Business Associate Agreement: Complete Guide
A business associate agreement (BAA) is one of the most key records in any HIPAA rule-keeping program. Whenever a covered group engages a third party that will create, receive, keep, transmit, or touch protected health information on its behalf, a BAA must be in place before any PHI is shared. Failing to execute a proper BAA is one of the most common --- and most costly --- HIPAA breaches identified in enforcement actions.
This guide covers everything groups need to know about business associate agreements: who qualifies as a business associate, what a BAA must contain, how to track ongoing rule-keeping, and what happens when a breach occurs. Whether you are a covered group managing vendors or a business associate working with healthcare clients, understanding BAA rules is non-negotiable for HIPAA rule-keeping.
What Is a Business Associate?
Definition and Scope
Under HIPAA, a business associate is any person or group that is paid money to complete a certain task and by way of completing this task it is fair to believe that there will be exposure to PHI that is inherent to the work being performed.
The relationship is defined by the nature of the work, not by the size of the group or the volume of PHI involved. Even a single interaction involving PHI can set up a business associate relationship.
Common examples of business associates include:
- IT service providers/Managed Service Providers --- Companies that host, keep, or have access to systems containing ePHI, including cloud service providers, managed security services, and EHR vendors
- Billing and coding companies --- Third-party billing services that process claims containing PHI
- Legal and accounting firms --- When they access PHI in the course of providing professional services. For example, an Attorney who specializes in medical malpractice will likely come into contact with PHI while doing their job.
- Consultants --- Compliance consultants, practice management consultants, and other advisors who access PHI directly as part of the reason for why you hired them initially.
- Shredding and disposal companies --- Firms that handle the destruction of PHI-containing media and records
- Transcription services --- Medical transcription companies that process dictated records
- Claims processing groups --- Entities that handle health insurance claims on behalf of a covered group
Who Is NOT a Business Associate?
Not every vendor relationship triggers BAA rules. The following are usually not business associates:
- Janitorial services --- Unless they are namely contracted to handle PHI-containing waste they are considered a 'regular vendor' and regular vendors should sign a data privacy agreement.
- Electrical and plumbing contractors --- upkeep providers without access to PHI
- Conduit groups --- groups that merely transport PHI - A good example of this group is someone like your ISP. They can't ALWAYS know what's traveling across their networks so they can't be responsible for bad actors in most cases.
- Members of a covered group's team --- Employees, volunteers, and trainees under direct control are not business associates
- Patients and personal representatives --- people acting on theirS, OR ON behalf OF A LOVED ONE.
The distinction between a team member and a business associate depends on the degree of control the covered group exercises. Independent contractors who operate under their own management and discretion are often business associates, while people under the covered group's direct supervision are team members.
BAA rules Under HIPAA
rule-based Basis
The HIPAA Privacy Rule requires covered groups to obtain satisfactory assurances from business associates that they will properly safeguard PHI. These assurances must be written down in a written agreement --- the BAA. The HITECH Act expanded these rules by making business associates directly liable for rule-keeping with certain HIPAA terms and extending the rule to subcontractor relationships.
A covered group that knows of a pattern or practice of a business associate that counts as a real breach of the BAA must take fair steps to cure the breach or end the breach. If such steps are unsuccessful, the covered group must end the agreement if feasible. Failure to act on known breaches exposes the covered group to its own enforcement liability. In a worst case scenario, where ending of the agreement will be harmful to the partis, it is advisable to contact HHS to explain the situation and do away with any notions they have of your supposed wrongdoing.
When a BAA Must Be in Place
A BAA must be executed before any PHI is shared with the business associate. This timing rule is absolute. groups that begin sharing PHI before a BAA is signed face possible breaches no matter what of whether a breach occurs. During vendor onboarding, the BAA should be part of the contracting process alongside service level agreements and other standard business records.
