Business Associate Agreement
Also known as: BAA
A contract required under HIPAA between a covered healthcare organization and a vendor that will create, receive, maintain, or transmit protected health information on its behalf.
If your product will touch protected health information on behalf of a healthcare organization, a Business Associate Agreement is a precondition for the relationship, not a negotiating item at the end of it. It allocates responsibility for safeguarding that information, for breach notification, and for what happens to the data when the relationship ends.
Healthcare organizations will not move a product into production without one where one is required, and a vendor that has never signed one signals inexperience immediately.
Having a BAA template is table stakes. What distinguishes a prepared vendor is knowing which of its subcontractors and cloud providers sit downstream of that obligation, and being able to say so without a two-week delay.
This entry describes a contracting concept and is not legal advice. Specific obligations depend on the arrangement and should be reviewed by counsel.