Do home health agencies need a BAA with a staffing agency? Not always, and not never. The answer turns on who controls the clinician’s work, which means two agencies using the same staffing firm can land in different places and both be right.
A per diem nurse takes assignments from your scheduler on Monday, then carries assignments from two other agencies later the same week, opening each one’s EMR app on the same personal phone between visits. That is an ordinary month in a market as dense as the San Francisco Bay Area, and it is exactly the fact pattern that makes this question hard to answer from a contract alone.
It is worth answering carefully, because whoever issues the paycheck, a clinician reaching your patient records is your agency’s exposure. Healthcare remained the costliest sector to breach in IBM’s Cost of a Data Breach Report 2026, at an average of $6.64 million, a healthcare-wide figure rather than a home-health-specific one. The classification decision is what determines how that access gets controlled. Below are the ten questions home health and hospice agencies ask most often about where the line sits.
1. Do home health agencies need a BAA with a staffing agency?
Sometimes. A staffing agency is not automatically a business associate, and it is not automatically exempt either. The answer depends on control: whether the staffed clinician works under your agency’s direct control, or whether the staffing agency is handling patient information on its own account.
HIPAA’s underlying test is functional. It asks whether a party creates, receives, maintains, or transmits PHI on your agency’s behalf, in a capacity other than as a member of your workforce. That framework applies to every vendor and is covered in full in our guide to the HIPAA business associate agreement for home health agencies. The staffing case is unusual only because the workforce exception is genuinely in play.
2. What does HIPAA mean by workforce?
45 CFR 160.103 defines workforce as employees, volunteers, trainees, and other persons whose conduct, in the performance of work for a covered entity, is under the direct control of that entity, whether or not they are paid by it.
The phrase doing the work in that definition is whether or not they are paid. A clinician on a staffing agency’s payroll can still be part of your workforce, because payroll is not the test. Direct control over how the work is performed is the test. Members of your workforce are not business associates, and no agreement is required for them.
3. How do I tell whether a staffed clinician is workforce?
Look at who directs the work day to day. A staffed nurse who takes assignments from your scheduler, documents visits in your EMR under your credentials policy, and reports to your director of nursing is functioning as a member of your workforce rather than as a business associate.
Signs the clinician is workforce:
- Assignments come from your scheduler rather than from the staffing agency
- Clinical documentation happens in your instance of Axxess, WellSky, KanTime, Homecare Homebase, or MatrixCare, under your access policy
- Supervision and clinical escalation run to your director of nursing
- Your agency sets the standards the clinician’s work is measured against
- The staffing agency supplies the person and never touches the patient record itself
No agreement is required for that arrangement. Something else is required instead.
4. If the clinician is workforce, what does our agency have to do instead?
Treat the clinician as workforce in fact rather than only on paper. That means training on your policies, credentialing through your process, and access controlled by your agency exactly as it would be for a direct employee.
The workforce classification does not remove obligations. It moves them onto your agency. Instead of a contract with the staffing agency, you carry responsibility for the clinician’s HIPAA and security training, their named account, the scope of what they can reach, and the record showing all of it happened. Our guide to running security awareness training covers the training piece.
5. When is a staffing agency actually a business associate?
When it handles patient information on its own account rather than simply supplying a person who works under your direction. At that point the staffing agency is performing a function involving PHI on your agency’s behalf, and an agreement is required.
Common triggers:
- It pulls visit records from your system for its own billing or invoicing
- It runs its own scheduling or workforce platform that holds your patient data
- Its supervisors review your clinical documentation for quality or performance purposes
- It receives patient identifiers as part of matching clinicians to assignments
Where an agreement is required, both sides carry their own compliance obligations. Business associates have been directly liable since 2013, and that liability sits alongside your agency’s rather than replacing any part of it. The signed contract is also only the starting point, which is why our guide to verifying a business associate’s safeguards before you sign covers what to ask before patient data moves.
