Business associate agreement (BAA)
A business associate agreement (BAA) is the written contract HIPAA requires between a covered entity and a vendor that creates, receives, maintains or transmits protected health information on its behalf.
Also called BAA, business associate contract
- Last reviewed
- 4 sources, linked
- 4 related terms
What it means
Under HIPAA, a business associate is a person or company that handles protected health information for a covered entity. Billing companies, record and cloud hosts and answering services are typical, and so are web, form, chat and call tracking vendors whenever they touch that information. A subcontractor handling it for a business associate is a business associate too.
The contract terms are set by regulation. The agreement must say what the vendor may do with the information, bar other uses, require safeguards and the reporting of breaches, pass the same limits down to subcontractors, and provide for the information to be returned or destroyed when the work ends.
HHS says a cloud provider that stores electronic protected health information is a business associate even when the data is encrypted and the provider holds no key. A vendor that will not sign a BAA cannot be given protected health information, however good its product is.
Why it matters for your website
List every service that touches your site's data: hosting, form handling, email delivery, chat, scheduling, call tracking, analytics and the CRM. Anything that receives a form submission or a recorded call about treatment either signs a BAA or never receives that data.
Ask a web partner directly whether it will sign one. If it builds forms that send health details anywhere, it should, or it should design the site so those details never pass through systems it runs.
Sources
The facts on this page about a law, a regulator, a clinical standard or a platform come from these sources. Each link opens the original in a new tab.
- Cornell Law School, Legal Information Institute45 CFR § 160.103, Definitions (covered entity, business associate, protected health information) (opens in a new tab)
- Cornell Law School, Legal Information Institute45 CFR § 164.504(e), Business associate contracts (opens in a new tab)
- U.S. Department of Health and Human ServicesBusiness Associates (opens in a new tab)
- U.S. Department of Health and Human ServicesFAQ 2076: If a CSP stores only encrypted ePHI and does not have a decryption key, is it a HIPAA business associate? (opens in a new tab)
Last reviewed
This entry explains a rule so you can plan a website around it. It is not legal advice: for a decision about your own program, ask a healthcare attorney.
See how your own site handles it
Send your URL for the free funnel review. Within two business days you get a 3-minute video on the page your traffic lands on, the three places it is losing inquiries, and what ChatGPT and Perplexity say about your center. It is free, and no call is attached.