What is a BAA?
A BAA (business associate agreement) is the written contract HIPAA requires before a vendor creates, receives, keeps or sends PHI for a covered entity or for another business associate. It limits how the vendor may use the data and binds it to safeguards, breach reporting and the same rules for its own subcontractors.
Last updated
What a BAA must say
45 CFR 164.504(e) lists what the contract has to cover. In plain words, the vendor must:
- 1Use and disclose PHI only as the contract allows or as the law requires.
- 2Use appropriate safeguards and follow the Security Rule for electronic PHI.
- 3Report any use or disclosure the contract does not allow, including breaches of unsecured PHI.
- 4Make sure its subcontractors that handle the PHI agree to the same restrictions.
- 5Help the covered entity give patients access to, and amendments of, their records, and an accounting of disclosures.
- 6Make its records available to HHS when asked, and return or destroy the PHI when the contract ends where that is feasible.
Who needs one in a software project
If you build software for clinics, health plans or their vendors and your systems touch PHI, you sign a BAA with your customer. Then every vendor below you that touches the same data needs one with you: cloud hosting, database, file storage, email and SMS, error tracking, analytics and any AI API.
A software agency that only works on code and test data, and never accesses production PHI, may not need one. If engineers will see production data or support the live system, put a BAA in place.
Check it for your case.
Read the official text.
- 45 CFR 164.504(e), Business associate contracts (eCFR)checked 2026-10-25
- 45 CFR 164.502, Uses and disclosures of PHI (eCFR)checked 2026-10-25
- 45 CFR 160.103, Definitions (eCFR)checked 2026-10-25
Common follow-up questions.
Is there an official BAA template?
HIPAA does not prescribe exact wording. Most vendors offer their own BAA; check that it covers everything 45 CFR 164.504(e) requires.
Does a BAA make a vendor HIPAA compliant?
No. It is a contract. Compliance depends on how the vendor and you actually protect the data, which is why a risk analysis and technical safeguards still matter.
Do I need a BAA with a vendor that only stores encrypted data?
Usually yes. The definition of a business associate covers vendors that maintain PHI, not only those that read or use it.
Related questions and guides.
- Can I send PHI to an LLM?Question
- Does my app need to be HIPAA compliant?Question
- How much does a telehealth app cost?Question
- AI agent vs workflow automationComparison
- RAG vs fine-tuningComparison
- GlossaryEvery term, in plain words.
- HIPAA guideWho HIPAA applies to and what it asks of software.
- Business associateGlossary
- Covered entityGlossary
- Software for clinicsClinic systems, the rules that apply and how they are built.
