Business Associate Agreement (BAA)

What is a business associate agreement?

A business associate agreement (BAA) is a contract required by HIPAA, the US health privacy law. It is signed between an organization that handles health data and a vendor that gets access to that data while doing work for it.

HIPAA calls the first side a "covered entity." That means a health care provider, a health plan or a health care clearinghouse (HHS). The vendor is a "business associate." HHS lists cloud service providers that store or process electronic health data as one example (HHS guidance).

The data at stake is protected health information (PHI): health details that can be tied to a person. Before a covered entity shares PHI with a vendor, it needs "satisfactory assurances" in a written contract. That contract is the BAA (HHS guidance). The chain continues: a business associate needs its own BAA with any subcontractor that handles the PHI.

What it looks like in a vendor's terms

A typical clause reads like this:

Vendor will use and disclose PHI only to provide the Services or as required by law. Vendor will use appropriate safeguards to protect PHI and will report to Customer any use or disclosure not allowed by this BAA, including any breach of unsecured PHI. Vendor will require its subcontractors to agree to the same restrictions. At termination, Vendor will return or destroy all PHI, where feasible.

• "Only to provide the Services": the vendor cannot use health data for its own purposes, such as marketing.
• "Appropriate safeguards": the vendor must protect electronic PHI under the HIPAA Security Rule.
• "Report to Customer": the vendor must tell you about misuse and breaches. This is a form of breach notification clause.
• "Subcontractors": the same rules must flow down the chain. These are flow-down obligations.
• "Return or destroy": the data should not stay with the vendor after the contract ends.

These elements match the list in HHS's sample business associate agreement provisions, which HHS describes as sample language, not a required form.

Why it matters to you

If you handle PHI for a health care client, you are likely a business associate yourself. That means you need BAAs with the vendors that touch that data, such as your cloud host, your support desk or your messaging tool.

• Direct liability. HHS says business associates are directly liable for several HIPAA failures, including not reporting a breach and not signing BAAs with subcontractors that handle PHI (HHS fact sheet).
• Breach timing. Under the rule, a business associate must tell the covered entity about a breach without unreasonable delay and no later than 60 calendar days after discovery (45 CFR 164.410). Your client may ask you for a shorter window, so your vendors' BAAs need to support it.
• Plan cost. Some vendors sign a BAA only on their top plan. Slack says you must be on an Enterprise plan and have a signed BAA before using Slack with PHI (Slack Help Center). Notion says you must subscribe to its Enterprise Plan to be eligible to sign its BAA (Notion Help Center). Supporting one health care customer can push up your software bill.
• Feature gaps. A BAA may not cover every feature. Notion states that "Any Beta Services are not covered by the BAA" (Notion Help Center).

What to check

• Check which plan the vendor requires before it will sign a BAA, and price that plan into your budget.
• Ask for the list of products and features the BAA covers. Treat everything else, including beta and AI features, as off limits for PHI until confirmed.
• Read the breach reporting section. Note how fast the vendor promises to tell you and whether that fits what you promised your own clients.
• Check the vendor's subprocessor list and confirm the vendor has BAAs with the subcontractors that touch PHI.
• Confirm what happens to PHI at the end of the contract: return, deletion, and what the vendor keeps and why.
• Review any setup rules, such as required settings or places where PHI must not be entered, and share them with your team.

How Venpo helps

A BAA often depends on the vendor's online documents, such as its subprocessor list, security pages and product terms. Venpo monitors those public pages and emails you a plain-English alert when one changes, for example when a vendor adds a new subprocessor. You also get a change history per vendor that you can show your health care clients.