Back to Glossary
Business Associate Agreement
A Business Associate Agreement is a HIPAA-required contract that protects patient information when it's shared outside a healthcare organization. It's an agreement between:
- a covered entity such as a healthcare provider, health plan or healthcare clearinghouse that uses or maintains patient health information, and
- a business associate or any vendor or partner that handles that information on the covered entity's behalf. This can include billing companies, IT service providers, consultants, e-signature tools and many others.
Protected Health Information (PHI) includes any information that can identify a patient, whether it's written, spoken or stored electronically. When PHI is electronic (called ePHI), the business associate must follow the HIPAA Security Rule, which requires strong administrative, physical, and technical safeguards such as access controls, encryption, and breach detection.
Why BAAs Matter?
Healthcare organizations rely heavily on vendors and a signed BAA is what makes it legally permissible for covered entities to share patient data with third parties. Without one, both sides face serious compliance risks and potential HIPAA penalties.
Recent breach data shows that hacking and unauthorized access incidents now account for nearly all large healthcare breaches, exposing millions of patient records. Because business associates often store or process large volumes of ePHI, a strong BAA is one of the most important tools organizations have to reduce risk.
What should be included in a BAA?
The BAA set the rules of the road for how the business associate can use, disclose, and protect PHI or ePHI. It requires the business associate to:
- use PHI only for the purposes the contract allows
- safeguard PHI and ePHI with appropriate security measures
- report improper uses, security incidents, or breaches
- ensure any subcontracts they work with to follow the same requirements
- return or securely destroy PHI at the end of the relationship
- allow the covered entity to end the agreement if the business associate fails to comply
In short, a BAA creates a trusted, accountable framework that makes it legally permissible to share patient information with third-party partners. It protects patients, reduces risk for both parties, and is one of the most important building blocks of HIPAA compliance in the healthcare industry.
Frequently Asked Questions
Who needs to sign a BAA?
A covered entity and any vendor that creates, receives, stores, or transmits protected health information on its behalf. That covers billing services, IT and hosting providers, cloud software, consultants, and e-signature tools. Subcontractors who touch the same data need their own agreements with the business associate, so the obligations follow the information down the chain.
What happens if you don’t have a BAA?
Sharing protected health information with that vendor isn’t permitted under HIPAA, and both sides are exposed. Regulators have treated a missing agreement as a violation in its own right, separate from any actual breach. You also lose the contractual terms that would have set breach notification duties and limits on how the vendor can use the data.
How do you keep track of signed BAAs?
Keep every executed BAA in one searchable place, linked to the vendor record and the underlying services agreement, with the signature date and any renewal or termination dates captured. Give someone ownership of reviewing that list on a schedule, because vendors change, services expand, and an agreement signed years ago may not describe what the vendor does now.
