Glossary
Business associate agreement (BAA)
Also called: Business associate contract
In one sentence
A BAA is the written contract HIPAA requires between a covered entity (like your practice) and any vendor that creates, receives, stores or transmits patient information on your behalf.
Under HIPAA, a business associate is any outside company that handles protected health information for you — your IT provider, your cloud email service, your billing company, your shredding service, your practice-management software vendor. Before that company touches patient data, HIPAA requires a written agreement (45 CFR 164.502(e) and 164.504(e)) that spells out what they may and may not do with it.
A BAA has to say, among other things, that the vendor will use the information only for the job you hired them to do, protect it with appropriate safeguards under the HIPAA Security Rule, report security incidents and breaches to you, pass the same obligations down to any subcontractors who touch the data, and return or destroy the information when the contract ends.
Why it matters for a small practice: if you share patient data with a vendor that hasn't signed a BAA, that's a HIPAA problem for you — even if the vendor never does anything wrong. It's also one of the first things an auditor or investigator asks for. Keep a simple list of every vendor that touches patient data and where each signed BAA lives.
Example: a dental office moves its email to Microsoft 365. Microsoft offers a BAA through its standard online terms for in-scope services, so the practice confirms it's in place. The office also signs a BAA with its IT provider, because the IT team can see mailboxes and files while fixing problems. The free webmail account the front desk used to use, with no BAA available, gets shut down.
Read more in our BAA guide for practices.
Related terms
- PHI (protected health information)PHI is any health information that can be linked to a specific person and is created or held by a healthcare provider, health plan or their vendors.
- ePHI (electronic protected health information)ePHI is protected health information that is created, stored, received or sent in electronic form — the data the HIPAA Security Rule exists to protect.
- HIPAA Security RuleThe HIPAA Security Rule is the federal regulation that sets the administrative, physical and technical safeguards healthcare providers and their vendors must use to protect electronic patient information.
- Security risk assessmentA security risk assessment is a structured review of where your sensitive data lives, what could go wrong with it, how likely and harmful that would be, and what you'll do about it.
- MSP (managed service provider)An MSP is an outside company that runs and supports your IT on an ongoing basis — help desk, monitoring, updates, security and planning — usually for a predictable monthly fee.