What is a Business Associate Agreement?
A Business Associate Agreement (BAA) is the contract HIPAA requires between a covered entity and any vendor that creates, receives, maintains or transmits protected health information on its behalf. It sets out what the vendor may do with that information and how it must protect it.
Who needs one
Covered entities are health plans, healthcare clearinghouses, and healthcare providers that carry out certain transactions electronically. A business associate is anyone that handles protected health information while providing a service to a covered entity: cloud hosting, billing, claims processing, clinical software, and lawyers or consultants with access to patient data.
The chain continues downstream. A business associate needs a BAA with each subcontractor that handles the same information. HHS guidance treats a cloud provider that stores electronic PHI as a business associate even if the data is encrypted and the provider holds no key. The exception for “mere conduits”, such as postal services and internet providers that only transmit data, is narrow.
What it must contain
HHS publishes sample BAA provisions that many organisations start from. The Breach Notification Rule requires a business associate to tell the covered entity about a breach of unsecured PHI without unreasonable delay and within 60 days of discovery, and many BAAs set a shorter window.
- Permitted uses. What the business associate may do with PHI, and a commitment not to use or disclose it otherwise.
- Safeguards. Appropriate safeguards, including compliance with the Security Rule for electronic PHI.
- Reporting. Reporting any use or disclosure the contract does not allow, including breaches of unsecured PHI.
- Subcontractors. Passing the same restrictions on to any subcontractor that handles PHI.
- Rights and records. Supporting patients’ rights of access and amendment, and making records available to HHS.
- Termination. Returning or destroying PHI at the end where feasible, and allowing termination for a material breach.
Signing and tracking them
Since the HITECH Act and the 2013 Omnibus Rule, business associates are directly liable for meeting the Security Rule and parts of the Privacy Rule. The BAA sets out who does what; it does not by itself make a vendor compliant.
A health-tech company selling to providers should expect to sign its customers’ BAAs or offer its own. It also needs to know which of its own suppliers touch PHI, including hosting, email, support tools and logging, and have a signed BAA with each. A simple register of supplier, date signed and services covered answers most audit and customer questions.
Questions
Business Associate Agreement (BAA), answered
Does signing a BAA make a vendor HIPAA compliant?
No. The BAA records the vendor’s obligations. Compliance depends on whether it actually meets them, through its risk analysis, safeguards and records.
Is a BAA the same as a GDPR Data Processing Agreement?
They do a similar job under different laws. Both govern a service provider handling regulated data for a customer, but the required terms differ, so a company with US health data and EU personal data often needs both.
Do we need a BAA with our cloud provider?
Yes, if it stores or processes PHI for you, even in encrypted form. The large cloud providers offer BAAs that usually cover only a listed set of services, so check that the services you use are on that list.
Working through this for an audit?
Talk it through with someone who has run the audit before, or look up another term.
- Each customer workspace has its own database
- Every change written to a tamper-evident activity log
- Auditors get scoped, read-only access
- AI suggestions wait for a person to accept them