HIPAA Basics for Insurance Agencies: What a BAA Covers
Most insurance agencies are not a HIPAA covered entity, but they become a business associate the moment they sign a carrier or FMO agreement. Here is what that BAA actually obligates you to do.
Does Your Insurance Agency Actually Need to Worry About HIPAA?
If your agents ever see a client's medications, diagnoses, or Medicare number while helping them enroll in a health plan, the answer is almost always yes. Most agencies are not themselves a "covered entity" under HIPAA, but they routinely become a business associate of the carriers and marketplaces they work with, and they take on contractual privacy and security obligations the moment they sign a producer or broker agreement. This post walks through what that actually means, what a Business Associate Agreement (BAA) covers, and the safeguards a small or mid-size agency needs in place before AEP or OEP starts.
Covered Entity vs. Business Associate: Where an Agency Fits
HIPAA's Privacy and Security Rules apply directly to "covered entities" — health plans, health care clearinghouses, and providers who transmit health information electronically — and to their business associates: any person or entity that performs a function on a covered entity's behalf involving the use or disclosure of protected health information (PHI). The U.S. Department of Health and Human Services (HHS) defines a business associate this way, and requires the covered entity to obtain "satisfactory assurances" from that business associate, in the form of a written contract, that PHI will be appropriately safeguarded before any PHI is shared with them (HHS.gov, Business Associates).
An independent agent or agency that helps a client apply for an ACA marketplace plan, a Medicare Advantage plan, or a life policy with health underwriting is, in practice, handling PHI on behalf of a health plan or carrier. That is usually why a carrier, FMO, or IMO will ask an agency to sign a BAA before appointing it — not because the agency decided compliance was optional, but because the contract requires it. Once that BAA is signed, the agency has taken on real, enforceable obligations, not just a formality to file away.
What a Business Associate Agreement Actually Obligates You To Do
A BAA is a contract, and its terms can be stricter than the baseline federal rule. In practice, the agreements agencies sign commonly include:
- A shorter breach notice window to the carrier or covered entity than HHS requires of the covered entity to individuals (see below) — often 24 to 30 days, so the covered entity has time to meet its own 60-day deadline.
- Written agreements with every subcontractor that also touches PHI on the agency's behalf — a call recording vendor, a dialer, an eSignature tool, a CRM.
- A defined turnaround on individual rights requests — access, amendment, and accounting-of-disclosures requests from the client themselves.
- Return or destruction of PHI at the end of the relationship, unless retention is separately required.
None of these obligations show up automatically in a generic "we take security seriously" policy. They have to be tracked against the actual agreement text, per subcontractor, with dates.
The Safeguards HHS Expects: Administrative, Physical, Technical
The HIPAA Security Rule organizes required and addressable safeguards into three categories. For a small agency, the practical version looks like this:
| Category | What it means for an agency |
|---|---|
| Administrative | A designated privacy/security contact, a written risk analysis, workforce training on what counts as PHI, and a documented incident response process. |
| Physical | Locked storage or screen locks for any device that can display client health data, and a policy for lost or stolen laptops and phones. |
| Technical | Access controls tied to job role, encryption of data in transit and at rest, and audit controls — a record of who accessed what PHI and when, required under 45 CFR 164.312(b) (eCFR, 45 CFR 164.312). |
Two things trip up agencies specifically. First, multi-factor authentication is not explicitly named in the 2003-era rule text, but it is the practical way most agencies satisfy the access-control and person-or-entity authentication standards on a shared CRM login. Second, "audit controls" is not optional paperwork — it is a named technical safeguard, and if a carrier or client ever asks who looked at a record and when, "we don't log that" is not an answer a business associate wants to give.
Documentation Retention: The Six-Year Rule
Whatever policies, risk assessments, and training records your agency produces to satisfy the Security Rule have to be kept somewhere for longer than most agencies assume. HHS regulation requires covered entities and business associates to retain HIPAA-related documentation — policies, procedures, risk analyses, training records, and the like — for six years from the date of creation, or from the date it was last in effect, whichever is later (eCFR, 45 CFR 164.316(b)(2)(i)). A training record from three years ago that has since been superseded by a new one still has to be kept — it does not fall off the clock until the newer version has itself been in effect for six years.
Breach Notification: The 60-Day Clock
If PHI is exposed — a laptop with client records is stolen, a spreadsheet with Medicare numbers is emailed to the wrong address — the Breach Notification Rule sets the deadline for telling the people affected. HHS requires notification "without unreasonable delay and in no case later than 60 calendar days following discovery of a breach" (HHS.gov, Breach Notification Rule). That 60-day clock is the outer limit that applies to the covered entity notifying individuals; the BAA an agency signs with its carrier or FMO will often set a shorter internal deadline for the agency to notify them, precisely so the covered entity has room to meet the federal deadline. Discovering the breach starts the clock — not confirming how bad it is, not finishing the investigation.
