Shared responsibility for HIPAA compliance

Healthcare operations glossary › Shared responsibility

In HIPAA, shared responsibility means a vendor secures its platform under a business associate agreement (BAA), while the practice still controls who has access, how staff are trained and how protected health information (PHI) is used. The phrase comes from cloud computing and vendor contracts. It is not a term defined in the HIPAA rules.

In practice at a clinic or small practice

The vendor's side. Take a staff chat tool covered by a signed BAA. The vendor encrypts data in transit and in storage, runs and maintains its infrastructure, and signs the BAA. Chanty is one example. Its BAA on the Business and Enterprise plans covers messages, files, voice notes, tasks and Teambook. Its Free plan has no BAA, so PHI should not go there.

The practice's side. Everything about how your people use the tool stays with you. In a normal week, that looks like this:

• The office manager sets roles and permissions so billing staff see billing channels, not HR conversations.
• A receptionist's last day is Friday. Her access is removed that afternoon, not whenever someone remembers.
• Someone with authority signs the BAA before anyone posts the first message that contains PHI.
• Staff lock their phones. A logged-in phone left on the break-room counter is the practice's problem, not the vendor's.
• Nurses and front desk staff are trained on what belongs in chat under the minimum necessary standard. A message like "Patient J.R. needs her 2:00 moved to Thursday" works. Pasting a full chart summary does not.

A common gap. Anything you connect to the chat tool sits outside the chat vendor's BAA. That includes a linked cloud storage folder and an automation service that copies messages into another app. Each of those vendors needs its own BAA if PHI will pass through it. AI agents connected to the workspace need a separate written agreement before they work with PHI.

Not to be confused with

Term	How it differs
Business associate agreement (BAA)	The contract that documents the vendor's obligations. Shared responsibility is the broader split of duties, including everything the BAA does not cover, such as your staff's behavior and your access decisions.
"HIPAA compliant" or "HIPAA certified" software	No tool makes a practice compliant by itself, and HHS does not certify software. Compliance depends on how the practice configures and uses the tool.

What the rules say

"Shared responsibility" has no definition in the HIPAA regulations. It is industry usage that describes how duties are divided in practice.

The rules themselves set out who must do what:

• A covered entity must obtain satisfactory assurances, through a business associate contract, that a business associate will appropriately safeguard PHI.
• Business associates are directly liable for certain HIPAA requirements, including Security Rule safeguards for electronic PHI.
• The covered entity keeps its own duties. These include conducting a risk analysis, running security awareness training, training its workforce on privacy policies, managing access and applying sanctions when staff violate policy.
• HHS has published guidance on cloud computing that discusses how responsibilities divide between a customer and a cloud service provider. Under the rules above, a provider's obligations under a BAA sit alongside the customer's own obligations; they do not replace them.

Signing a BAA does not hand over your risk analysis, staff training, offboarding or breach notification duties. Those stay with the practice.

Related reading

• Business associate agreement (BAA): what the contract must include and what to check before you sign one.
• Business associate: who counts as a vendor under HIPAA and when a BAA is required.
• How one staff chat vendor documents security and its BAA: a reference example of a documented split between vendor and customer duties.