BAA (Business Associate Agreement)
A Business Associate Agreement (BAA) is a contract between a HIPAA covered entity and a business associate when the business associate performs services involving protected health information on the covered entity’s behalf, as defined by HIPAA.
When a BAA may apply
Whether a vendor is a business associate depends on the parties’ roles and activities, not simply on the fact that they provide interpretation. A service arrangement that creates, receives, maintains, or transmits protected health information for a covered entity may require a BAA. The covered entity and vendor should assess the actual data flow and applicable HIPAA rules.
A BAA does not by itself establish that a vendor’s security program is adequate or that either party has met every privacy obligation. Review the contract and operational practices with qualified privacy and legal staff.
What to review in an agreement
- What information the vendor may handle and for what purpose.
- Who may access it, including workforce members and subcontractors.
- Safeguards, permitted uses, disclosures, and retention or return of information.
- How incidents and breaches are reported and handled.
- Audit, cooperation, termination, and other terms required by the parties and law.
References
Let’s plan the conversation.
Share your setting, language needs, and timing with our team.