What is a business associate agreement (BAA)?
A business associate agreement (BAA) is the written contract HIPAA requires before a covered entity lets a vendor create, receive, maintain or transmit protected health information (PHI) on its behalf. It sets permitted uses, safeguards, breach reporting and other duties. A form or cloud provider needs one when it handles electronic PHI for a covered entity, even when stored data is encrypted and the vendor has no decryption key.
Last updated
- Required contents 9 items
- Governing rules 45 CFR 164.502(e)
- Applies to Vendors handling PHI
- Encrypted cloud data BAA still needed
- Keep signed copy 6 years
- Official certification None
What is a BAA?
A BAA is the written agreement between a covered entity and a business associate that handles protected health information on its behalf. HIPAA uses the agreement to document how that information will be safeguarded.
The definitions in 45 CFR 160.103 supply the agreement's context. Protected health information (PHI) is individually identifiable health information transmitted or maintained in any form or medium, including demographic information. A covered entity is a health plan, a health care clearinghouse, or a health care provider that transmits health information electronically in connection with a covered transaction, such as billing an insurer electronically.
A business associate is a person or company that creates, receives, maintains or transmits PHI on behalf of a covered entity. Under 45 CFR 164.502(e)(1), a covered entity may allow that work only after obtaining satisfactory assurance that the business associate will safeguard the information. Section 164.502(e)(2) says the assurance is documented through a written contract or other written agreement that meets 45 CFR 164.504(e).
The BAA records those assurances and the vendor's obligations. For plain-language meanings of covered entity, business associate and PHI, see the HIPAA glossary.
This information is general. Confirm how it applies to your practice with your own counsel or compliance lead.
Who needs a BAA, and who does not?
The HHS business associates guidance names kinds of service providers that are business associates when their work for a covered entity involves PHI, and disclosures that need no BAA. The rows below follow those roles and cases.
| Who | Needs a BAA? | Why |
|---|---|---|
| Cloud provider | Yes, when it handles PHI | HHS lists a cloud provider as a business associate. |
| IT vendor | Yes, when it handles PHI | HHS lists an IT vendor as a business associate. |
| CPA firm | Yes, when it handles PHI | HHS lists a CPA firm as a business associate. |
| Attorney | Yes, when it handles PHI | HHS lists an attorney as a business associate. |
| Medical transcription service | Yes, when it handles PHI | HHS lists medical transcription as a business associate service. |
| App developer working for the provider | Yes, when it handles PHI | HHS lists an app developer working for the provider as a business associate. |
| Another health care provider receiving PHI for treatment | No | HHS says no BAA is needed for a disclosure to another provider for treatment. |
| Postal service or another conduit | No | HHS says no BAA is needed for conduits such as the postal service. |
| Janitorial service with incidental access | No | HHS says no BAA is needed when a janitorial service's access is incidental. |
| Bank processing a payment | No | HHS says no BAA is needed for a bank processing a payment. |
| Health plan receiving a provider's disclosure for payment | No | HHS says no BAA is needed for this payment disclosure. |
What must a BAA say?
45 CFR 164.504(e)(2) lists nine required terms for the BAA. Each row below states one thing the contract must do.
| Requirement | What the BAA must do |
|---|---|
| Permitted and required uses | State the permitted and required uses of PHI by the business associate. |
| Other uses and disclosures | Bar the business associate from using or disclosing PHI other than as the contract allows or the law requires. |
| Safeguards | Require appropriate safeguards and compliance with the Security Rule for electronic PHI. |
| Reporting | Require the business associate to report impermissible uses and breaches under 45 CFR 164.410 to the covered entity. |
| Subcontractors | Require the business associate to bind its subcontractors to the same terms. |
| Patient rights | Require support for patients' rights of access, amendment and accounting of disclosures. |
| HHS access | Require the business associate to make its books and records available to HHS. |
| End of contract | Require the business associate to return or destroy PHI when the contract ends, where feasible. |
| Material violation | Let the covered entity end the contract for a material violation. |
Does an online form tool or cloud service need a BAA?
