HIPAA BAA at clinic signup: what it covers and what it does not
Click-through Business Associate Agreement before PHI-touching texting runs. Checklist for practice administrators comparing vendors.
· 2 min read · Updated
Every Echo clinic trial starts with a click-through Business Associate Agreement with Ekco Health Ltd. before any PHI-touching workflow runs. That includes check-ins, reorder texts, and clinic messaging on a number we issue.
Why the BAA comes first
Clinics need the same legal footing as with an EHR vendor: a signed BAA before names, phone numbers, or visit context move through a third party. We do not run a “connect your panel later” pilot without the agreement.
Posture details: Trust and security.
What a messaging BAA should cover
Under HIPAA (45 CFR 164.308(b), 164.314(a)), the agreement should address:
- Scope: The specific messaging product that will handle PHI
- Encryption: In transit and at rest in vendor systems
- Access controls and audit logs
- Subcontractors: Flow-down BAAs where subprocessors touch PHI
- Breach notification: Timelines and cooperation duties
- Termination: Data return or destruction
Echo covers patient texts from your issued clinic number (check-ins, refill nudges, links to your store), replies and flags for staff use to see who is on plan, and de-identified use only as your agreement allows.
Apple does not sign a BAA. iMessage may be the rail patients see. The contract for PHI in Echo systems is with Ekco Health Ltd.
Common clinic gaps (even with a BAA)
- Using consumer SMS or email marketing tools that refuse BAAs
- Assuming “encrypted” equals HIPAA compliant without access controls and audit trails
- Staff texting PHI from personal phones
- Skipping TCPA consent and STOP handling on patient lines
A signed BAA is necessary, not sufficient. Configuration and training are non-optional.
For administrators comparing vendors
If you are shopping HIPAA-compliant patient texting, the BAA should not hide behind a sales call only. Click-through at registration matches what clinics expect from clinical tools.
Lean appointment reminders with minimal PHI may be handled differently from clinical content in messages; document your policy with counsel.
Next step
Trust and security · HIPAA, SMS, and iMessage for clinics · Start for free
Common questions
- Does Echo sign a BAA?
- Yes. Click-through BAA at signup, before PHI-touching ekco or iMessage workflows run.
- Does Apple sign a BAA for iMessage?
- No. Ekco Health Ltd. signs the BAA for the Echo systems. Do not treat Apple as a HIPAA covered vendor for iMessage or iCloud.
- Is a signed BAA enough to be compliant?
- No. The clinic must configure the tool correctly, train staff, enforce minimum necessary, and maintain internal policies. A BAA does not immunize against misuse.
We cite public sources in the text where it matters. For operations and finance context only, not clinical, legal, or investment advice.
Keep reading
iMessage
iMessage for clinics: a more natural way to text patients
Patients already use Messages all day. A clinic number they recognize beats short codes and portal notifications. iMessage when supported, SMS when not.
· 4 min read
HIPAA
HIPAA, SMS, and iMessage for clinics: what practice owners need to know
A blue bubble is not a compliance certificate. What matters is PHI handling, BAAs, access controls, and clinic-controlled systems — not SMS vs iMessage alone.
· 4 min read
Patient texting
Automated patient texting for clinics: check-ins and refills without the busywork
Automate welcome texts, weekly check-ins, and running-low reminders with clinic-approved copy. Patients reply by text. Staff step in when someone needs a person.
· 4 min read
See it on your patients.
Two weeks free on your real patients. ekco texts on an Echo-issued number. Patients reply on iMessage.