Do I need a BAA to text patients for reviews?

If a company sends review requests to your patients for you, it has to receive at least a name and a phone number from your clinic. Under HIPAA, that makes it a business associate, and you need a signed Business Associate Agreement (BAA) before you share any of it. In Texas, a second law, HB 300, adds training, notice and penalty rules for both your clinic and the vendor.

Is a review-texting company really a business associate?

Yes, in almost every setup. HIPAA defines a business associate as anyone who "creates, receives, maintains, or transmits protected health information" on behalf of a covered entity, other than your own staff (45 CFR 160.103). A list of your patients with their phone numbers is protected health information (PHI): it shows who visited your clinic, and when. A vendor that receives that list to text people on your behalf fits the definition.

The definition also covers the vendor's own suppliers. A "subcontractor that creates, receives, maintains, or transmits protected health information on behalf of the business associate" is a business associate too.

What does HIPAA require before you share patient data?

A written agreement. You may let a business associate handle PHI only after you get "satisfactory assurance" that it will safeguard it, and those assurances "must be documented through a written contract" (45 CFR 164.502(e)). That contract is the BAA. The order matters: sign first, then share.

What has to be in the BAA?

HIPAA lists the required terms (45 CFR 164.504(e)(2)). In plain terms, the vendor must agree to:

• use and disclose PHI only as the contract allows, or as the law requires;
• use appropriate safeguards, including the HIPAA Security Rule for electronic PHI;
• report any use or disclosure the contract doesn't allow, including breaches;
• make sure its own subcontractors agree to the same restrictions;
• help you meet patients' rights to access, amend and get an accounting of their information;
• open its records to HHS if HHS checks your compliance;
• return or destroy your patients' data when the contract ends, where feasible.

The contract must also let you terminate it if the vendor violates a material term.

What if the texting company uses its own vendors?

They need agreements too. A business associate may pass PHI to a subcontractor, such as a texting carrier or a hosting provider, only after getting the same written assurances from it (45 CFR 164.502(e)(1)(ii)). You don't sign those agreements yourself, but your BAA should require them. It's fair to ask a vendor which subcontractors will see your patients' data.

What happens if the vendor has a breach?

It must tell you. A business associate has to report a breach of unsecured PHI to your clinic "without unreasonable delay and in no case later than 60 calendar days after discovery," naming each affected patient where possible (45 CFR 164.410). Your clinic then decides on notice to patients and HHS. Many BAAs set a shorter reporting window than 60 days.

What does Texas HB 300 add to HIPAA?

Texas HB 300 took effect on September 1, 2012 and amended Chapter 181 of the Texas Health and Safety Code (HB 300, enrolled). For a clinic and its texting vendor, four changes matter most.

It covers more businesses than HIPAA does. Texas defines a "covered entity" as anyone who handles PHI for commercial or professional gain, or who simply "comes into possession of protected health information," and names business associates outright (Tex. Health & Safety Code § 181.001). Your texting vendor is therefore bound by Texas law directly, not only through your BAA.

It requires documented staff training. Each covered entity must train employees on state and federal PHI law as their duties require. New employees must finish it within 90 days of hire. When a material change in the law affects their duties, they must be retrained within a year. Each employee signs a statement confirming the training, and the clinic keeps it for six years (§ 181.101).

It requires a notice about electronic disclosure. If patients' PHI is subject to electronic disclosure, the clinic must tell them, for example with a notice posted in the office or on its website. Disclosures for treatment, payment or health care operations to another covered entity don't need a separate patient authorization. Otherwise, each electronic disclosure needs the patient's separate authorization (§ 181.154).

It raised state penalties. The Texas Attorney General can seek up to $5,000 per violation per year for negligence, $25,000 for knowing or intentional violations, and $250,000 when PHI is used for financial gain. If a court finds a pattern or practice, the cap is $1.5 million a year. Against a licensed clinic, the Attorney General can seek these civil penalties only after the clinic's licensing board refers the case (§ 181.201). HB 300 also bans selling PHI (§ 181.153).

What this means for your clinic

• Get the BAA signed before any data moves. That includes a "test" upload of a few patients.
• Read the BAA for the terms above, especially breach reporting, subcontractors, and return or destruction of data at the end of the contract.
• Ask who else touches the data. The vendor should be able to name its subcontractors and confirm they've signed agreements.
• Keep the paperwork. The signed BAA belongs in your compliance file, and so do your staff's signed HB 300 training statements (six years).
• Train the front desk on the new workflow within 90 days of hire for new staff. A process change like review texting is a good reason to refresh everyone.
• Check your electronic-disclosure notice (Texas § 181.154) and update it if it doesn't cover a texting vendor.

A BAA covers how a vendor handles your data. It doesn't cover whether a patient agreed to get review texts (that's the TCPA) or what your team says when it replies to a review. Both have their own rules.

How Automynds handles it

• BAA signed before go-live. No patient data moves until the Business Associate Agreement is in place. We sign your clinic's BAA.
• Only what the text needs. Typically a patient ID, first name, the mobile number, the text-message consent flag, and where and when the visit ended. Your contract lists the exact fields for your clinic. Ratings and comments come only from the patient's own reply. Never clinical notes, diagnoses or treatment details.
• Subcontractors under agreement. Every vendor that handles your patients' data has signed a BAA with us. We'll share the list on request.
• Breach reporting and data return. The reporting window and how your patients' data is returned or deleted are set in the BAA you sign with us.
• Texas privacy addendum. A Texas data protection addendum is part of every contract (see the Texas TDPSA page).
• Training with records. Your front desk is trained before go-live on asking for consent and replying to reviews safely. You get dated sign-offs to keep for HIPAA and Texas privacy training requirements.

Questions about our BAA? Email hello@automynds.com.