Business​‍​‌‍​‍‌​‍​‌‍​‍‌ Associate Agreement: What Is a BAA?

In healthcare, securing patient information is a law that applies not only inside hospitals but also to other parties involved.

A business associate agreement (BAA) is a vital contract that healthcare providers and their third-party vendors use to ensure compliance and data protection when sharing Protected Health Information (PHI). Sharing PHI without such an agreement poses huge legal risks to all parties.

What is a Business Associate Agreement (BAA)?

It is a contract, a business associate agreement, between a HIPAA-covered entity and a business associate. This contract’s main aim is that the business associate shall protect PHI properly that they get, create, keep, or communicate for the covered entity. Basically, it brings HIPAA compliance to any external party dealing with sensitive patient data.

HIPAA and Business Associate Agreement — The Legal Basis

What HIPAA Requires Regarding BAAs

According to HIPAA rules, covered entities must obtain satisfactory assurances that their business associates will safeguard PHI. These assurances should be documented in a written business associate agreement (baa).

Major Provisions of the HIPAA Privacy Rule

A BAA under the Privacy Rule should precisely state a business associate’s authorized and required uses of PHI. Besides, it is a condition the associate will not use or disclose the information in any way that would be a violation of the Privacy Rule if done by the cover entity.

Main Provisions of the HIPAA Security Rule

According to the Security Rule, business associates must establish administrative, physical, and technical safeguards. A business associate agreement hipaa need to mirror these requirements to guarantee the confidentiality, integrity, and availability of electronic PHI.

The HITECH Act and BAA Obligations

Previously, the contract primarily governed business associates. However, post-HITECH business associates can be held responsible for compliance with several HIPAA provisions directly. Additionally, HITECH raised penalties for non-compliance and required that subcontractors be treated as the primary business associate.

Learn about contract management software.

Protect Your PHI. Get Your Business Associate Agreement in Place Now.

Book a demo

Who is a Covered Entity?

Health Plans

Examples are health insurance companies, HMOs, employer-sponsored health plans, as well as government programs like Medicare and Medicaid.

Healthcare Clearinghouses

These are entities that receive health information in a non-standard format and convert it into a standard format or vice versa.

Healthcare Providers

Any person or business that offers medical or health services and electronically transmits health information in connection with a transaction covered by HIPAA (e.g., billing).

Hybrid Entities — Universities and Academic Medical Centers

These are large organizations that perform both HIPAA-covered and non-covered functions. They need to identify their “healthcare components” and ensure that those components are compliant with BAA rules when interacting with the rest of the organization or vendors outside.

Learn about 10 Best Contract Management Tools in 2026

By 2027, 50% of organizations will use AI-enabled tools for contract management.

— Gartner

What Is a Business Associate?

A business associate is any individual or organization that performs functions or activities for a covered entity requiring the use or disclosure of PHI.

Examples of Business Associates

• IT Providers: Cloud storage companies, software vendors, and managed service providers.
• Professional Services: Lawyers, accountants, and consultants who need access to health records.
• Administrative Services: Billing companies, transcription services, and third-party administrators.

Subcontractors and the Third-Party Chain

If a business associate hires another company to help with their work for a covered entity, that company is a subcontractor. HIPAA requires a business associate agreement to flow down through the entire chain.

Who Does NOT Qualify as a Business Associates

A workforce member of the covered entity (like an employee) is not a business associate. Also, entities that merely convey PHI, such as the US Postal Service or internet service providers, generally do not require a BAA.

BAA vs NDA — What Is the Difference?

Legal Basis and Scope of Protection

NDA (Non-Disclosure Agreement) is a typical civil contract, aimed at protecting trade secrets and proprietary information. By contrast, a BAA is a specific requirement under federal law, aimed at safeguarding patient privacy.

Penalties and Enforcement Differences

Breaking an NDA commonly leads to a private lawsuit for damages. On the other hand, a violation of a BAA or HIPAA rules can lead to large federal fines from the Office for Civil Rights (OCR) as well as criminal charges.

Can an NDA Replace a BAA? The Short Answer

Certainly not. An NDA does not meet the legal requirements of HIPAA. While it is common to have both, an NDA is lacking in specific PHI protections and the reporting obligations a business associate agreement helps satisfy.

What Must a Business Associate Agreement Include?

Basic Contract Information — Parties, Dates, and Signatures

The document should identify the covered entity and the business associate, including when the agreement starts.

