Not always. It is not necessary to have a BAA to look up diagnosis information using patient data, so long as the data used maintains the patient’s anonymity.

For example, a doctor googling your symptoms doesn’t require a BAA with google.