Business Associate Agreement (BAA)
A written contract required by HIPAA between a Covered Entity and any vendor that handles PHI on its behalf.
A BAA is a HIPAA-mandated contract that passes down privacy and security obligations from a Covered Entity (hospital, insurer, etc.) to a Business Associate (SaaS vendor, cloud provider, etc.). Without a signed BAA, a healthcare customer cannot legally let you process their PHI. Standard BAAs cover permitted uses, safeguards, breach notification and subcontractor flow-down.