Does Your Dental Bookkeeper Need a BAA? HIPAA Questions to Ask Before You Hire

If your bookkeeper works in your practice management system, they will see patient names, balances and payments. Under HIPAA, an outside firm that provides accounting services to a covered entity, where the work involves access to protected health information, is a business associate. That means you need a written business associate agreement, or BAA, before the work starts. Once the agreement is signed, ask what they will see, who on their team will see it, and how fast they will call you if something goes wrong. We are bookkeepers, not lawyers, and this is not legal advice.

When a Bookkeeper Becomes a Business Associate

Two things have to be true. First, your practice has to be a covered entity. A dentist is covered by HIPAA if the practice transmits health information electronically in connection with a standard transaction, which is how HHS describes covered health care providers. Sending insurance claims electronically is the common one, and a practice that does it is covered.

Second, the bookkeeper's work has to involve patient information. The HIPAA definition of a business associate includes a person who provides "legal, actuarial, accounting, consulting, data aggregation …, management, administrative, accreditation, or financial services" to a covered entity, "where the provision of the service involves the disclosure of protected health information". HHS's business associate guidance lists, among its examples, a firm "whose accounting services to a health care provider involve access to PHI." The ADA's FAQ on business associates lists accountants among the people who might be one.

HHS says no BAA is needed for someone like a janitor or an electrician, whose work does not involve patient information and whose access "would be only incidental, if at all." A bookkeeper who logs into your practice software, reads your aging report or matches insurance payments to deposits does not fit that exception.

A bookkeeper who only sees your bank statements and vendor bills may never touch patient information. That is rare in dental work, and it usually means nobody is tying your practice software to the bank, which is a problem of its own. Our post on how to choose a dental bookkeeper includes the BAA question for that reason.

What Patient Data Your Books Actually Need

HIPAA's minimum necessary standard applies to a covered entity and to a business associate. Both must "make reasonable efforts to limit protected health information to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request."

For bookkeeping, that rule is easy to meet. Your books need totals: production by provider, adjustments and write-offs, collections, and accounts receivable by age. None of that requires a chart note, an x-ray or a treatment plan.

Patient-level detail comes in with the reconciliation. When a deposit does not match the payments posted in your system, someone has to find out which payment is missing, and that usually means looking at individual patients and claims. A dental bookkeeper needs payment and claim detail, not clinical records.

Ask whether the bookkeeper needs a full login to your practice software, or a role that can run financial reports and view payments. Ask whether report exports that leave your system carry patient names or only totals, and where those exports are kept once downloaded. Be wary of anyone who asks for full access and a shared password.

Questions to Ask About Access and Security

The HIPAA Security Rule applies directly to business associates for electronic patient information. These are the questions to ask before you hire.

Will you sign a BAA before you get access? The answer should be yes, with an agreement ready. If they hesitate, or have no agreement ready, ask how they handle patient data for their other healthcare clients.

Who on your side will see our patient data? Ask for names or roles, and whether any of the work is done by contractors or offshore staff.

Do you use subcontractors or software that will hold our data? Under 45 CFR 164.502(e), a business associate may pass patient information to a subcontractor only after getting satisfactory assurances, documented in a written agreement, that it will be safeguarded. Ask who those subcontractors are.

Have you done a security risk analysis? In 2025 HHS settled with an accounting firm acting as a business associate for $175,000 after a ransomware attack, and found it had failed to conduct an accurate and thorough risk analysis.

How are logins handled? Each person should have their own login, with multi-factor authentication where your software supports it, and access should be removed the day someone leaves their firm or the engagement ends.

What happens if you have a breach? The rule requires a business associate to tell you "without unreasonable delay and in no case later than 60 calendar days after discovery" under 45 CFR 164.410. Sixty days is the outer limit outside a law enforcement delay. Ask how fast they would actually call you and who would make the call.

What happens to our data when we part ways? They should return or destroy it and confirm in writing that they have. ## What a BAA Does and Does Not Cover

The regulation, 45 CFR 164.504(e), lists what a BAA must say. In plain terms: what the bookkeeper may do with patient information, that they will protect it and report any improper use or breach, that their subcontractors are bound the same way, that they will help you meet patients' rights to their records, that HHS can review their records, and that they will return or destroy the data when the work ends, or keep protecting it if that is not feasible. You must also be able to cancel the agreement if they break a material term.

HHS publishes sample BAA provisions and says they "alone may not be sufficient to result in a binding contract under State law." Have your attorney look at whatever you sign.

Signing a BAA does not move your responsibility to the bookkeeper. Business associates are directly liable for parts of HIPAA, including the Security Rule, impermissible disclosures and breach notification, as HHS lays out in its fact sheet on business associate liability. The practice keeps its own exposure. Under 45 CFR 160.402(c), a covered entity can face civil money penalties for the acts or omissions of a business associate that is its agent under the federal common law of agency, acting within the scope of that agency. And under 45 CFR 164.504(e), if you know of a pattern of activity by the business associate that materially breaches the agreement and do not take reasonable steps to fix it, or end the contract, if feasible, when that fails, the practice is out of compliance itself.

Having no agreement at all is a violation too. In 2016 an orthopaedic clinic in North Carolina paid $750,000 to HHS after it handed x-ray films to a vendor without a business associate agreement in place.

HHS proposed a substantial update to the Security Rule in January 2025. As of October 2026 it has not been finalized, and HHS's own Security Rule summary still describes "the Security Rule that is currently in effect."

P.S. Reciprocity Accounting works inside your practice management system every month, and these are the questions we expect a practice to ask us before we start. See how we can help your practice.

Frequently Asked Questions

Does my dental bookkeeper need to sign a BAA?

If your practice is a HIPAA covered entity and the bookkeeper's work involves access to patient information, yes. A bookkeeper who works in your practice management system or reconciles insurance payments will see protected health information.

Is every dental practice a HIPAA covered entity?

A practice that submits insurance claims electronically is covered. One that never conducts a standard electronic transaction, itself or through a billing service, is not.

What has to be in a business associate agreement?

How the bookkeeper may use patient information, safeguards, breach reporting, the same terms for subcontractors, support for patients' rights to their records, access for HHS, return or destruction of the data at the end, and your right to cancel. The list is in 45 CFR 164.504(e).

How quickly must a bookkeeper report a breach to my practice?

Without unreasonable delay, and no later than 60 calendar days after the breach is discovered.

Does a BAA transfer HIPAA liability to the bookkeeper?

No. The bookkeeper becomes directly liable for some HIPAA requirements, but the practice can still be liable for a business associate acting as its agent, and for ignoring a known pattern of breach. Talk to your attorney about your situation.