Glossary, regulation and privacy
What is a business associate agreement?
A business associate agreement (BAA) is the contract HIPAA requires between a covered entity, such as a US medical practice, and a vendor that creates, receives, keeps or sends protected health information on its behalf. It binds the vendor to safeguard that information and to use it only as the contract allows.
Updated . Defined by the wai team for clinics, groups and health systems.
Also called BAA or HIPAA business associate agreement.
Why Business associate agreement matters to a clinic
HIPAA defines a business associate by what it does with patient information on a covered entity's behalf,1 and a covered entity may share protected health information with one only under satisfactory assurances, in practice a written agreement.2 The required terms are set out in the Privacy Rule.3
For a practice, the BAA is the first document to ask a scribe, booking or messaging vendor for. The practice stays responsible for choosing vendors that will sign one, and for keeping the signed copy.
Questions
Does a BAA make a vendor HIPAA compliant?
No. HIPAA has no certification, and compliance depends on the practice's role, the signed agreements and the operating controls on both sides, with the BAA as the starting point. See security.
Does a UK clinic need a BAA?
No. A BAA is a US requirement. A UK clinic needs a data processing contract under UK GDPR, which plays a similar role.
Sources
See wai on your own clinic.
A 15 minute video call on your own diary, notes and inbox. Prices for clinics, groups and hospitals are on the pricing page.