BAA (Business Associate Agreement)

A Business Associate Agreement is a HIPAA-required contract between a covered entity and any third party that creates, receives, maintains, or transmits PHI on the covered entity's behalf. The BAA sets out the business associate's contractual obligations for safeguarding PHI. Business associates are also directly liable for certain HIPAA requirements under the HITECH Act and the 2013 Omnibus Rule, independently of the agreement. Software vendors handling ePHI for healthcare customers typically sign a BAA before integration.