{"head":{"title":"What Is a BAA (Business Associate Agreement)? | OceanLab","description":"A BAA is the contract HIPAA requires between a covered entity and a vendor that handles its PHI. What it must contain, who needs one and common mistakes.","canonical":"https://oceanlab.in/glossary/baa"},"crumbs":[{"name":"Home","path":"/"},{"name":"Glossary","path":"/glossary"},{"name":"BAA","path":"/glossary/baa"}],"slug":"baa","term":"BAA (business associate agreement)","aka":["business associate agreement","business associate contract"],"category":"Compliance","short":"The contract HIPAA requires between a covered entity and a vendor that creates, receives, keeps or sends its PHI.","body":[["Under HIPAA a business associate is a person or company that handles ",{"href":"/glossary/phi","text":"PHI"}," on behalf of a covered entity: a software vendor, a cloud host, a billing firm or an AI provider processing patient data. 45 CFR 164.502(e) and 164.504(e) require a written contract, the BAA, before PHI is shared with them."],["The BAA says what the vendor may do with the PHI, requires it to use safeguards under the Security Rule, to report breaches and security incidents, to make its subcontractors agree to the same terms, and to return or destroy PHI when the contract ends."]],"why":["Without a BAA, sending PHI to a vendor is generally not allowed, even if the vendor is secure. For software teams this affects every service in the data path: hosting, databases, email, logging, analytics and LLM APIs. Each one that touches PHI needs to offer a BAA, and some only do so on certain plans."],"example":["A telehealth startup uses a cloud host, a transcription service and an LLM API to draft visit notes. Before any real patient data flows, it signs BAAs with the clinics it serves, and checks that all three vendors sign BAAs with it as their subcontractor."],"inBuild":null,"mistakes":[["Signing with customers but forgetting subcontractors such as the logging or email provider."],["Sending PHI to an AI API that does not offer a BAA, or on a plan that is not covered."],["Treating the BAA as the whole of compliance. It is a contract; the safeguards still have to be built."]],"related":[{"href":"/glossary/phi","label":"PHI (protected health information)","detail":"Health information that can identify a person and is created or held by a HIPAA covered entity or its business associate."},{"href":"/glossary/soc-2-type-ii","label":"SOC 2 Type II","detail":"An independent audit report on whether a service organisation's controls were designed well and worked over a period of time."},{"href":"/glossary/guardrails","label":"Guardrails (AI)","detail":"Checks placed around an AI model that block, fix or flag unsafe, off-topic or incorrect inputs and outputs."},{"href":"/glossary/maker-checker","label":"Maker-checker (four-eyes principle)","detail":"A control where one person makes a change and a different person must approve it before it takes effect."}],"tools":[{"href":"/tools/hipaa-checklist","label":"HIPAA checklist","detail":"Free tool"}],"links":[{"href":"/compliance/hipaa","label":"HIPAA guide","detail":"Who HIPAA applies to and what it asks of software."},{"href":"/compliance","label":"Compliance guides","detail":"What each rule means for the software you build."},{"href":"/software/clinics","label":"Software for clinics","detail":"Clinic systems, the rules that apply and how they are built."},{"href":"/questions/does-my-app-need-hipaa","label":"Does my app need to be HIPAA compliant?","detail":"Question"}],"sources":[{"title":"45 CFR 164.502, Uses and disclosures of PHI (eCFR)","url":"https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502","checkedAt":"2026-10-25"},{"title":"45 CFR 164.504(e), Business associate contracts (eCFR)","url":"https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.504","checkedAt":"2026-10-25"},{"title":"45 CFR 160.103, Definitions (eCFR)","url":"https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103","checkedAt":"2026-10-25"}],"legal":true,"updatedAt":"2026-10-25"}