BAA for Captions: When You Need One and When You Don't

A business associate agreement (BAA) is a written contract that HIPAA requires between a covered entity, such as a clinic or health plan, and a vendor that handles protected health information (PHI) for it. If your captioning or transcription tool will touch PHI for a covered entity, you need a BAA with that vendor. If you caption a sermon, a conference keynote, a class or a staff meeting with no PHI involved, HIPAA’s BAA rule is usually not part of the picture.

That is the short answer. The rest of this guide helps you work out which side of the line your sessions fall on, what a BAA has to contain, and how to choose captions that fit.

TL;DR

• A BAA is required when a vendor creates, receives, maintains or transmits PHI on behalf of a covered entity or another business associate.
• The rule follows the data, not the technology. A cloud captioning tool is judged by what it handles, whether a human or software does the work.
• Churches, event organizers, schools and most business meetings usually are not covered entities, so their everyday captioning does not need a BAA.
• It does not finish it.
• Live Caption AI does not offer BAAs and is not a HIPAA-compliant service. It is built for accessibility at churches, events, classes and meetings.

Table of Contents

• What a business associate agreement is
• Do captions count? The rule follows the data
• Who usually does not need a BAA for captions
• What a captioning BAA has to cover
• A BAA is not a compliance certificate
• AI captioning versus human captioners: same duties, different workflow
• Where Live Caption AI fits
• What you get for everyday accessibility
• Perspective
• Plans and pricing
• Put captions in every seat
• A quick checklist before you caption
• FAQ
• Sources

What a business associate agreement is

HHS describes a BAA as a contract or other written arrangement through which a covered entity gets assurances that a business associate will appropriately safeguard PHI. HHS lists an independent medical transcriptionist as an example of a business associate. The HHS business associate FAQs also note that the Privacy Rule, at 45 CFR 164.504(e), requires the covered entity and business associate to enter into this written agreement.

Three terms matter:

• Covered entity: a health plan, a healthcare clearinghouse, or a healthcare provider that transmits health information electronically in connection with certain standard transactions.
• Business associate: a person or company that performs a function for a covered entity that involves PHI. Transcription is a classic example.
• PHI: individually identifiable health information held or transmitted by a covered entity or business associate.

If any of those three is missing from your situation, the BAA question usually answers itself.

Do captions count? The rule follows the data

Captions are speech turned into text. Whether that makes your vendor a business associate depends on what the speech contains and who you are.

HHS guidance on cloud computing says that cloud providers that create, receive, maintain or transmit electronic PHI on behalf of a covered entity or business associate must sign a BAA. That holds even if they store only encrypted data and do not hold the key. You can read it in the HHS guidance on HIPAA and cloud computing.

The test is about the function and the data. It does not say “human captioners need a BAA and software does not.” A live captioning service handling patient conversations for a hospital sits in the same category whether a person types or a model transcribes. Healthcare-focused vendors say the same: HIPAA Partners writes that live transcription and captioning services become business associates when they process, transmit or store patient information during healthcare interactions.

So the question to ask is not “is this AI or human?” Ask these instead:

1. Are we a covered entity, or a business associate of one?
2. Will patient information be spoken during the sessions we caption?
3. Would the captioning vendor create, receive, maintain or transmit that information for us?

Three yes answers mean you need a BAA before the session, and you need a vendor that signs one.

Who usually does not need a BAA for captions

Most people searching this phrase are not hospitals. They run a church service, a webinar or a community event, and someone mentioned HIPAA. Here is how the common cases look.

Churches and ministries

Many nonprofits are not subject to HIPAA at all. A healthcare law firm’s overview of nonprofit HIPAA rules explains that a nonprofit may become subject to the rules when it is a healthcare provider that electronically transmits health information in connection with a covered transaction. A congregation captioning its Sunday service is not doing that.

Churches do hear health news, though. Prayer requests mention surgeries and diagnoses. The same law firm notes that even when HIPAA does not technically apply, keeping medical information confidential is recommended, and written consent is a good privacy practice. A simple habit works well: ask people before you read their health details aloud, and tell your team how the captions and transcripts are handled.

Event organizers and AV companies

Conferences, trade shows, town halls and corporate events are not covered entities. Your attention goes to accessibility, accuracy on names and terms, and multilingual attendees. An AV company running captions for a client’s event should still ask the client one question up front: will this session include patient information from a covered entity? If yes, the client, not the AV crew, needs to decide whether the session can be captioned with a given tool.

