A BAA OCR vendor is an OCR or document extraction service that will sign a business associate agreement and handle PHI under it. Choose one by asking where pages are stored, who can see them, which subprocessors touch them, how long they are kept and how incidents are reported, then compare each answer with what the contract actually says.
What separates a BAA OCR vendor from an ordinary OCR service?
A BAA OCR vendor differs from an ordinary OCR service in what it agrees to, not in how it reads text. Both turn a scanned page into text or fields. The BAA vendor also signs a contract that limits how it may use PHI, commits it to safeguards and incident reporting, and carries those duties down to its own subcontractors.
The contract terms come from the HIPAA rules. Under 45 CFR 164.504(e) on the eCFR, a business associate contract must establish the permitted uses and disclosures of PHI, require the business associate to use appropriate safeguards, report any use or disclosure the contract does not allow, ensure its subcontractors agree to the same restrictions, and return or destroy the PHI at the end of the contract if feasible. A clause-by-clause reading of that list is in the guide to which clauses a business associate agreement must contain.
The Security Rule adds duties for electronic PHI. 45 CFR 164.314 on the eCFR requires the contract to say the business associate will comply with the Security Rule, ensure its subcontractors agree to do the same, and report any security incident it becomes aware of. An ordinary OCR service that will not sign those terms cannot be sent PHI, however good its text recognition.
A signature is the start, not the finish. The software itself is neither compliant nor non-compliant on its own, a point the post on whether OCR is HIPAA compliant on its own explains. What matters is how the vendor runs the service around it.
Questions to ask a BAA OCR vendor before signing
The questions to ask a BAA OCR vendor before signing cover five areas: where pages are stored, who can see them, how long they are kept, what happens in an incident, and how the vendor describes its own status. Ask in writing, keep the answers, and check that each one matches a clause in the contract.
Here is a question script of twelve questions. The answers are examples of the kind you might hear, not quotes from any vendor.
| # | Question | A good answer sounds like | A red-flag answer sounds like |
|---|---|---|---|
| 1 | Will you sign our BAA, or only yours? | "Ours is standard; we will review yours and mark changes." | "We don't sign BAAs, but our service is secure." |
| 2 | Where are uploaded pages and extracted fields stored? | Names the hosting arrangement and region in writing. | "In the cloud." |
| 3 | Is our data stored apart from other customers' data? | Explains how it is separated and who holds the keys. | "Everything is in one database, it's fine." |
| 4 | Which of your staff can open our pages, and why? | Named roles, access granted per case, logged. | "Our whole team can help if needed." |
| 5 | Is every view, edit and export logged, and can we see the log? | "Yes, and you can export it." | "We log errors." |
| 6 | Who are your subprocessors, and do they all sign BAAs with you? | A written list, with a BAA or equivalent for each one that touches PHI. | "We can't share that." |
| 7 | Does any person key or review our pages, and where are they? | Names the team, its location and its contract terms. | "That's handled by a partner." |
| 8 | Do you use our pages to train or improve your models? | "No," or "only with your written consent," stated in the contract. | "Customer data helps improve the service for everyone." |
| 9 | How long do you keep source pages, and can we set that? | A default period and a setting to shorten it. | "We keep everything in case you need it." |
| 10 | What happens to our data when the contract ends? | Return or destruction, with confirmation in writing. | No answer, or "we keep backups indefinitely." |
| 11 | How and when will you tell us about a security incident? | A named contact, a time frame and a written process. | "We'd let you know." |
| 12 | How would you describe your compliance status? | "We sign a BAA; here is what is in place, here is what is not, and here is the evidence." | "We're HIPAA certified." |
The claims row
Question 12 is the one that sorts honest vendors fastest. In the 2003 HIPAA Security Rule final rule in the Federal Register, HHS renamed the proposed "Certification" standard to "Evaluation" and said it did "not intend to create certification criteria", so a vendor that leads with a "HIPAA certified" badge is describing its own marketing. A good vendor states what it signs and what it can show. Schema Care, for example, says on its compliance section of the homepage that it will not accept real patient data until a BAA is signed, and every Schema Care paid plan includes a BAA. Why audit reports and certifications are not the same as HIPAA compliance is covered in the guide to SOC 2 vs HIPAA.
The full security review, with the evidence to request for each area, belongs to what a healthcare vendor security questionnaire covers. The twelve questions above are the short list that decides whether that longer review is worth starting.
Where do an OCR vendor's subprocessors touch PHI?
