BAA (business associate agreement)
Also called business associate agreement, business associate contract.
The contract HIPAA requires between a covered entity and a vendor that creates, receives, keeps or sends its PHI.
Last updated
What it is.
Under HIPAA a business associate is a person or company that handles PHI on behalf of a covered entity: a software vendor, a cloud host, a billing firm or an AI provider processing patient data. 45 CFR 164.502(e) and 164.504(e) require a written contract, the BAA, before PHI is shared with them.
The BAA says what the vendor may do with the PHI, requires it to use safeguards under the Security Rule, to report breaches and security incidents, to make its subcontractors agree to the same terms, and to return or destroy PHI when the contract ends.
Why it matters
Without a BAA, sending PHI to a vendor is generally not allowed, even if the vendor is secure. For software teams this affects every service in the data path: hosting, databases, email, logging, analytics and LLM APIs. Each one that touches PHI needs to offer a BAA, and some only do so on certain plans.
Common mistakes.
- 01
Signing with customers but forgetting subcontractors such as the logging or email provider.
- 02
Sending PHI to an AI API that does not offer a BAA, or on a plan that is not covered.
- 03
Treating the BAA as the whole of compliance. It is a contract; the safeguards still have to be built.
Read the official text.
Primary sources this definition is based on.
- 45 CFR 164.502, Uses and disclosures of PHI (eCFR)checked 2026-10-25
- 45 CFR 164.504(e), Business associate contracts (eCFR)checked 2026-10-25
- 45 CFR 160.103, Definitions (eCFR)checked 2026-10-25
Work it out with a tool.
Related terms.
- PHI (protected health information)Health information that can identify a person and is created or held by a HIPAA covered entity or its business associate.
- SOC 2 Type IIAn independent audit report on whether a service organisation's controls were designed well and worked over a period of time.
- Guardrails (AI)Checks placed around an AI model that block, fix or flag unsafe, off-topic or incorrect inputs and outputs.
- Maker-checker (four-eyes principle)A control where one person makes a change and a different person must approve it before it takes effect.