Nature and Scope of PHI Involved

The BAA should specify the types of PHI shared and the purposes for which it is being done.

Permitted and Impermissible Uses of PHI

It should indicate that the business associate will not use or disclose PHI in ways other than those provided for in the contract or as required by law.

Security Safeguards and Technical Measures

The business associate shall undertake the use of suitable safeguards in order to avert unauthorized use or disclosure of the information.

Breach Notification Procedures and Timelines

The BAA must set the associate’s obligation to notify the covered entity of a “security incident,” or “breach” within a very specific time frame (e.g., 60 days or less).

Subcontractor BAA Requirements

The contract must guarantee that subcontractors who have access to the PHI are bound to the same restrictions and conditions.

Employee HIPAA Training Protocol

Many BAAs require the business associate to attest that their staff have been adequately trained in HIPAA compliance.

PHI Return and Destruction Procedures

After the contract terminates, the associate must return or destroy all PHI obtained from the covered entity.

Liability, Consequences and Indemnification Clauses

The contract should specify the actions to take in case of a breach, including the party responsible for costs related to notification and credit monitoring for impacted patients.

HIPAA Business Associate Agreement Template — How to Use One

What a Good BAA Template Must Cover

An excellent hipaa business associate agreement template should contain all of the provisions that the Department of Health and Human Services (HHS) requires.

How to Customize a Template for Your Organization

One business model is different from another. Therefore, you have to tweak the template a bit in case that your services and the data storage environment are different.

Free vs Attorney-Drafted Templates — Pros and Cons

Free templates might offer a basic skeleton, but an attorney-drafted business associate agreement template gives a superior protection against particular risks of your business as well as the local regulations.

Common Template Mistakes That Create Compliance Gaps

Being dated is a major risk when one uses a generic template that has not been updated since the HITECH Act. Covered entities are vulnerable to breaches in the case of templates, which are too vague about reporting breaches.

Common Business Associate Agreement Compliance Mistakes

Not Having a BAA When One Is Required

This is the single most widespread and costly error. By sharing PHI without a BAA, both sides are in direct violation of HIPAA.

Using Outdated or Generic Templates

Rules keep changing. It’s possible that an old BAA doesn’t cover new requirements related to electronic safeguards or the liability of subcontractors.

Ignoring the Subcontractor Chain

Covered entities should make sure their business associates have secured BAAs from subcontractors.

Vague Language Around Permitted PHI Uses

If a BAA is overly broad, it may inadvertently give a vendor permission to utilize patient data for marketing or research purposes, which is illicit.

Missing Breach Notification Requirements

If a BAA lacks a breach report timing and manner specification, the covered entity may fail to meet federal reporting deadlines.

Failing to Update BAAs When Services Change

The BAA must be in line with new/different processing of data, when the vendor’s role expands to consist of more types of data or different types of processing.

Best Practices for Managing Business Associate Agreements

• Maintain a Central Register: Keep a master list of every vendor that qualifies as a business associate.
• Set Up Automated Alerts: Use a system to notify you when a BAA is up for renewal or when a vendor’s security certifications expire.
• Conduct Annual BAA Audits: Regularly examine your BAAs to ensure that the terms remain accurate and that your associates are indeed following the security protocols stated in the contract.
• Train Staff: Your procurement and IT teams need to know exactly when a BAA is required before they sign a new vendor.
• Store BAAs Centrally: Employ a contract management system to keep all BAAs in one location for easy access during an audit or breach investigation.

See How Zapro Simplifies BAA Management

Get Started Now

FAQ

Is a business associate agreement required by law?

Yes. HIPAA stipulates that covered entities should have a written BAA before they share PHI with a business associate.

What is the difference between a BAA and an NDA?

A BAA is a federally mandated document for protecting health information under HIPAA, whereas an NDA is a general contract aimed at protecting private business information.

What must a HIPAA business associate agreement include?

It should specify the authorized uses of PHI, the requirements for security safeguards, the procedures for breach notification, and the necessity for subcontractors to sign similar agreements.

Does a business associate agreement need to be updated regularly?

Yes. It should be revisited and updated whenever the regulations change or the scope of the business relationship evolves.

What are the penalties for not having a business associate agreement in place?

OCR can impose fines from thousands to millions of dollars for each violation, depending on the degree of ​‍​‌‍​‍‌​‍​‌‍​‍‌negligence.