A BAA Checklist for Dental Vendors

Walk through your practice and count the vendors that touch patient information. The practice management system, obviously. But also the answering service that takes after-hours messages, the texting tool that sends reminders, the cloud backup, the email provider, the marketing platform that knows who your patients are, and the phone system that records calls. Each one handles protected health information on your behalf. Each one is supposed to have a signed Business Associate Agreement on file. And if you're like most practices, you genuinely don't know how many of them actually do — which means you don't know how many compliance gaps are sitting quietly in your vendor stack right now.

The Business Associate Agreement is the single most important document in your vendor relationships, and it's also the most commonly skipped. Vendors call themselves "HIPAA-friendly," practices assume a BAA is in place, and nobody checks until an audit or a breach forces the question. This guide is a practical BAA checklist for dental practices: what a BAA is, what it must contain, which vendors need one, and how to vet a new vendor before you sign. We'll keep the framing honest throughout — a BAA is a necessary foundation, not a guarantee, and no vendor should pretend otherwise.

What a BAA is and why it's non-negotiable

A Business Associate Agreement is the contract between your practice (a covered entity) and any vendor (a business associate) that creates, receives, maintains, or transmits protected health information on your behalf. In plain terms: if a vendor can see, store, or move your patients' information, you need a signed BAA with them. It's not optional, and it's not satisfied by a vendor's marketing claim that they're "HIPAA compliant." The agreement is what legally binds the vendor to safeguard the information and accept responsibility for doing so.

Skipping it isn't a small oversight. Sharing protected health information with a vendor that hasn't signed a BAA is itself a compliance gap, regardless of how secure that vendor's technology is. This is exactly where many phone and answering-service vendors fall short — they handle patient calls every day without ever signing one, and the practice doesn't find out until it matters most. The BAA is the floor. Everything else in your vendor evaluation sits on top of it.

The BAA checklist: what every agreement must contain

A real BAA covers a defined set of obligations. When you're handed one to sign, check that it actually addresses each of these — a thin or vague BAA is nearly as much of a red flag as none at all:

• Permitted uses and disclosures. Exactly what the vendor may do with the information, and nothing beyond it.
• Safeguards. A commitment to appropriate administrative, physical, and technical safeguards — encryption, access controls, the practical security measures.
• Subcontractor flow-down. If the vendor uses subcontractors that touch the information, those subcontractors must be bound by the same obligations.
• Breach notification. A clear obligation and timeline to notify your practice if protected information is breached.
• Access, amendment, and accounting. Support for patients' rights to access and amend their information, and an accounting of disclosures.
• Return or destruction at termination. What happens to your patients' information when the relationship ends — it must be returned or destroyed.
• Audit and recordkeeping. The vendor makes its practices and records available so compliance can be verified.

If any vendor offers an agreement missing several of these, or won't provide a BAA in writing at all, you have your answer about how seriously they take patient data.

Which dental vendors need a BAA

The short rule: if it can see, store, or move patient information, it needs a BAA. In a typical dental practice that includes:

• The practice management system (Dentrix, Open Dental, Eaglesoft, Curve Dental, CareStack, and others).
• The phone and answering service — including any AI receptionist or after-hours service that handles patient calls.
• Texting and reminder tools that message patients about appointments.
• Cloud backup and storage holding any patient records.
• Email providers if patient information travels by email.
• Marketing and recall platforms that work from your patient list.
• Billing, claims, and clearinghouse services.

The two most commonly overlooked are the phone/answering service and the texting tool — precisely because they feel like utilities rather than systems handling protected health information. They are exactly that, and they belong on your checklist with the rest.

How an AI receptionist meets the bar

When you're vetting a phone vendor specifically, the AI receptionist sits squarely in BAA territory because it handles patient calls all day. DentalReception AI is built to be HIPAA compliant and offers a signed BAA — and it answers every call in under two rings and books the appointment live into your schedule, 24 hours a day, 365 days a year, while keeping patient information inside a protected, encrypted, access-controlled workflow the whole time.

Mapped to the checklist: a signed BAA is available, so the foundational requirement is met rather than hand-waved. Patient and insurance details captured on a call are encrypted and attach directly to the booking in your practice management system — no sticky notes, no shared voicemail, no information sitting loose between steps. Access is controlled so information reaches your authorized team, and calls and recordings are handled with audit logging. The full specifics live on the security page, which is exactly the kind of concrete documentation a vendor should be able to point you to.

