Every healthcare buyer asks every PII vendor the same question early in procurement: “Do you have a BAA?” It is a reasonable question, and for most vendors it is the right one. For a vendor that ships self-hosted software, it is aimed at the wrong target. For its software, Philterd does not sign a Business Associate Agreement, and the reason is not reluctance or a paperwork shortcut. It is that there is no business-associate relationship to govern. This guide walks through why, from the definitions up, so your compliance team can confirm it rather than take it on faith.
What HIPAA actually says
A HIPAA Business Associate Agreement is a contract between a covered entity and a business associate. The term is defined in 45 CFR § 160.103: a business associate is a person or entity that, on behalf of a covered entity, creates, receives, maintains, or transmits protected health information. The definition also covers services such as consulting that involve disclosure of PHI.
The four operative verbs all describe contact with the data. A business associate is something that handles your PHI. The BAA exists to govern that handling: how the associate safeguards the PHI it touches, what it may do with it, and what happens when the relationship ends.
So the real question behind “do you have a BAA?” is: does this vendor handle our PHI? If the answer is no, there is nothing for a BAA to govern.
The architecture test
Apply the definition to two vendor models.
A SaaS vendor that processes PHI in the vendor’s cloud. You send records to the vendor’s service, the vendor’s systems process them, and results come back. The vendor receives, maintains, and transmits your PHI on your behalf. That is the textbook business-associate relationship, and a BAA is required. This is a perfectly valid architecture; it simply comes with a business-associate role.
Self-hosted software running entirely inside your own environment. You deploy the software in your own cloud account or data center. It runs against your data, inside your perimeter, under your access controls. The vendor’s systems never see the data. Philterd works this way: Philter, Phileas, and the rest of the toolkit run inside your infrastructure. The software does not send customer PHI to Philterd or process it on our systems, and Philterd cannot access it at runtime.
Run the test against the second model and it fails every verb in the definition. Through this software, Philterd does not create, receive, maintain, or transmit your PHI. For the software, Philterd is therefore not a business associate, and there is no BAA to sign. This follows from the architecture, because Philterd has no access to PHI in software you self-host.
What this changes for your own BAA chain
Nothing about your own obligations changes. Your agreements with downstream parties (your cloud provider, an EHR vendor, any SaaS service you send output to) are exactly what they were. Self-hosting Philter does not remove any of those.
If anything, it makes that chain cleaner. Data that meets a de-identification standard such as HIPAA Safe Harbor before it leaves your perimeter is no longer PHI, which can remove the need for a BAA with vendors that receive only that data. Automated redaction alone does not establish de-identification, so confirm it with your privacy officer. The point of redacting at the edge is to shrink the set of systems and vendors that ever see regulated data.
The one edge case: consulting
There is one situation where the question changes. In a consulting engagement, Philterd staff may work inside your environment. Most engagements are scoped to synthetic data, policy design, and deployment review that does not require seeing real records. Before any engagement that could give Philterd staff access to real PHI, we put a written agreement in place with the required business associate terms.
A note on vendor architecture
If a PII vendor asks you to sign a BAA, it is worth understanding what that BAA covers. It almost certainly means the vendor processes your PHI in their cloud, which is a different architectural decision from running redaction inside your own perimeter. Both can work under HIPAA. Only the second keeps the data in your own environment while it is redacted. The presence or absence of a BAA is not a measure of how seriously a vendor takes compliance; it is a signal of where the data is processed.
The bottom line
For its software, Philterd does not sign a BAA because there is no business-associate relationship to govern. The software does not send your data to us.
If your procurement or security team wants to verify this reasoning, point them at the security overview, or talk to the team about your specific deployment.