Classes, universities and staff meetings

Student records fall under different rules than PHI, and most staff meetings never mention health data. Where a class is a clinical training session using real patient cases, treat it as a PHI question and involve your compliance officer.

Healthcare organizations

Hospitals, clinics, practices and health plans are where BAAs are standard. If your sessions include identifiable patient details and you are a covered entity, you need a vendor willing to sign one. That is a compliance decision for your privacy officer and counsel, not something a feature list can settle.

What a captioning BAA has to cover

HHS summarizes the required content of a business associate contract on its Business Associate Contracts page. A compliant agreement must:

• Establish the permitted and required uses and disclosures of PHI, and prohibit any other use.
• Require appropriate safeguards, including Security Rule requirements for electronic PHI.
• Require the vendor to report unauthorized uses or disclosures, including breaches of unsecured PHI.
• Make PHI available so individuals can exercise access, amendment and accounting rights.
• Make the vendor’s relevant internal practices, books and records available to HHS.
• Require return or destruction of PHI at termination, if feasible.
• Require subcontractors that handle PHI to agree to the same restrictions.
• Let the covered entity terminate if the vendor violates a material term.

HHS also publishes a model business associate agreement that shows how these points read in contract language. Your counsel will adapt it to your arrangement.

Extra points for captioning and transcription

Captioning has quirks that general vendor contracts miss. Law firm Foley & Lardner, writing about AI transcription tools in health care, advises that agreements should:

• Define who owns and controls recordings, transcripts, summaries and other outputs.
• Limit the vendor’s use and disclosure of the data.
• Set retention and deletion requirements that match your record-keeping duties.
• Address encryption in transit and at rest.
• Provide audit rights and breach-notification mechanisms.

The same article recommends mapping the data flow of any transcription tool: who controls each type of data, how access is granted, whether outputs become part of the medical record, and how deletion works across systems. That map is useful for any captioning setup, healthcare or not. It tells you where audio goes, where text goes and who can see either.

A BAA is not a compliance certificate

A common mistake is treating the BAA as the finish line. It is not. A HIPAA guide for app teams points out that a BAA does not configure the application, cover services outside its scope, perform your risk analysis or training, or transfer your obligations.

In practice, a BAA is one piece of a larger set: risk analysis, staff training, access controls, policies for when captions are used, and a plan for transcripts. The covered entity stays responsible for all of it.

AI captioning versus human captioners: same duties, different workflow

The legal duty attaches to handling PHI, so an AI captioning vendor that handles PHI for a covered entity has the same BAA obligation as a human captioning agency. The practical differences are in the workflow:

If a vendor cannot or will not sign a BAA, it should not be used for sessions with PHI from a covered entity. That is the safe default, and it is simple to follow.

Where Live Caption AI fits

Live Caption AI is a live captioning and translation app for churches, meetings, classes and events. The speaker runs it on a phone or laptop. Attendees scan a QR code and read captions on their own phones. No app. No account. No hardware to rent. No stenographer to book.

Here is what we are clear about, because it matters for this topic:

• We do not offer BAAs, and Live Caption AI is not a HIPAA-compliant service.
• It is an AI captioning tool. It is not certified or human-reviewed.
• It does not make an organization ADA-compliant on its own. It can be one part of an ADA effective-communication plan.
• Session audio is never stored.

Use it for the rooms where it fits best: worship services, community events, conferences, lectures, town halls and everyday meetings. If a session would put PHI from a covered entity through a captioning vendor, that session needs a vendor that signs a BAA, and your privacy officer should make that call.

If you want a deeper look at what to ask transcription vendors in healthcare, our guide to HIPAA-compliant transcription providers walks through the questions.

What you get for everyday accessibility

For the settings where a BAA is not the issue, the goal is simple: make sure everyone in the room can follow along. Here is what Live Caption AI gives you.

• Captions on every phone in the room. Share a QR code. Attendees read live captions on their own devices.
• Specialized vocabulary. A Worship & Ministry model, a Medical model and a Finance & Earnings model help with terms generic speech-to-text garbles. Custom Terms lets you enter up to 100 names, places and terms before you go live.
• Live translation. Pick one source language and one of 29 target languages per session. Viewers can switch between the original and the translation.
• Transcripts and summaries. Save and export transcripts as TXT, SRT, JSON or PDF. AI summaries are included.
• Audio privacy. Session audio is never stored.

