HIPAA and Business Associate Agreements

Explanation

Decide whether your Cloud Secure Edge deployment needs a BAA, and request one

  • Last validated: Oct 21, 2026
  • 6 minutes to read

The Health Insurance Portability and Accountability Act (HIPAA) applies to covered entities, such as healthcare providers and health plans, and to their business associates. Under HIPAA, an organization needs a business associate agreement (BAA) with each vendor that creates, receives, stores, or transmits protected health information (PHI) on its behalf.

Whether SonicWall Cloud Secure Edge (CSE) handles your PHI depends on the capabilities you turn on. Use this page to find out which of your CSE capabilities can see PHI, and to request a BAA from SonicWall.

Summary

  • Secure Private Access (SPA) transmits your application traffic to its destination. CSE does not inspect or store the application payload. Hosted Websites is the exception. CSE decrypts that traffic, processes the request URLs and the CSE authentication data, and keeps only the request URLs.
  • Secure Internet Access (SIA) inspects traffic content only when TLS decryption is on. If you turn on TLS decryption, you need a BAA.
  • SonicWall does not keep a standard BAA. Send your organization’s BAA form to your SonicWall account team, and SonicWall Legal reviews it. See Request a BAA.

Secure Private Access

SPA connects users to your private applications and servers. CSE offers two deployment models for SPA, and they differ in where your traffic goes:

  • Self-hosted Private Edge. The Access Tier runs in your own network. Application traffic goes from the user’s device to your Access Tier and never passes through SonicWall infrastructure.
  • Global Edge. Application traffic passes through the CSE Global Edge Network on its way to the Connector in your network.

On Global Edge, CSE handles your traffic as follows:

  • CSE reads connection metadata, such as user identity, device posture, and destination, to enforce your access policies.
  • CSE transmits the application traffic to its destination. CSE does not inspect, analyze, or store the application payload, including any PHI in it.
  • CSE buffers traffic only for as long as transmission requires.
  • For Hosted Websites, CSE decrypts each request at the Access Tier. Of the decrypted traffic, CSE processes only the request URL and the CSE authentication data, which contains no health information. CSE keeps only the request URL.
Capability What CSE processes What CSE retains
Service Tunnel Connection metadata, such as user, device, destination address, and port Connection events. No application payload.
Infrastructure services, such as SSH, RDP, and databases Connection metadata, such as user, device, and target service Connection events. No application payload.
Hosted Websites HTTP requests, which CSE decrypts at the Access Tier to authenticate users and enforce role-based access Access events, which can include request URLs. No request or response bodies.
Device Trust Device posture, such as operating system version, required running applications, and location at sign-in Device posture data

Hosted Websites: CSE decrypts Hosted Website traffic, and its access events can include request URLs. If your web application puts patient identifiers in its URLs, such as a medical record number in the path or query string, those identifiers reach CSE. Request a BAA in that case.

Secure Internet Access

SIA protects users as they browse the internet and use SaaS applications. SIA enforces its policies through Internet Threat Protection (ITP). What ITP can see depends on whether TLS decryption is on.

  • TLS decryption off. The desktop app sends only the domain, such as example.com, to ITP. ITP replies with allow or block, and the traffic itself never reaches CSE.
  • TLS decryption on. Traffic that matches the ITP policy passes through the CSE Secure Web Gateway (SWG). The SWG decrypts the traffic, inspects it, and re-encrypts it. ITP sees full URLs, downloaded files, and the account a user signs in with. Any of these can contain PHI.
Capability What ITP examines Needs TLS decryption
Category Blocking and Application Blocking Domain and its content category No
Domain entries in Domain Blocking and Bypass Domain No
Auto enabled threat protection Domain No
Geo-Blocking Destination IP address and its country No
URL entries in Domain and URL Blocking and Bypass Full URL Yes
Risk-based URL Filtering Full URL Yes
File Analysis in Malware Download Protection Content of downloaded files Yes
Require Approved Accounts for AI Apps Account the user signs in with Yes

The Internet Access Logs also depend on TLS decryption. With decryption off, each log entry records the domain. With decryption on, each entry records the full URL. CSE keeps these logs for up to 12 months.

If you turn on TLS decryption for any ITP policy, you need a BAA. With decryption on, CSE inspects content that can contain PHI and stores full URLs in the Internet Access Logs.

To limit the PHI that ITP inspects, add the domains of your health record systems and other PHI applications to Domain and URL Bypass in the ITP policy, as domain entries. ITP does not inspect or log traffic to a bypassed domain. See Step 3: Bypass. Bypass entries reduce what CSE sees, but you still need a BAA while decryption is on, because users can reach PHI on sites that are not on the list.

The HIPAA conduit exception

The HIPAA conduit exception covers vendors that only transmit PHI and hold it no longer than transmission requires, such as internet service providers. A vendor that qualifies for the exception is not a business associate for that service, so no BAA is needed for it.

SPA works as a transmission service. It uses connection metadata to enforce access and does not store the application payload. The exception is Hosted Websites. The most CSE keeps from Hosted Website traffic is the request URL, which it records in access events, such as the event for a blocked request. If your Hosted Website URLs contain PHI, CSE stores that PHI, so request a BAA. The SIA capabilities that need TLS decryption inspect content, so they are not transmission-only.

Your compliance and legal teams decide whether the conduit exception applies to your deployment, because the answer depends on the capabilities you turn on and on how your applications handle PHI. If they decide that you need a BAA, SonicWall reviews your form.

Request a BAA

BAA terms vary from one organization to the next, so SonicWall reviews the BAA form your organization provides. SonicWall does not have a standard BAA form.

  1. Use the tables on this page to list the CSE capabilities you plan to use.
  2. Send your BAA form to your SonicWall account team. If you do not know your account team, contact SonicWall Sales, or email Sales@sonicwall.com, or call +1-888-557-6642.
  3. SonicWall Legal reviews your form. If SonicWall needs changes, Legal works with your team directly or through your account team.

Include this information with your request:

  • Your BAA form, in an editable format if possible.
  • Your organization’s full legal entity name, including any suffix, such as Inc. or Ltd.
  • Your company address, including the suite number, city, state or province, postal code, and country.
  • The name and email address of the contact for the request.
  • The name and email address of the person who will sign the BAA, if you know it.

This page is for information only and is not legal advice.

Was this page helpful?