BAA
Business Associate Agreement, a HIPAA-required contract between a covered entity and any vendor that handles protected health information on its behalf.
A BAA defines the permitted uses of PHI, required safeguards, breach notification obligations, and subcontractor requirements. Every SaaS vendor, cloud provider, integration partner, and consultant that accesses PHI needs a BAA in place before any data flows. AWS, Azure, GCP, and most healthcare SaaS vendors offer standard BAAs. Not having a BAA in place is one of the most common HIPAA compliance gaps.
FAQ
- When is a BAA required?
- Whenever a business associate creates, receives, maintains, or transmits PHI on behalf of a covered entity. This includes cloud hosting providers, integration vendors, analytics platforms, and consultants with PHI access.