What a BAA is
A business associate agreement is a contract required by HIPAA between a covered entity and any vendor that creates, receives, maintains or transmits PHI on its behalf. It is required whenever that relationship exists — it is not optional and not negotiable in principle, though the terms around the required content are.
What it is not is compliance. The BAA is a contract in which you represent that you safeguard PHI appropriately. The safeguarding is separate work, and since HITECH you are directly liable for it regardless of what the contract says.
What it must contain
| Required element | What it does |
|---|---|
| Permitted uses and disclosures | Defines exactly what the BA may do with PHI |
| Safeguards obligation | Requires appropriate safeguards, including Security Rule compliance |
| Reporting | Obligation to report breaches and improper uses |
| Subcontractor flow-down | Requires BAAs with subcontractors touching PHI |
| Individual rights support | Making PHI available for access, amendment and accounting |
| HHS access | Making records available to the Secretary for compliance review |
| Return or destruction | What happens to PHI at termination |
| Termination for breach | The covered entity's right to terminate |
What to check before signing
Breach notification timeline. HIPAA sets an outer limit; many BAAs impose far shorter ones — 24 or 48 hours is common. Confirm you can actually detect and report within it, because you are signing up to a capability, not an intention.
Indemnification. Not a HIPAA requirement, and frequently added. Uncapped indemnity for a breach is a commercial decision that should not be made by whoever received the email.
Audit rights. Some BAAs give the covered entity the right to audit you. Reasonable in principle; check the notice period and frequency.
Scope of permitted use. If you need PHI for product improvement or analytics, it must be permitted explicitly. Assuming it falls under healthcare operations is a common and unsafe reading.
Return or destruction at termination. Confirm you can actually do what you are agreeing to, including in backups.
Subcontractor obligations. You will need BAAs with every subprocessor touching PHI. Inventory them before signing, not after.
The ordering mistake
The common sequence is: customer sends BAA, sales wants the deal, someone signs it, and the safeguards work starts afterwards if at all.
That converts a compliance gap into a contractual breach as well. You have represented that safeguards exist. If they do not, you are exposed both to OCR and to your customer.
The better sequence is a risk analysis first — even a fast one — so you know what you are representing. It also gives you a defensible answer when the customer's security team asks the follow-up questions, which they increasingly do.
Who needs one, and with whom
Covered entity to business associate. The standard case.
Business associate to subcontractor. Flows down the chain — your hosting provider, your analytics vendor, anyone touching PHI on your behalf.
Cloud providers. Major providers will sign one and offer HIPAA-eligible services. That covers their layer only; everything above it stays yours.
Not needed between two covered entities exchanging PHI for treatment, or with a pure conduit such as a postal service — though the conduit exception is narrower than vendors often claim.
FAQs
What is a business associate agreement?
A contract required by HIPAA between a covered entity and any vendor that creates, receives, maintains or transmits PHI on its behalf. It defines permitted uses, requires safeguards, sets breach reporting obligations, and flows those requirements down to subcontractors.
What must a BAA include?
Permitted uses and disclosures, an obligation to implement appropriate safeguards including Security Rule compliance, breach and improper use reporting, subcontractor flow-down, support for individual rights, HHS access for compliance review, return or destruction of PHI at termination, and termination rights for breach.
Does signing a BAA make me HIPAA compliant?
No. A BAA is a contract in which you represent that you safeguard PHI appropriately; the safeguarding is separate work. Since the HITECH Act business associates are directly liable for Security Rule compliance regardless of contract terms, so signing without the underlying work creates exposure to both the regulator and the customer.
What should I check before signing a BAA?
The breach notification timeline, which is often far shorter than HIPAA's outer limit; indemnification terms, which are not a HIPAA requirement and are frequently added; audit rights; whether your intended uses such as analytics are explicitly permitted; whether you can actually return or destroy PHI at termination including backups; and your subcontractor inventory.
Do I need a BAA with my cloud provider?
Yes, if they store or process PHI. Major cloud providers will sign one and offer HIPAA-eligible services, which covers their layer of the shared responsibility model. Everything above it — access control, logging, training, your own risk analysis — remains your obligation.
Where to go next
See HIPAA for SaaS companies, start with a risk assessment, or read the breach notification rule.