A business associate agreement (BAA) is the contract HIPAA requires between a healthcare organization and a vendor that creates, receives, keeps or sends protected health information (PHI) on its behalf. A signage vendor needs one only if patient information passes through its system; if the screens never show or store PHI, there is nothing for a BAA to cover.
Who needs a BAA
HIPAA applies to covered entities (health plans, healthcare clearinghouses and providers that bill electronically) and to their business associates. A vendor becomes a business associate by handling PHI for a covered entity, whether or not anyone calls it that. A cloud service that stores a patient list for a waiting-room screen is one; a service that never sees patient data is not.
What a BAA says
Among other things, a BAA sets out:
- what the vendor may and may not do with the PHI
- the safeguards it must keep in place
- that it reports breaches and security incidents to the covered entity
- that its own subcontractors who touch the PHI sign equivalent terms
- that it returns or destroys the PHI when the contract ends
When signage involves PHI
| Screen | PHI? |
|---|---|
| A waiting room calling "Ticket 42 to Room 3" | No |
| A waiting room calling "Maria G. to Room 3" | Yes: a name tied to a visit |
| A staff-only bed board fed from the EHR | Yes, if the vendor's cloud receives the data |
| The same bed board loaded straight from your server onto the screen | Only what the vendor can see, such as screenshots |
The safest design keeps PHI off public screens entirely and keeps the vendor's cloud out of the path of any PHI that staff screens need.
What to ask a signage vendor
- Does any patient data pass through or rest in your cloud, including screenshots of the screens?
- Can screenshots be switched off for screens that show sensitive information?
- Will you sign a BAA, and if not, how is the product designed so that you don't need to?
- How do queue screens call patients without names?
Where Screenly stands
Screenly does not sign a BAA today. It stores no patient data by design: queues call a ticket number, never a name, a ScreenlyOS device loads internal pages straight from your servers, and privacy mode stops screenshots of sensitive screens. HIPAA and Screenly sets out the detail.
