A business associate agreement (BAA) is the written contract HIPAA requires between a covered entity, such as a clinic or health plan, and a vendor that creates, receives, maintains or transmits protected health information for it. It limits what the vendor may do with the data and binds it to safeguards, breach reporting and return or destruction at the end.
What a business associate agreement says in plain terms
A business associate agreement says, in plain terms, what a vendor may do with a covered entity's patient information, what it must protect, what it must report, and what happens to the data when the work ends. The covered entity signs it with the vendor, and the vendor signs a matching one with any subcontractor that touches the same data.
The duty to have one comes from 45 CFR 164.502 on the eCFR. Paragraph (e)(1)(i) lets a covered entity share protected health information (PHI) with a business associate "if the covered entity obtains satisfactory assurance that the business associate will appropriately safeguard the information". Paragraph (e)(2) says those assurances "must be documented through a written contract or other written agreement or arrangement".
The parties are defined in 45 CFR 160.103 on the eCFR. A covered entity is "a health plan", "a health care clearinghouse", or a health care provider "who transmits any health information in electronic form in connection with a transaction covered by this subchapter". A business associate is a person who handles PHI on the covered entity's behalf, "other than in the capacity of a member of the workforce".
The agreement can stand alone or sit as an addendum to a main services contract. The services contract says what the vendor does. The BAA says how the vendor treats the PHI it touches while doing it. A BAA does not replace the services contract, and a services contract with a privacy paragraph does not replace a BAA unless it contains the required terms.
When does a document vendor need a BAA?
A document vendor needs a BAA when it creates, receives, maintains or transmits PHI on a covered entity's behalf. A company that scans, reads, extracts, keys, indexes or stores medical paperwork for a clinic, a billing service or a health plan usually fits that description, because the paperwork itself carries patient identifiers.
The definition in 45 CFR 160.103 names the activities directly. A business associate handles PHI "for a function or activity regulated by this subchapter, including claims processing or administration, data analysis, processing or administration, utilization review, quality assurance", and also "billing, benefit management, practice management, and repricing". It also covers a person who provides "legal, actuarial, accounting, consulting, data aggregation", "management, administrative, accreditation, or financial services" where the service involves disclosing PHI.
Read against document work, that covers most vendors in the chain:
- A scanning bureau that digitizes paper charts maintains PHI.
- An extraction service that reads EOBs and claims into fields receives and creates PHI.
- An outsourced data-entry team that keys intake forms receives PHI.
- A cloud service that stores the scans maintains PHI.
- A records retrieval or abstraction company that reads charts for a client receives PHI. Services of this kind are compared in the guide to clinical data abstraction companies.
Storage counts even when no one looks. The 2013 HIPAA Omnibus Rule says "an entity that maintains protected health information on behalf of a covered entity is a business associate and not a conduit, even if the entity does not actually view the protected health information". You can read that in the 2013 HIPAA Omnibus Rule in the Federal Register.
The trigger is PHI. If a vendor receives only information that has been de-identified under 45 CFR 164.514, the Privacy Rule's requirements "do not apply" to it, per 164.502(d)(2). How de-identification works, and what it removes, is covered in Safe Harbor vs Expert Determination and the 18 HIPAA identifiers.
Before signing, most of the useful work is in the questions you ask. A list of them is in questions to ask a BAA OCR vendor before signing.
Which clauses must a business associate agreement contain?
A business associate agreement must contain the terms listed in 45 CFR 164.504 on the eCFR, paragraph (e)(2). They set the permitted uses, bind the vendor to safeguards and reporting, pass the same terms to subcontractors, support patients' rights, open the vendor's records to HHS, and require return or destruction of PHI at termination.
The table lists each required clause with its citation and what to look for in a vendor's draft. The "look for" column is a reading aid, not legal advice.
| Required clause | Citation | What to look for in the vendor's draft |
|---|---|---|
| Permitted and required uses and disclosures; no use that would violate the rule "if done by the covered entity" | 164.504(e)(2)(i) | A specific description of the service, such as reading EOBs and claims into fields, not a blanket grant |
| Use for the vendor's own management and administration, if allowed | 164.504(e)(2)(i)(A), (e)(4) | Whether the draft adds this, and the limits on it |
| Data aggregation for the covered entity's health care operations, if allowed | 164.504(e)(2)(i)(B) | Whether it is included and why the service needs it |
| No use or further disclosure beyond the contract or the law | 164.504(e)(2)(ii)(A) | The same wording, with no added rights for product development |
| Appropriate safeguards and compliance with subpart C (the Security Rule) for electronic PHI | 164.504(e)(2)(ii)(B) | A reference to subpart C, not a looser "reasonable efforts" phrase |
| Report uses or disclosures not provided for, "including breaches of unsecured protected health information as required by § 164.410" | 164.504(e)(2)(ii)(C) | Who is notified, how, and within what period |
| Subcontractors agree to "the same restrictions and conditions" | 164.504(e)(2)(ii)(D) | A flow-down clause and how you learn who the subcontractors are |
| Make PHI available for patient access under 164.524 | 164.504(e)(2)(ii)(E) | How fast the vendor will produce a record you ask for |
| Make PHI available for amendment under 164.526 | 164.504(e)(2)(ii)(F) | How a correction reaches the vendor's copy |
| Make information available for an accounting of disclosures under 164.528 | 164.504(e)(2)(ii)(G) | What disclosure records the vendor keeps |
| Comply with the Privacy Rule where it carries out a covered entity's obligation | 164.504(e)(2)(ii)(H) | Whether the service does any such task |
| Make internal practices, books and records available to the Secretary | 164.504(e)(2)(ii)(I) | The clause, unchanged |
| Return or destroy PHI at termination, "if feasible", or extend protections if not | 164.504(e)(2)(ii)(J) | Timelines, backup copies, and proof of destruction |
| Covered entity may terminate if the vendor "has violated a material term" | 164.504(e)(2)(iii) | A termination right that is not buried behind long cure periods |
Two clauses deserve extra reading on document work. The return-or-destroy clause should cover every copy the vendor makes: original scans, extracted fields, review queues, exports and backups. The breach-reporting clause sets how a problem reaches you. What a business associate has to report, and when, is covered in what a business associate must report to the covered entity.
