We can’t mishandle PHI we never receive.
The cleanest PHI architecture is the one where the vendor never touches protected health information. Blueprint runs inside your systems — the covered entity holds the PHI, not us — so there’s typically no business associate relationship and no BAA to negotiate.
Who says so: HHS — “the mere selling or providing of software … does not give rise to a business associate relationship if the vendor does not have access to the [PHI].” HHS FAQ 256 ↗
It all turns on one word: access.
HIPAA defines a “business associate” by whether you handle PHI. No handling, no relationship — and no BAA.
- A business associate creates, receives, maintains, or transmits PHI on behalf of a covered entity.
- HHS: “the mere selling or providing of software … does not give rise to a business associate relationship if the vendor does not have access to the PHI.”
- A covered entity must have a written BAA with any business associate.
- HHS names the triggers: the vendor hosts the software (and its PHI) on its own server, or accesses PHI when troubleshooting — then it is a business associate.
Why a hosted UI vendor becomes a business associate.
A hosted UI vendor that stores or proxies your screens’ data is handling PHI — and per HHS, even storing without viewing makes them a business associate. Now you need a BAA and they’re in your risk surface.
Remote support sessions, telemetry, or error logs that carry PHI quietly create a business-associate relationship you didn’t plan for.
The “conduit exception” (courier / ISP) is narrow and the wrong doctrine for a UI runtime — the correct basis is “no access to PHI,” not “we’re a conduit.”
Why Blueprint stays out of the BAA, point by point.
What a privacy officer sees: no PHI leaving your walls.
A change to the screen is a reviewable diff; the runtime that serves it receives nothing.
{ "type": "form", "id": "patient-intake", "fields": [ { "type": "text", "label": "Diagnosis" } { "type": "select", "label": "Diagnosis (ICD-10)" } ] }
PHI the vendor received
Data path
- Runs on-prem yes
- Vendor access to PHI none
- Telemetry with PHI none
The honest part
Blueprint isn’t “HIPAA-compliant” — HIPAA doesn’t certify software, and compliance is the covered entity’s obligation. What’s true: if Blueprint never accesses PHI (no vendor hosting, no PHI in support or telemetry), it isn’t a business associate, so there’s typically no BAA. Business-associate status turns on your actual deployment — confirm with your privacy officer or counsel. This page is informational, not legal advice.
The questions your compliance team will ask.
Are you HIPAA-compliant?
HIPAA doesn’t certify software — compliance is your obligation as the covered entity. Blueprint’s role is architectural: run on-prem, never touch PHI, so we aren’t a business associate.
Do we need a BAA with you?
Typically not — a vendor with no access to PHI isn’t a business associate (HHS FAQ 256). This depends on your deployment (no vendor hosting, no telemetry or support access to PHI); confirm with counsel.
What if support needs to see PHI?
Then that access would make us a business associate for that purpose, and a BAA would be required. The default is no access.
Does PHI in logs matter?
Yes — if error logs or telemetry carry PHI off your systems, that’s PHI handling. Blueprint’s default is no PHI egress; keep it that way.
Verify it yourself.
Every claim on this page traces to HHS or the Code of Federal Regulations.
- Software vendorsHHS FAQ 256 — Is a software vendor a business associate? — “providing software … does not give rise to a BA relationship if the vendor does not have access to the PHI.”
- BA definition45 CFR 160.103 (govinfo) — “creates, receives, maintains, or transmits PHI” on behalf of a covered entity.
- BAA45 CFR 164.502(e) (govinfo) — written BAA required with any business associate.
- Storage boundaryHHS — Cloud Computing guidance — even storing PHI without viewing it creates business-associate status.