Back to all glossary articles

Business associate agreement (BAA)

What is a BAA?

A business associate agreement or BAA is a contract between a HIPAA-covered organization and its business associates. It obliges both sides of the contract to protect personal health information (PHI) and comply with the guidelines provided by HIPAA.

BAAs require that:

  • A company dealing with PHI obtains sufficient assurances from its business associates
  • The business associate will safeguard the PHI on the company’s behalf

Under the HITECH Act (the Health Information Technology for Economic and Clinical Health Act), any HIPAA business associate automatically becomes subject to audits performed by the U.S. Department of Health and Human Services (HHS) and can be held accountable for any data breaches or improper handling of data.

What should be in a BAA?

HIPAA requires that every BAA contains certain elements. As we can read on the HHS website, the contract must:

  • Describe the business associate’s permitted and required uses of protected health information.
  • Provide that the business associate will not use or further disclose the protected health information other than as permitted or required by the contract or as required by law.
  • Require the business associate to use appropriate safeguards to prevent the use or disclosure of protected health information other than as provided for by the contract.

You may also like:

  • Privacy by design in practice: How “just enough” data beats “just in case” collection

    While collecting more data “just in case” feels safer, according to Matt Gershoff, it’s also one of the biggest sources of unnecessary compliance risk, analytical noise, and wasted organizational resources in the analytics industry today. His approach of “just enough” data collection is more intentional, more aligned with privacy regulation, and often more analytically effective.

  • 4 ways to make your analytics HIPAA-compliant: Implementation guide

    Healthcare organizations have four main approaches to achieving HIPAA-compliant analytics. Each has different trade-offs in cost, technical complexity, and analytics capabilities. This guide compares all four implementation methods – from using Google Analytics with workarounds to deploying fully HIPAA-compliant analytics platforms – so you can choose the right approach for your organization’s needs and resources.

Other definitions

Recent posts from Piwik PRO blog