data is encrypted at rest or in transit. They also need to understand how the service addresses access, operational and administrative risks, recovery, and the other safeguards identified through their risk analysis. The appropriate measures depend on the arrangement rather than on a single feature.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsWhat should cloud contracts cover beyond the BAA?
HHS identifies several service-level topics to address, as appropriate, in terms consistent with the BAA and HIPAA Rules. An SLA or related agreement can make operational expectations clearer, but it should not conflict with the BAA or prevent the regulated organization from accessing ePHI when required.
Rank #4
- Availability and reliability of the service.
- Backup and recovery arrangements.
- Customer access to ePHI and its return when the service ends.
- Which party is responsible for particular security activities.
- Limits on the provider’s use, retention, and disclosure of ePHI.
Translate broad promises into an operational understanding: what is covered, which party performs each activity, and how the parties coordinate when the service or data is at risk.
Do HIPAA Rules require CSPs to provide security documentation or allow audits?
HHS OCR says HIPAA does not expressly require a CSP to provide security documentation or permit a customer to audit its security practices. That narrow point does not make assurances unimportant: a customer may seek documentation, additional assurances, or audit rights through the BAA, SLA, or other written terms based on its risk analysis and compliance needs. Contract terms or other obligations may also matter beyond what HIPAA expressly requires.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How do incidents, breaches, and subcontractors affect the arrangement?
Incident and breach coordination
HHS says business associates must address security incidents and report incidents of which they become aware to their customer. The BAA can specify the detail, frequency, and format of those reports, so teams should make the reporting path usable in practice rather than leaving it implicit.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Breaches of unsecured PHI are subject to separate requirements under the Breach Notification Rule. Contractual reporting terms should support the parties’ applicable obligations; a BAA cannot override those requirements.
Best Value
Downstream vendors
A business associate’s subcontractor that creates, receives, maintains, or transmits PHI on its behalf is also a business associate. The upstream business associate must establish an appropriate BAA with that subcontractor before disclosing PHI for the work. Map the downstream services that handle PHI instead of assuming a top-level cloud agreement covers every component.
Does HIPAA prohibit overseas cloud storage?
HHS cloud guidance does not treat overseas storage as categorically prohibited by HIPAA. Location can change the risk profile and the practical enforceability of agreements, however, so the parties should include location-specific risks in their risk analysis and risk management. Do not assume HIPAA imposes a blanket U.S.-only data-residency rule.
What is the current status of proposed Security Rule changes?
On the HHS OCR The Security Rule page last reviewed March 19, 2026, “HIPAA Security Rule to Strengthen the Cybersecurity of Electronic Protected Health Information,” dated January 6, 2025, is listed as a proposed rule. The page separately lists the January 25, 2013 Omnibus HIPAA Final Rule. Treat the 2025 item as a proposal based on that dated page; this status statement is not a claim about any later action.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →HHS also identifies the joint ASTP/ONC and OCR Security Risk Assessment Tool as a resource useful to small and medium-sized healthcare practices and business associates. It is a government assessment tool, not an endorsement of a cloud product.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
