CDS Business Associate Agreement (BAA) for Healthcare Backup Services
Review the CDS Business Associate Agreement and understand how it applies to your healthcare backup services. Download the document or speak with our team about agreement coverage and service requirements.
What Is a Business Associate Agreement for Healthcare Backup?
A business associate agreement (BAA) establishes a backup provider’s responsibilities for handling and safeguarding protected health information. Healthcare organizations generally need a BAA when a provider maintains electronic protected health information on their behalf. The agreement defines contractual obligations; it does not replace the organization’s broader HIPAA compliance responsibilities.
When a BAA Applies to Healthcare Data Backup
Healthcare backups can contain electronic protected health information (ePHI), including patient records, diagnostic images, billing information, and data from electronic health record (EHR) systems.
Covered entities and business associates
A covered entity includes a health plan, healthcare clearinghouse, or healthcare provider that conducts certain standard transactions electronically. A business associate performs services involving protected health information on behalf of a covered entity. A provider storing healthcare backups can fall within that relationship.
What HHS guidance says
According to HHS guidance on cloud computing, an appropriate BAA must be in place when a cloud provider creates, receives, maintains, or transmits ePHI on behalf of a covered entity or business associate.
Missing a required agreement can have significant consequences. Raleigh Orthopaedic Clinic agreed to a $750,000 settlement to resolve potential HIPAA violations after sharing patient information with a business partner without first executing a BAA. The HHS enforcement case involved X-ray digitization and demonstrates the importance of establishing vendor obligations before disclosing PHI.[source]
What the CDS Agreement Covers
The publicly available CDS agreement includes HIPAA provisions addressing:
Confidentiality and safeguards
Protecting PHI and preventing unauthorized use or disclosure.
Disclosure restrictions
Limiting disclosure to third parties, including restrictions involving subcontractors of the customer.
Reporting and mitigation
Reporting unauthorized use, disclosure, or server breaches of which CDS becomes aware, and mitigating harmful effects where practicable.
PHI after termination
Destroying PHI when the agreement ends. If destruction is not possible, providing written notification and extending protection to the retained information.
Continuing obligations
Addressing changes necessary to comply with HIPAA and obligations that survive termination.
Confirm the applicable version
The full agreement governs the contractual terms. Confirm the applicable version and covered services with CDS.
If you are evaluating UnisonBDR managed backup and disaster recovery, ask our team which agreement and service terms apply to your deployment.
Request a Data AssessmentHow to Arrange Your BAA With CDS
Downloading the PDF does not itself execute the agreement. Existing customers seeking their applicable agreement can contact CDS.
For service costs and options, review CDS pricing.
Review the agreement
Share it with the people responsible for your organization’s compliance, vendor assessment, and contract review.
Confirm service coverage
Ask CDS to verify the applicable agreement, covered services, and associated service-level terms.
Complete the acceptance process
Confirm how your organization should execute or accept the agreement before the service handles ePHI.
Keep your documentation
Retain the completed agreement with your vendor and compliance records.
Business Associate Agreement FAQs
Is a BAA Required for Encrypted Healthcare Backups?+
Yes, when the provider maintains ePHI on behalf of a covered entity or business associate. HHS states that encryption does not remove the provider’s business associate obligations—even when the provider does not hold the decryption key.
Does Signing a BAA Make Our Organization HIPAA Compliant?+
No. A BAA establishes obligations within a vendor relationship. Your organization must also address applicable risk assessments, safeguards, policies, workforce training, and incident response requirements. Our HIPAA-aligned backup service supports the backup component of that broader compliance program.
What Is the Difference Between a BAA and an SLA?+
A BAA addresses PHI handling and protection obligations. A service level agreement (SLA) defines service expectations, which may include availability, support, backup, and recovery responsibilities. The documents should be consistent. When reviewing disaster recovery solutions, ask CDS to confirm the recovery responsibilities and commitments included in your applicable service terms.
Take the Next Step Toward HIPAA-Aligned Data Protection
A signed BAA is only the start. Put the right safeguards and recovery capabilities behind it.
Free Cyber Vulnerability Assessment
Identify security gaps before they become incidents.
Get your free assessment →Healthcare Data Backup & Recovery
Explore backup and recovery built for healthcare organizations.
Explore healthcare solutions →Review Your BAA and Service Requirements With CDS
Get help confirming agreement applicability and the documentation needed for your healthcare backup services.
For a separate review of broader security exposure, request a free cyber vulnerability assessment.