What is a business associate agreement?
A business associate agreement is a contract HIPAA requires between a healthcare organisation and any vendor that creates, receives, stores or transmits protected health information on its behalf.
A BAA (HIPAA also calls it a business associate contract) sets out how the vendor must protect that information and what happens if it is breached.
Business associate vs covered entity
Covered entities are health plans, healthcare clearinghouses and healthcare providers that transmit health information electronically. A business associate is a person or company that handles protected health information for a covered entity, such as a billing firm, a cloud host or a software vendor. A business associate that hires its own subcontractor to handle that information needs a BAA with them too.
Who needs a BAA?
Any vendor that handles protected health information for a covered entity or for another business associate. The exceptions are narrow, such as one provider sharing information with another for treatment. If in doubt, assume you need one, and take legal advice on your specific case.
What goes in a BAA
- The permitted uses and disclosures of the information.
- A commitment to appropriate safeguards under the HIPAA Security Rule.
- Duties to report breaches and security incidents.
- The same terms flowed down to any subcontractors.
- Return or destruction of the information when the contract ends.
BAA requirements in practice
The BAA requirements come from the HIPAA Privacy and Security Rules, and signing one commits you to actually meeting them. Compliance as a Service for SMBs includes a HIPAA control library, and controls it shares with SOC 2 are tracked once rather than twice.
Last reviewed 2026-11-01.