6. What if control is split between us and the staffing agency?
Split arrangements are common and entirely normal. The clinicians can be your workforce while the staffing agency is simultaneously a business associate for a separate function, such as its own billing. Both can be true of the same relationship at the same time.
Where control is genuinely shared and the answer is not clear, execute the agreement and document why you did. The cost of an unnecessary agreement is low in that situation, and the cost of a missing one is not. That judgment applies to real gray areas. It is not a reason to paper every staffing relationship by default, which creates a different problem.
7. Are per diem clinicians we engage directly considered workforce?
Usually yes. A per diem nurse or therapist your agency engages directly is workforce under the same direct-control test, regardless of tax treatment. Whether the clinician receives a W-2 or a 1099 does not decide the question.
This one trips agencies up because worker classification for tax and wage purposes and workforce status under HIPAA are separate determinations with separate tests. A clinician can be an independent contractor for IRS purposes and a member of your workforce under 45 CFR 160.103 at the same time, and neither answer settles the other.
8. What about contracted therapy companies providing PT, OT, or speech services?
Contracted therapy companies usually fail the workforce test. The therapists work under their employer’s direction rather than under yours, which makes the therapy company a business associate and puts an agreement in scope.
A second document causes real confusion here. Under 42 CFR 484.105(e)(2), a Medicare-certified home health agency must already have a written agreement with any organization furnishing services under arrangement to its patients, and must maintain overall responsibility for those services. Agencies frequently assume that contract covers HIPAA. It does not. The services-under-arrangement agreement is a Conditions of Participation document. A business associate agreement is a Privacy Rule document. Your agency needs both, and neither substitutes for the other.
9. What goes wrong if we paper the relationship the wrong way?
You create a written record that contradicts how the clinicians actually work. An agency that signs a business associate agreement covering clinicians who take assignments from its own scheduler and document in its own EMR has produced a document arguing against its own workforce position, and that document is discoverable.
The error runs in both directions. Treating a genuine business associate as workforce leaves a required agreement unsigned. Treating your own workforce as a business associate undercuts the training and access obligations the workforce classification actually carries.
Write the determination down either way, along with the reasoning behind it. The question recurs at every survey and every staffing change, and reconstructing the logic a year later from memory is how agencies end up answering it differently the second time.
10. How can an IT partner help, and what can it not do?
An IT partner cannot make the determination for you. Whether a staffing agency is a business associate depends on how the relationship works, and that judgment belongs to the agency.
An IT partner also cannot assume your HIPAA obligations. A BAA with your MSP does not move liability off the agency. What a partner supplies is the access control that makes a workforce determination hold up.
- Named accounts for staffed clinicians and never a shared login, since the workforce position holds only if your agency controls access
- Access scoped to assigned patients and time-limited to the assignment period
- Contracted therapy companies given their own accounts rather than borrowed credentials, since they are business associates on the access side
- Access records that evidence the control you claimed, so the position rests on system data rather than paperwork
Three questions worth asking before you sign:
- Will you sign a business associate agreement, and accept the same annual verification clause you would tell us to require of others?
- Will you review our vendors’ security attestations, or does that sit outside your scope?
- How do you provision and deprovision staffed clinicians who rotate through on short assignments?
Expect a provider to help support HIPAA compliance. Do not expect one to certify it.
“Shared logins is one of the most common items we run into. If a staffed nurse has her own login, sees only her assigned patients, and loses access the day the assignment ends, the workforce position holds up on its own. If four clinicians are sharing one credential, no agreement anybody signs is going to protect you.”
Brendan Duebner, President of IT Total Care
Not Sure Whether Your Home Health Agency Needs a BAA With a Staffing Agency?
IT Total Care works with home health and home hospice agencies across the San Francisco Bay Area on the access side of this question: named accounts for staffed and per diem clinicians, permissions scoped to the assignment, and access records that support the determination your agency made. Our home-based care IT support covers provisioning, deprovisioning, vendor security review, and the documentation surveyors ask to see. You can read more about our approach to healthcare IT.
Contact Us to talk through how your agency’s staffed and per diem clinicians are provisioned today.