What a responsible vendor won't do is overclaim. DentalReception AI does not assert insurance eligibility or make clinical judgments; it captures and relays information and routes anything needing human judgment to your team. A BAA covers how a vendor handles your data — it doesn't transform software into a guarantee.

Accuracy note: A signed BAA is a legal foundation for handling protected health information; it is not a certification, an audit result, or a guarantee against all risk, and your practice remains a covered entity with its own compliance obligations. DentalReception AI is built to be HIPAA compliant and offers a signed BAA. Pre-launch and onboarding compliance items — including data hosting region — are confirmed before anything goes live.

How to vet a new vendor before you sign

Run every new vendor that will touch patient information through the same short process:

1. Ask for the BAA up front, in writing. If they offer "HIPAA-friendly" language instead of a signed BAA, stop there.
2. Read the BAA against the checklist above. Confirm it covers safeguards, subcontractor flow-down, breach notification, and end-of-term return or destruction.
3. Ask the security specifics. How is data encrypted, in transit and at rest? Who can access it? Is access logged?
4. Ask about subcontractors. Who else touches the data downstream, and are they bound by the same terms?
5. Keep a vendor inventory. Maintain a running list of every vendor that touches patient information and whether a current BAA is on file. For a multi-location group, this is the difference between knowing your exposure and guessing at it.

That last point matters most for groups, where vendor sprawl multiplies across locations and a BAA gap at one office is easy to miss. A maintained inventory — reviewed periodically — turns vendor compliance from an annual scramble into a managed process.

❓Frequently asked questions

Is a vendor saying "we're HIPAA compliant" the same as having a BAA?

No, and treating them as the same is a common and costly mistake. "HIPAA compliant" is a claim about a vendor's security practices; a BAA is a signed legal contract that binds them to protect your patients' information and accept responsibility for it. You need both, but the BAA is the non-negotiable one — sharing protected health information with a vendor that hasn't signed a BAA is a compliance gap no matter how good their security is. When a vendor offers "HIPAA-friendly" language instead of putting a signed BAA in front of you, treat it as a refusal. A vendor that takes patient data seriously provides a BAA without hesitation.

Which vendors do practices most often forget to get a BAA from?

The phone and answering service, and the texting or reminder tool. Both feel like utilities rather than systems that handle protected health information, so they slip past the BAA process. But an answering service hears patients describe symptoms and reads back insurance details, and a reminder tool messages patients about their appointments — both are handling protected information squarely. Cloud backup, email providers, and marketing platforms working from your patient list are also commonly missed. The safe rule is mechanical: if a vendor can see, store, or move patient information in any form, it needs a signed BAA, full stop — no matter how peripheral it feels.

What should I do if I find a vendor without a BAA?

Address it promptly. Contact the vendor and request a signed BAA; a legitimate vendor that handles patient information will have one ready. If they can't or won't provide one, that's a strong signal to evaluate a replacement, because continuing to share protected health information with them leaves the gap open. Document what you find and what you do about it — a record of identifying and closing the gap is itself part of good compliance practice. Then add the vendor to a maintained inventory so the same gap doesn't reopen. This is also a good moment to review the rest of your stack, since one missing BAA often means others.

Does a signed BAA make my practice fully compliant?

No — a BAA is a foundation, not a finish line, and any vendor implying otherwise is overstating things. The BAA binds your vendor; your practice remains a covered entity with its own obligations: training staff, controlling access, securing records, and maintaining your own safeguards. A BAA with every vendor that touches patient data is necessary but not by itself sufficient. The honest way to think about it: the BAA closes the vendor-relationship gap, and you still own the rest. That's why a responsible vendor frames its product as "built to be HIPAA compliant" with a signed BAA available, rather than promising your practice blanket compliance.

Where can I see how a vendor should document this?

A clear example is the security page, which lays out how patient information is handled, and the HIPAA-compliant AI receptionist overview. The best way to evaluate any vendor concretely is a demo, where you can see how patient and insurance information stays inside a protected workflow and ask the checklist questions directly. You can also browse the blog for related compliance topics. Whatever vendor you're evaluating, bring this checklist, ask for the BAA in writing first, and don't accept "HIPAA-friendly" as a substitute.