HIPAA & privacy

What is a business associate agreement (BAA)?

A business associate agreement (BAA) is a contract required by HIPAA between a covered entity (or a business associate) and a vendor that will create, receive, maintain, or transmit protected health information (PHI) on its behalf. It sets out how the business associate will safeguard PHI and its breach-notification duties. You must have a signed BAA in place before sharing PHI with that vendor.

What a BAA covers

A BAA spells out the permitted uses of PHI, the safeguards the business associate must apply, its breach-notification obligations, the flow-down of terms to any subcontractors, and what happens to the PHI when the relationship ends (return or destruction).

Who needs one

A covered entity needs a BAA with each business associate that handles PHI on its behalf, and a business associate needs one with each of its subcontractors that do the same. The obligation flows down the chain.

Sign it before sharing PHI

The single most common mistake is sharing PHI with a vendor before a BAA is signed. If a vendor will store, process, or transmit PHI for you, get the BAA in place first.

FAQ