Practical tips for a church or event team:

1. Load names of pastors, guests, songs, venues and sponsors into Custom Terms the day before.
2. Put the QR code on the screen, the bulletin and the seat-back signage.
3. Pick the translation language that matches your largest group of attendees.
4. Tell attendees at the start that captions are AI-generated, so they know what to expect.
5. Before you share a transcript, check it for personal details people did not expect to see published.

The last tip echoes the confidentiality habit from the church section: ask first, share carefully.

Perspective

We hear “do I need a BAA for captions?” more often than you might expect, and often from people who run a church, a conference or a classroom. They have heard the word HIPAA and want to do the right thing.

Our view is simple. Match the tool to the room. For worship services, community events, lectures and meetings, the biggest barrier is that someone cannot follow what is being said. A deaf or hard-of-hearing person, a visitor who speaks another language, or someone in a noisy hall. Live captions on their own phone remove that barrier in seconds. No hardware. No stenographer.

We are also direct about what we are not. Live Caption AI is an AI tool. It is not certified, not human-reviewed, and not a HIPAA service, and we do not sign BAAs. That clarity helps you. You know exactly where it fits, and you can build it into an accessibility plan with confidence.

Where it fits, we think it is hard to beat on value. Professional is $19.99 a month with unlimited captioning. The Worship & Ministry model and up to 100 Custom Terms mean the names your community uses show up correctly.

Ryan

Plans and pricing

Plans are published on our pricing page:

Need translation for a single event? One-off credit packs are available: 30 credits for $6.99, 60 credits for $11.99 and 120 credits for $19.99.

Put captions in every seat

If your goal is clear, accessible communication for a congregation, a conference or a classroom, start with the room. Open Live Caption AI on a phone or laptop, show the QR code and let people read along on their own screens.

Explore Live Caption AI

No app for attendees. No hardware. See the plans and details on the pricing page.

A quick checklist before you caption

• Are you a covered entity or a business associate of one? If no, HIPAA’s BAA rule generally does not apply to you.
• Will identifiable patient information be spoken? If no, captions are an accessibility choice, not a PHI workflow.
• If yes to both, do you have a signed BAA with the vendor, a risk analysis, and staff training?
• Do you know where audio, transcripts and summaries go, and who can see them?
• Have you told attendees that captions are AI-generated?
• Have you added names and terms to Custom Terms before going live?

FAQ

Do I need a BAA to caption a church service?

Usually not. Many nonprofits and churches are not subject to HIPAA, and a sermon is not a PHI workflow. If your church runs a health clinic that is a covered entity, talk to your privacy officer or attorney about those specific sessions.

Does a BAA make a captioning service HIPAA-compliant?

No. A BAA is a required contract, but it does not perform your risk analysis, train your staff or configure the tool for you.

Do AI captioning tools need a BAA like human captioners?

The duty follows the data, not the method. When a vendor creates, receives, maintains or transmits PHI for a covered entity, HHS expects a BAA, whether the transcription is done by a person or by software.

No. Live Caption AI does not offer BAAs and is not a HIPAA-compliant service. It is designed for accessibility at churches, events, classes and meetings, and session audio is never stored.

Can Live Caption AI be part of an ADA plan?

Yes, an organization can use it as part of its ADA effective-communication plan. It does not make an organization ADA-compliant on its own, and it is an AI tool, not a certified or human-reviewed service.

Sources

• HHS: Business Associates FAQs
• HHS: Guidance on HIPAA and Cloud Computing
• HHS: Business Associate Contracts
• HHS: Model Business Associate Agreement
• Foley & Lardner: AI Transcription Tools in Health Care
• HIPAA Partners: Captioning Services for Healthcare Providers
• Caspio: What a BAA Covers and Doesn’t

Recommended

• Festival Stage Captions That Meet ADA and Skip Stenographers
• Bilingual Church Captions: How to Caption Two Languages
• Creators: Use Captions, SDH, or Subtitles Correctly for Accessibility
• 5 Minute Test to Decide Open vs Closed Captions Before You Publish