{"head":{"title":"What Is a BAA? HIPAA Business Associate Agreements","description":"A BAA is the contract HIPAA requires between a covered entity and a vendor that handles PHI for it. What it must include, who signs one and common gaps.","canonical":"https://oceanlab.in/questions/what-is-a-baa"},"crumbs":[{"name":"Home","path":"/"},{"name":"Questions","path":"/questions"},{"name":"What is a BAA?","path":"/questions/what-is-a-baa"}],"question":"What is a BAA?","answer":["A BAA (business associate agreement) is the written contract HIPAA requires before a vendor creates, receives, keeps or sends ",{"href":"/glossary/phi","text":"PHI"}," for a covered entity or for another business associate. It limits how the vendor may use the data and binds it to safeguards, breach reporting and the same rules for its own subcontractors."],"sections":[{"heading":"What a BAA must say","body":[["45 CFR 164.504(e) lists what the contract has to cover. In plain words, the vendor must:"]],"bullets":[["Use and disclose PHI only as the contract allows or as the law requires."],["Use appropriate safeguards and follow the Security Rule for electronic PHI."],["Report any use or disclosure the contract does not allow, including breaches of unsecured PHI."],["Make sure its subcontractors that handle the PHI agree to the same restrictions."],["Help the covered entity give patients access to, and amendments of, their records, and an accounting of disclosures."],["Make its records available to HHS when asked, and return or destroy the PHI when the contract ends where that is feasible."]]},{"heading":"Who needs one in a software project","body":[["If you build software for clinics, health plans or their vendors and your systems touch PHI, you sign a BAA with your customer. Then every vendor below you that touches the same data needs one with you: cloud hosting, database, file storage, email and SMS, error tracking, analytics and any AI API."],["A software agency that only works on code and test data, and never accesses production PHI, may not need one. If engineers will see production data or support the live system, put a BAA in place."]],"bullets":[]}],"faqs":[{"question":"Is there an official BAA template?","answer":"HIPAA does not prescribe exact wording. Most vendors offer their own BAA; check that it covers everything 45 CFR 164.504(e) requires."},{"question":"Does a BAA make a vendor HIPAA compliant?","answer":"No. It is a contract. Compliance depends on how the vendor and you actually protect the data, which is why a risk analysis and technical safeguards still matter."},{"question":"Do I need a BAA with a vendor that only stores encrypted data?","answer":"Usually yes. The definition of a business associate covers vendors that maintain PHI, not only those that read or use it."}],"terms":[{"href":"/glossary/baa","label":"BAA"},{"href":"/glossary/phi","label":"PHI"},{"href":"/glossary/soc-2-type-ii","label":"SOC 2 Type II"}],"tools":[{"href":"/tools/hipaa-checklist","label":"HIPAA checklist","detail":"Free tool"},{"href":"/tools/hipaa-risk-assessment","label":"HIPAA risk assessment","detail":"Free tool"}],"links":[{"href":"/compliance/hipaa","label":"HIPAA guide","detail":"Who HIPAA applies to and what it asks of software."},{"href":"/glossary/business-associate","label":"Business associate","detail":"Glossary"},{"href":"/glossary/covered-entity","label":"Covered entity","detail":"Glossary"},{"href":"/software/clinics","label":"Software for clinics","detail":"Clinic systems, the rules that apply and how they are built."}],"related":[{"href":"/questions/can-i-send-phi-to-an-llm","label":"Can I send PHI to an LLM?","detail":"Question"},{"href":"/questions/does-my-app-need-hipaa","label":"Does my app need to be HIPAA compliant?","detail":"Question"},{"href":"/questions/how-much-does-a-telehealth-app-cost","label":"How much does a telehealth app cost?","detail":"Question"},{"href":"/compare/ai-agent-vs-workflow-automation","label":"AI agent vs workflow automation","detail":"Comparison"},{"href":"/compare/rag-vs-fine-tuning","label":"RAG vs fine-tuning","detail":"Comparison"},{"href":"/glossary","label":"Glossary","detail":"Every term, in plain words."}],"sources":[{"title":"45 CFR 164.504(e), Business associate contracts (eCFR)","url":"https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.504","checkedAt":"2026-10-25"},{"title":"45 CFR 164.502, Uses and disclosures of PHI (eCFR)","url":"https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502","checkedAt":"2026-10-25"},{"title":"45 CFR 160.103, Definitions (eCFR)","url":"https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103","checkedAt":"2026-10-25"}],"legal":true,"updatedAt":"2026-10-25"}