Disclaimer:  The following is not legal advice.  Please review the following informational material with a licensed attorney.

Who owns your data?  

Given today's litigious and legislative environment, this is not a insignificant question.

BAA language directly addresses the scope of data ownership questions.  There are two standard BAA boilerplates:
     - Software as a service (SaaS) and
     - Application Host Provider (AHP). 

A cogent summary of the legal ramifications are as follows:

CMS Submission process with standard SaaS BAA: You can easily also lose ownership and control of your clinical data; the common SaaS (software as a service) BAA used by other vendors makes data hostage situations more likely under many situations, including legal depositions and CMS data access requirements.

CMS Submission process with AHP BAA  Your organization retains ownership and control of your clinical data; our AHP (Application Host Provider) BAA eliminates data hostage situations, wherein you have full control over situations such as legal depositions and CMS data access requirements.

CMSGATEWAYS.COM  provides your organization with legal protection from legal exposure by using the AHP BAA.

More information on "Who owns data?" can be found here