An OCR vendor's subprocessors touch PHI wherever a page or an extracted field passes through a system the vendor does not run itself. The usual places are the host that stores files, any outside model or OCR engine the vendor calls, support and ticketing tools, email, and backups. Each one that handles PHI needs its own contract with the vendor.
The rule for this chain is written into the Security Rule. 45 CFR 164.308 on the eCFR says, in paragraph (b)(2), that a business associate may let a subcontractor create, receive, maintain or transmit electronic PHI on its behalf only if it obtains satisfactory assurances that the subcontractor will safeguard the information, documented in a written contract. The covered entity does not sign with the subcontractor directly. The vendor does.
Ask the vendor to map a single page through its service:
- Upload. Which system receives the file?
- Storage. Where does the file sit, and for how long?
- Processing. Does the vendor's own software read the page, or does it send the page or an image of it to another company's engine?
- Review. If a person checks low-confidence fields, whose staff are they, and what tool do they use?
- Support. If you open a ticket and attach a sample, where does that attachment go?
- Backups and logs. Do backups or error logs hold copies of pages or field values?
Support tools are an easy step to miss. A vendor may keep its main system tightly controlled while its help desk stores every screenshot a customer sends. Ask whether support staff can see your pages, and whether tickets can be kept free of PHI.
Model providers are the newest step. If the vendor sends pages to an outside model, ask whether that provider is under a BAA with the vendor, whether it keeps the inputs, and whether it may train on them. A vague answer here is a reason to stop.
Offshore data entry behind an OCR vendor
Offshore data entry behind an OCR vendor means people outside the country keying or checking fields that the software could not read. The HIPAA contract provisions in 164.504(e) and 164.314 attach to the subcontractor's role, not its location. What matters is that the vendor discloses the arrangement and that the offshore team is bound by the same contract terms.
An OCR service that advertises automation can still route hard pages to people. That is not wrong in itself. A handwritten intake form or a faxed lab page may need a human, and a human check is often safer than a guess. The problem is when the buyer does not know it happens.
Ask three things. First, does any person outside the vendor's own staff see the pages, and in which country? Second, is that team a subcontractor under a written agreement that carries the same restrictions as your BAA, as 164.504(e) requires for subcontractors? Third, what can that team do with the pages: view only, or download, print and store?
The text of the regulations does not name countries, so the decision about offshore work is a policy question for your own organization. Some organizations exclude offshore access in their contracts; others allow it with conditions. Your compliance officer or counsel should make that call, and the contract should record the answer either way.
The trade-off between paying people to key lab results and automating the work is weighed in the comparison of lab result data entry outsourcing vs automation. That post covers cost and turnaround; this section covers who sees the pages.
Red flags in a BAA OCR vendor's answers
Red flags in a BAA OCR vendor's answers are replies that avoid the question, promise what no one can promise, or contradict the contract. A vendor that will not name its subprocessors, claims a HIPAA certification, keeps data forever by default, or uses customer pages to train shared models without consent is not one to send PHI to.
Answers that avoid the question
"We take security seriously" is not an answer to "who can open our pages". Ask again, in writing, and expect a specific reply. A vendor that cannot describe its own access controls probably does not have them written down.
Certifications that do not exist
HHS does not certify HIPAA compliance. The Security Rule's evaluation standard in 164.308(a)(8) asks each covered entity and business associate to evaluate its own safeguards, and the 2003 final rule says an entity may do that with its own workforce or an outside evaluator. A vendor that leads with a certificate is describing marketing, whoever issued it. Ask instead for the evidence behind each claim: a signed BAA, an audit report if one exists, a recent risk analysis summary.
Contract terms that do not match the sales call
If the sales call says pages are deleted after thirty days but the contract says "retained as needed", the contract wins. Read the retention, subcontractor and termination clauses against the answers you collected. The technical safeguards in 45 CFR 164.312 on the eCFR give a useful checklist for this reading: access control, audit controls, integrity, person or entity authentication and transmission security.
Refusing a test on de-identified samples
A vendor confident in its product should let you test it on pages with no PHI before you sign anything. One that insists on real patient pages before a BAA is in place has the order backwards. Building a fair sample set is covered in the guide to de-identified sample documents for a pilot.
Pressure to sign quickly
A discount that expires this week is a sales tactic, not a reason. A vendor that is ready to handle PHI should be ready to wait while your compliance lead reads the BAA, checks the subprocessor list and asks the questions in the healthcare vendor security questionnaire.