:root{--green:#2F7D43;--green-dark:#276B38;--green-light:#EAF3EC;--green-mid:#B5D9BD;--green-xlight:#F1F5F2;--accent:#2F7D43;--slate:#12201A;--blue:#176B87;--danger:#B42318;--text:#000;--text-2:#34423B;--border:#DCE3DF;--bg-light:#F6F8F7;}
.cfy-page *{box-sizing:border-box;}
.cbp{margin:0;font-family:"Outfit",sans-serif;color:#000;line-height:1.7;}
.cbp .wrap{max-width:820px;margin:0 auto;padding:0 24px;}
.cbp h1, .cbp h2, .cbp h3{font-family:"Outfit",sans-serif;font-weight:700;color:var(--slate);line-height:1.25;}
.cbp-hero{background:linear-gradient(170deg,#fff 55%,var(--green-xlight) 100%);padding:64px 0 44px;}
.cbp-cat{display:inline-block;font-size:11.5px;font-weight:700;letter-spacing:.06em;text-transform:uppercase;color:var(--green);background:var(--green-light);border:1px solid var(--green-mid);padding:5px 13px;border-radius:100px;margin-bottom:16px;text-decoration:none;}
.cbp-hero h1{font-size:38px;margin:0 0 14px;}
.cbp-meta{font-size:13.5px;color:var(--text-2);}
.cbp-body{padding:44px 0 20px;}
.cbp-answer{background:var(--bg-light);border-left:4px solid var(--green);border-radius:10px;padding:20px 24px;margin:0 0 30px;}
.cbp-answer strong{display:block;font-family:"Outfit",sans-serif;color:var(--slate);font-size:14px;margin-bottom:6px;text-transform:uppercase;letter-spacing:.05em;}
.cbp-answer p{margin:0;font-size:16.5px;color:#000;}
.cbp-toc{border:1px solid var(--border);border-radius:10px;padding:18px 24px;margin:0 0 32px;background:#fff;}
.cbp-toc h2{font-size:14px;margin:0 0 10px;text-transform:uppercase;letter-spacing:.05em;color:var(--text-2);}
.cbp-toc ol{margin:0;padding-left:20px;}
.cbp-toc li{font-size:14.5px;margin-bottom:5px;}
.cbp-toc a{color:var(--green);text-decoration:none;font-weight:600;}
.cbp-body h2{font-size:25px;margin:36px 0 12px;}
.cbp-body h3{font-size:18px;margin:26px 0 8px;}
.cbp-body p{font-size:16.5px;color:#111;margin:0 0 16px;}
.cbp-body ul, .cbp-body ol{margin:0 0 18px;padding-left:22px;}
.cbp-body li{font-size:16px;color:#111;margin-bottom:8px;}
.cbp-key{background:var(--green-xlight);border:1px solid var(--green-mid);border-radius:10px;padding:20px 24px;margin:28px 0;}
.cbp-key h3{margin:0 0 10px;font-size:15px;text-transform:uppercase;letter-spacing:.05em;color:var(--green-dark);}
.cbp-key ul{margin:0;padding-left:20px;}
.cbp-key li{font-size:15.5px;color:#111;}
.cbp-warn{background:#fef2f2;border-left:4px solid var(--danger);border-radius:10px;padding:18px 24px;margin:24px 0;}
.cbp-warn h3{color:var(--danger);font-size:15px;margin:0 0 8px;}
.cbp-warn li, .cbp-warn p{font-size:15.5px;color:#B42318;}
table.cbp-t{width:100%;border-collapse:collapse;margin:22px 0;font-size:15px;}
table.cbp-t th, table.cbp-t td{border:1px solid var(--border);padding:11px 14px;text-align:left;vertical-align:top;}
table.cbp-t th{background:var(--bg-light);font-weight:700;color:var(--slate);}
.cbp-faq{margin:38px 0 0;border-top:2px solid var(--border);padding-top:26px;}
.cbp-faq h2{margin-top:0;}
.cbp-q{border-bottom:1px solid var(--border);padding:16px 0;}
.cbp-q h3{margin:0 0 6px;font-size:16.5px;}
.cbp-q p{margin:0;font-size:15.5px;color:var(--text-2);}
.cbp-related{background:var(--bg-light);border-radius:12px;padding:24px;margin:34px 0 0;}
.cbp-related h2{font-size:17px;margin:0 0 12px;}
.cbp-related ul{margin:0;padding-left:20px;}
.cbp-related li{font-size:15.5px;margin-bottom:7px;}
.cbp-related a{color:var(--green);font-weight:600;text-decoration:none;}
.cbp-cta{background:var(--green);border-radius:14px;padding:34px;text-align:center;margin:38px 0 10px;}
.cbp-cta h2{color:#fff;font-size:23px;margin:0 0 8px;}
.cbp-cta p{color:#EAF3EC;font-size:15.5px;margin:0 0 18px;}
.cbp-btn{display:inline-block;background:#fff;color:var(--green-dark);font-weight:700;padding:13px 26px;border-radius:8px;text-decoration:none;font-size:15px;}
.cbp-btn:hover{background:var(--green-xlight);color:var(--green-dark);}
@media(max-width:760px){.cbp-hero h1{font-size:28px;}.cbp-body h2{font-size:21px;}table.cbp-t{font-size:13px;}}
