What is a business associate agreement (BAA)?

BAA meaning and definition

BAA stands for business associate agreement. It is a written contract between a covered entity and a business associate, or between a business associate and its subcontractor. The HIPAA regulations call it a business associate contract. A covered entity is a health plan, a health care clearinghouse, or a health care provider that transmits health information electronically. A business associate is a vendor that creates, receives, maintains, or transmits PHI on the covered entity’s behalf. The rules for the contract sit in the Privacy Rule at 45 CFR §164.502(e) and §164.504(e). The Security Rule repeats them for electronic PHI at §164.308(b) and §164.314(a).

What a BAA covers

Section 164.504(e)(2) lists what the contract must say. It sets out the permitted and required uses and disclosures of PHI. It may not let the business associate do anything with PHI that would break the Privacy Rule if the covered entity did it. The business associate agrees to use or disclose PHI only as the contract allows or as required by law. It agrees to use appropriate safeguards, and to comply with the Security Rule for electronic PHI. It must report any use or disclosure the contract does not allow, including breaches of unsecured PHI. It must bind its subcontractors to the same terms. It must help the covered entity give patients access to their PHI, amend it, and account for disclosures. Where it carries out a covered entity’s Privacy Rule obligation, it must follow the rules that apply to the covered entity. It must open its books and records on that PHI to the Secretary of Health and Human Services. When the contract ends, it returns or destroys the PHI if that is feasible. The contract must also let the covered entity terminate it if the business associate violates a material term.

Breach reporting under a BAA

A business associate that discovers a breach of unsecured PHI must tell the covered entity (§164.410). It must do so without unreasonable delay, and no later than 60 calendar days after discovery. The notice identifies, to the extent possible, each individual affected and gives the covered entity what it needs to send its own notices. A BAA can set a shorter deadline than the rule, so read that clause before you sign. Your incident response plan has to meet it.

Who needs one

A covered entity needs a BAA with each business associate that handles PHI on its behalf, and a business associate needs one with each of its subcontractors that do the same. The obligation flows down the chain. Typical business associates include cloud hosting providers, billing companies, IT support firms, and SaaS products that store patient data. Your own employees are part of your workforce, so they are not business associates and do not sign one.

The duty continues after signing

Suppose a covered entity learns of a pattern of activity by its business associate that materially breaches the BAA. It must take reasonable steps to cure the breach. If those steps fail, it must end the contract where feasible (§164.504(e)(1)(ii)). A business associate owes the same duty about its subcontractors (§164.504(e)(1)(iii)). So keep a list of every BAA you hold, who it is with, and what that vendor does with PHI.

Sign it before sharing PHI

The single most common mistake is sharing PHI with a vendor before a BAA is signed. If a vendor will store, process, or transmit PHI for you, get the BAA in place first.

Where Keel fits

Keel’s HIPAA framework scores the business associate contract rules as requirements in their own right, including §164.504(e)(2) and both cure-or-terminate duties. You attach each signed BAA as evidence to the control that covers it. Keel is not a system of record for PHI. Keep PHI out of the evidence you upload and Keel does not act as your business associate.

FAQ