As one example of how a vendor states its own rule, Schema Care's compliance section says: "We won’t accept real patient data until a BAA is signed with you." Each of its paid plans on the pricing section lists a BAA as included.
Business associate agreement edge cases: conduits, subcontractors and pilots
Business associate agreement edge cases sit at the edges of the definition. A conduit that only carries data does not need a BAA. A subcontractor of a vendor does, signed with the vendor. And a trial of a document vendor needs one as soon as real patient paperwork is involved, because the rule turns on PHI, not on contract stage.
Conduits
The conduit exception is narrow. The 2013 HIPAA Omnibus Rule text describes it as intended "to exclude only those entities providing mere courier services" and "their electronic equivalents, such as internet service providers (ISPs) providing mere data transmission services". It adds that a conduit "transports information but does not access it other than on a random or infrequent basis".
The rule also limits the exception to transmission: it covers "any temporary storage of transmitted data incident to such transmission". A service that keeps documents after delivery is maintaining PHI. For document work, that means a scanning or extraction vendor is not a conduit, and neither is a storage service.
Subcontractors
A subcontractor is "a person to whom a business associate delegates a function, activity, or service", in the definition in 45 CFR 160.103. The same section says a business associate includes "a subcontractor that creates, receives, maintains, or transmits protected health information on behalf of the business associate".
The paperwork runs down the chain. Under 164.502(e)(1)(i), "A covered entity is not required to obtain such satisfactory assurances from a business associate that is a subcontractor." Instead, paragraph (e)(1)(ii) puts that duty on the business associate. And 164.504(e)(5) applies the same contract requirements to the agreement between a business associate and its subcontractor. So a clinic signs with its extraction vendor, and the vendor signs with its cloud host and any offshore keying team. How those subprocessors touch PHI is covered in where an OCR vendor's subprocessors touch PHI.
Pilots and trials
A trial with any document vendor raises the same question as production: will the vendor see PHI? If the trial uses de-identified samples, the Privacy Rule's requirements do not apply to that data under 164.502(d)(2). If it uses real EOBs, claims or intake forms, the vendor is receiving PHI and the rule requires the written assurances before it does. A short trial is not an exception in the regulation text.
Limited data sets
One narrow alternative exists. Under 164.504(e)(3)(iv), a covered entity that discloses only a limited data set to a business associate for a health care operations function may rely on a data use agreement that meets 164.514(e)(4).
What a signed BAA does not prove about a vendor
A signed BAA does not prove a vendor is secure. It is a contract: a set of promises the vendor makes, which the covered entity can enforce. It shows the vendor agreed to safeguards, reporting and return or destruction of PHI. It does not show that the vendor's systems, staff or subcontractors actually meet those promises.
The regulation's own word is "assurance". Under 164.502(e)(1)(i), the covered entity obtains "satisfactory assurance that the business associate will appropriately safeguard the information". The BAA documents that assurance. It is not a certificate, an audit report or a test result.
The covered entity keeps a duty after signing. Under 164.504(e)(1)(ii), it is not in compliance if it "knew of a pattern of activity or practice of the business associate that constituted a material breach or violation" and did not take reasonable steps to cure it or, failing that, end the contract "if feasible". The same paragraph, at (e)(1)(iii), puts a matching duty on a business associate regarding its subcontractors.
Things a BAA does not tell you:
- Where the vendor stores scans and extracted fields, and in which country
- Which subcontractors handle the data, and whether they signed matching agreements
- How the vendor controls staff access and records who viewed what
- How long it keeps source documents, and whether deletion covers backups
- Whether any independent party has tested its controls
Those answers come from a security review, not from the contract. For document work, ask for them alongside the BAA draft and compare the answers with the clauses in the table above. A vendor that signs a BAA readily but cannot answer the questions has given you a promise without the evidence behind it.