An online form tool or cloud service needs a BAA when it creates, receives, maintains or transmits electronic PHI for a covered entity. The HHS cloud computing guidance treats that cloud provider as a business associate even if it stores only encrypted data and has no decryption key.
Encryption does not remove the need for a BAA when a cloud service maintains electronic PHI. A covered entity that uses a cloud service to hold electronic PHI without a BAA is in violation of the HIPAA Rules. Before real patient details go into intake forms, the practice's vendor review needs to establish whether the form provider handles PHI on its behalf.
The conduit exception covers transmission-only services. It does not change the guidance for a cloud service that maintains electronic PHI. For a closer look at a general form tool, read Is Google Forms HIPAA compliant?. More background is collected in the intake and HIPAA guides.
Does a BAA certify a vendor or its software?
There is no official HIPAA certification for software. A BAA does not make a vendor HIPAA certified, and signing one does not replace the practice's responsibility for how it configures and uses the service.
A BAA is a contract. It documents the business associate's duties for PHI, while the practice still decides how it sets up and uses the tool. Those decisions include what patient information its forms request and which staff members use the submitted records.
When evaluating HIPAA-compliant forms, review the agreement alongside the product's security practices. Intake Pro is built for protected health information. Staff sign in with multi-factor authentication, every read is scoped to the practice and logged, files are encrypted at rest and connections use HTTPS. Each submission keeps a signed PDF and an audit trail.
How does a practice manager put a BAA in place with a form vendor?
A practice manager can put a BAA in place with a form vendor in five steps, before any real patient data goes into the tool. The practice's counsel or compliance lead reviews the agreement before anyone signs.
-
List vendors that handle PHI
Inventory the form, cloud, IT and other service providers that create, receive, maintain or transmit PHI for the practice. Include the online form and e-signature tools used during patient intake.
-
Ask each vendor for its BAA
Request the BAA for the service the practice plans to use. Gather the documents before setup so they can be reviewed together.
-
Read the BAA with counsel
Compare the document against the nine items in 45 CFR 164.504(e)(2). Cover permitted uses, safeguards, reporting, subcontractors, patient rights, HHS access, termination and the handling of PHI when the contract ends.
-
Sign before entering real patient data
Complete the agreement before entering real patient data. Intake Pro signs a BAA before you collect real patient data through its intake forms and e-signatures.
-
Keep the signed BAA
Keep the fully signed copy with the practice's HIPAA documentation. Under 45 CFR 164.530(j), the documentation period is six years from creation or the date it was last in effect, whichever is later.
Questions
When must a BAA be in place before a vendor handles PHI?
A covered entity must obtain satisfactory assurance before allowing a business associate to create, receive, maintain or transmit PHI. Section 164.502(e)(2) documents that assurance through a written contract or other written agreement meeting section 164.504(e).
Does a BAA requirement change when a cloud provider encrypts PHI?
No. A cloud provider that maintains electronic PHI for a covered entity is a business associate even when it stores only encrypted data and lacks the decryption key. Using that cloud service to hold electronic PHI without a BAA violates the HIPAA Rules.
Which subcontractor terms must a BAA include?
The BAA must require the business associate to bind its subcontractors to the same terms. This is one of the nine contract requirements listed in 45 CFR 164.504(e)(2), alongside safeguards, reporting and the other required provisions.
How long should a practice keep a signed BAA?
Keep the signed BAA with the practice's required HIPAA documentation for six years from the date it was created or the date it was last in effect, whichever is later. That documentation period comes from 45 CFR 164.530(j).
Does a BAA replace a practice's decisions about form setup?
No. The BAA is a contract documenting the business associate's duties for PHI. The practice still decides how it sets up and uses the tool, including the patient information its forms request and the staff members who use submitted records.