Business Associate Agreement (BAA)

A business associate agreement, or BAA, is a written contract required by the HIPAA rules between a covered entity, such as a medical or dental practice or a health plan, and a business associate, a vendor that creates, receives, keeps or sends protected health information on the covered entity's behalf. The US Department of Health and Human Services publishes guidance on what these contracts must contain.

Who needs one

Any vendor whose service involves protected health information: a billing company, a cloud host, an email or texting platform used for patient messages, an AI provider that processes patient notes, and an automation agency that builds or runs systems touching patient data. Vendors of business associates, called subcontractors, need their own agreements too.

What it covers

Permitted uses and disclosures of the information, safeguards the vendor must use, reporting of breaches and security incidents, the vendor's obligations for subcontractors, access and amendment support, and return or destruction of the information when the contract ends.

What it does not do

A BAA does not make a tool compliant on its own. It sets obligations. The practice still has to configure the tool correctly, limit who can access what, keep the minimum necessary data and review logs. Many software products only sign BAAs on specific plans, or only cover certain features, so check which products and settings are in scope.

For AI and automation projects

the questions are concrete: which vendors see patient data, does each one sign a BAA, does the model provider keep or train on inputs, where are logs stored and who can read them. If any vendor in the chain will not sign, patient data should not flow through it.

In our builds

we list every vendor that will touch patient data before the work starts, confirm agreements are in place, and design the workflow so data that does not need to leave a system stays there.