Definition

Business Associate Agreement (BAA)

A Business Associate Agreement, or BAA, is the HIPAA-required contract between a covered entity and any vendor that handles protected health information on its behalf. The agreement spells out how the vendor may use PHI, the safeguards it must apply, its duty to report breaches, and what happens to the data when the relationship ends. Without a signed BAA, sharing PHI with that vendor is itself a HIPAA violation, regardless of how careful the vendor is. Cloud hosts, billing services, and analytics providers all typically sign one. A BAA does not transfer accountability; both parties remain answerable for protecting the information.