A Practical HIPAA Checklist for a Small Agency
This is not a substitute for legal advice, but it is the short list most small Medicare, ACA, and final expense agencies are missing at least one item from:
- ☐ A signed BAA on file with every carrier, FMO, or IMO that requires one — and with every vendor of your own (dialer, texting platform, eSignature, CRM) that touches PHI.
- ☐ A named person responsible for privacy and security, even if that is the agency owner.
- ☐ Role-based access so agents only see the households assigned to them, not the whole book.
- ☐ Multi-factor authentication on any system that displays health data.
- ☐ An audit log that records access, not just logins — and someone who actually reviews it.
- ☐ A written incident response process: who gets told first, and within how many days the carrier BAA requires notice.
- ☐ Annual (at minimum) HIPAA training for every agent and staff member, with dated records kept for six years.
- ☐ A retention and disposal policy for both paper and electronic PHI.
Record keeping obligations tend to stack: a carrier compliance audit will often ask about Scope of Appointment documentation in the same breath as PHI safeguards. If you have not tightened that up yet, see our guide to Scope of Appointment record keeping for the current AEP. And because a BAA is frequently tied to a specific carrier appointment, it is worth keeping license and appointment status current at the same time — here is how appointment tracking works so a BAA does not quietly outlive the appointment it was signed for.
Example: A Five-Agent Medicare Agency Building Its HIPAA Program
Consider an illustrative example: a five-agent Medicare agency that has been appointed with several carriers and just added an ACA book ahead of Open Enrollment. Its BAAs are scattered across email threads from three different FMOs, no one owns the checklist above, and the shared CRM login means an audit log would not actually show which agent looked at which client. Before AEP, the owner assigns one person to own compliance, moves everyone to individual logins with MFA, and starts logging every BAA with its signed date and renewal date in one place instead of an inbox. None of that changes what the agency sells — it changes whether the agency can answer a carrier's compliance audit, or a client's breach notification question, in an afternoon instead of a scramble.
How AgencyView Helps With This
AgencyView builds these safeguards into the platform rather than leaving each agency to assemble them: authenticator-app multi-factor authentication (required for agency administrators), role-based access on every page with denied attempts written to an audit log, a 60-minute idle session timeout with a two-minute warning, and a HIPAA Compliance Center where an agency owner can see active sessions, review incidents, track who has completed HIPAA training and when, run disclosure and retention reports, and keep a register of business associates and subcontractors alongside AgencyView's own signed BAA with the agency. There is no official HIPAA certification for software, and AgencyView does not claim one — compliance is a program your agency runs, and these are the records and controls that program needs. Learn more about AgencyView's HIPAA compliance tools, or see how AgencyView brings the rest of the agency together in one subscription.
FAQ
Is my insurance agency automatically a HIPAA covered entity?
Usually not. Most agencies are business associates of the health plans and carriers they work with, taking on HIPAA-related obligations through the BAA they sign rather than being directly regulated as a covered entity themselves.
What is a Business Associate Agreement, and do we really need one?
A BAA is the written contract HHS requires before a covered entity can share PHI with a business associate; it spells out how that PHI must be protected (HHS.gov). If your agency accesses client health information to enroll them in a plan, you need one with the carrier or FMO, and with any vendor that also touches that data on your behalf.
How fast do we have to notify clients if PHI is exposed?
The federal outer limit is 60 calendar days following discovery of the breach (HHS.gov), but your BAA with a carrier or FMO may require you to notify them well before that, so they have time to meet their own deadline.
How long do we have to keep HIPAA documentation?
Six years from the date a policy, risk analysis, or training record was created, or from the date it was last in effect, whichever is later (45 CFR 164.316(b)(2)(i)).
Is there a HIPAA "certification" a CRM can earn?
No. HHS does not certify software as HIPAA compliant. A vendor can provide the technical safeguards — access controls, audit logs, encryption — that a covered entity's or business associate's compliance program relies on, but compliance itself is a program the agency runs, not a badge a product holds.
Where AgencyView fits
Keep reading
- HIPAA-Compliant CRM: A Solo Agent's Pre-Sign Checklist
- HIPAA Compliant Call Recording for Insurance Agents
- Choosing an Insurance Agency CRM: The Evaluation Checklist