{"@context":"https://schema.org","@type":"FAQPage","mainEntity":[{"@type":"Question","name":"Does every vendor need a BAA?","acceptedAnswer":{"@type":"Answer","text":"Only those that can access PHI. A design tool with no PHI exposure does not, but be honest about incidental access."}},{"@type":"Question","name":"What if a vendor refuses to sign?","acceptedAnswer":{"@type":"Answer","text":"Then they cannot process PHI. In practice this means either changing vendor or architecting PHI out of that tool."}},{"@type":"Question","name":"Do we need a BAA with our own subcontractors?","acceptedAnswer":{"@type":"Answer","text":"Yes. If you are a business associate and you engage subcontractors who touch PHI, the same obligations flow down."}},{"@type":"Question","name":"Is a BAA enough on its own?","acceptedAnswer":{"@type":"Answer","text":"No. It is a contractual control. You still need the safeguards, risk analysis and monitoring behind it."}}]}
HIPAA
What is a Business Associate Agreement (BAA)?
Short answer
A Business Associate Agreement is a contract HIPAA requires between a covered entity and any vendor that creates, receives, maintains or transmits protected health information on its behalf. It must be executed before PHI access begins and must flow down to subcontractors.
What a BAA must contain
HIPAA specifies required provisions. A generic vendor agreement with a confidentiality clause is not a BAA.
- Permitted and required uses and disclosures of PHI
- A commitment not to use or disclose PHI beyond what is permitted
- Requirement to implement appropriate safeguards
- Obligation to report breaches and security incidents
- Flow-down of the same obligations to subcontractors
- Return or destruction of PHI at termination
- Availability of records to the regulator
Who needs one
The test is access to PHI, not the vendor category. If a tool can see PHI, even incidentally, it needs a BAA.
- Cloud hosting, storage and database providers
- Email and collaboration platforms
- Support and ticketing systems
- Analytics or monitoring tools running on authenticated pages
- Contractors and consultants with production access
Timing is the compliance point
The BAA must be signed before the vendor touches PHI. Executing one after the fact does not remediate the exposure period, and this is exactly the pattern regulators pursue after a breach.
Where teams get caught
- A tool trialled on production data before procurement completes
- A vendor whose free tier does not include a BAA
- A subcontractor engaged by your vendor with no flow-down
- Auto-enabled vendor features that begin processing new data
Managing them at scale
Once you pass a handful of vendors, tracking BAAs in email becomes the failure point. Keep a register with vendor, PHI access scope, BAA status, signature date and renewal date, and reconcile it against your actual vendor list at least annually.
Key takeaways
- A BAA is mandatory before any vendor touches PHI.
- Confidentiality clauses do not satisfy the requirement.
- Obligations must flow down to subcontractors.
- Track BAAs in a register, not an inbox.
Frequently asked questions
Does every vendor need a BAA?
Only those that can access PHI. A design tool with no PHI exposure does not, but be honest about incidental access.
What if a vendor refuses to sign?
Then they cannot process PHI. In practice this means either changing vendor or architecting PHI out of that tool.
Do we need a BAA with our own subcontractors?
Yes. If you are a business associate and you engage subcontractors who touch PHI, the same obligations flow down.
Is a BAA enough on its own?
No. It is a contractual control. You still need the safeguards, risk analysis and monitoring behind it.
Get audit-ready in 8 to 12 weeks
Certifyi pairs the platform with a named compliance lead, with transparent, scope-based pricing.
Book a readiness call Start the free self-assessment