Key terms Every BAA Must Include
Required Elements
The Privacy Rule specifies that a BAA must include terms that:
- set up allowed uses and shares --- Specify what the business associate may and may not do with PHI, ensuring uses are limited to those needed to perform the contracted services or as required by law
- Prohibit unapproved use or sharing --- Explicitly prohibit the business associate from using or disclosing PHI in any manner that would violate the Privacy Rule if done by the covered group
- Require right protections --- Mandate that the business associate implement admin, physical, and tech protections as required by the Security Rule
- Require breach reporting --- Obligate the business associate to report any use or sharing not provided for by the agreement, including breaches of unsecured PHI
- Ensure subcontractor rule-keeping --- Require the business associate to obtain satisfactory assurances from any subcontractors that create, receive, keep, or transmit PHI
- Support person rights --- Require the business associate to make PHI available to people exercising their right of access and to support amendment requests
- Provide access for HHS --- Make the business associate's internal habits, books, and records available to the Secretary of HHS for rule-keeping decision
- Require return or destruction --- Upon ending, require the business associate to return or destroy all PHI received from or created on behalf of the covered group, if feasible
Recommended Additional terms
Beyond the minimum rules, well-drafted BAAs often include:
- Specific security rules --- data scrambling standards, access control rules, and security review duties
- Breach notice timelines --- Defining timeframes tighter than the rule-based maximum (for example, requiring notice within 24 or 48 hours rather than the 60-day rule-based deadline)
- Indemnification clauses --- Financial duty for costs arising from the business associate's rule-breaking or breach
- Insurance rules --- Minimum cyber liability insurance coverage amounts
- Audit rights --- The covered group's right to audit the business associate's rule-keeping with the BAA
- Data location restrictions --- rules regarding where PHI may be stored and processed, including restrictions on offshore data processing
- Incident response coordination --- steps for coordinating breach response actions between the parties
- ending triggers --- Specific conditions that count as real breach and trigger ending rights
Managing Subcontractors
The Subcontractor Chain
The HITECH Act created a downstream chain of duty for PHI protection. When a business associate engages a subcontractor that will have DIRECT access to PHI, the business associate must enter into a BAA with that subcontractor. This rule extends through every level of the subcontracting chain --- a subcontractor that engages its own subcontractor must also execute a BAA.
This chain of agreements ensures that PHI remains protected no matter what of how many groups handle it. Practically, this means groups must:
- Identify all subcontractors with access to PHI
- Execute BAAs with each subcontractor before sharing PHI
- Monitor subcontractor rule-keeping regularly
- Include flow-down terms in BAAs that require subcontractors to impose equivalent rules on their own subcontractors
Common Subcontractor Scenarios
Cloud systems providers represent one of the most common subcontractor relationships in modern healthcare. If a business associate hosts ePHI on a cloud platform, that cloud provider is a subcontractor and requires a BAA. Major cloud providers including AWS, Microsoft Azure, and Google Cloud offer standard BAAs for healthcare customers, but groups must verify that these agreements meet their specific rule-keeping rules.
Other common subcontractor scenarios include offshore development teams, third-party data analytics providers, backup and disaster recovery services, and managed security operations centers.
Monitoring Business Associate Compliance
Due Diligence Before Engagement
Before executing a BAA, covered groups should conduct due diligence to check a possible business associate's ability to protect PHI. This review should include:
- Security posture review --- Request and check the business associate's security policies, risk review results, and rule-keeping certifications (SOC 2, HITRUST, ISO 27001)
- Reference checks --- Contact other healthcare clients to understand the business associate's rule-keeping track record
- Incident history --- Review the HHS Breach Portal and other public sources for past breach notices involving the business associate
- Financial stability --- Assess the business associate's ability to keep enough security measures and respond to incidents
Ongoing Monitoring
Executing a BAA is not a one-time event. Covered groups must track business associate rule-keeping throughout the relationship:
- Annual rule-keeping attestations --- Require business associates to certify their ongoing rule-keeping with BAA terms and HIPAA rules
- Periodic security reviews --- Conduct or request updated risk reviews and security audit results
- Incident tracking --- keep records of any security incidents or near-misses reported by the business associate
- Contract reviews --- Revisit BAA terms at least annually to ensure they remain current with rule-based rules and team-level changes
- Performance metrics --- Track response times for access requests, breach notices, and other BAA duties
groups should build these tracking actions into their broader rule-keeping calendar and assign clear clear ownership for vendor oversight. A complete HIPAA risk review should include check of business associate risks.
Breach Responsibilities
Business Associate duties
When a business associate discovers a breach of unsecured PHI, it must notify the covered group without unreasonable delay and no later than 60 days after discovery. The notice must include:
- finding of each person whose PHI has been or is reasonably believed to have been affected
- A description of what happened, including the date of the breach and date of discovery
- A description of the types of PHI involved
- Any steps the business associate recommends people take to protect themselves
- A description of what the business associate is doing to look into the breach, reduce harm, and prevent future breaches
Covered Entity duties
The covered group retains duty for notifying affected people, HHS, and (for breaches affecting 500 or more people) the media. However, the covered group relies on timely and accurate information from the business associate to meet its own notice duties. This link makes tight breach reporting timelines in the BAA in key ways important.
Shared Liability
Under HITECH, business associates face direct liability for HIPAA breaches. Both the covered group and the business associate may face enforcement actions arising from a single incident. OCR reviews frequently examine both parties, and settlement agreements often include corrective action plans for both the covered group and the business associate.
groups on both sides of the BAA relationship should keep coordinated incident response plans, conduct joint tabletop exercises, and set up clear communication channels for breach response. Waiting until a breach occurs to define roles and duties leads to delayed notices, rule-based scrutiny, and increased harm to affected people.
BAA Frequently Asked Questions
Can we use a vendor's standard BAA template?
You can, but you should review it carefully. Vendor-provided BAA templates often favor the vendor's interests and may not include all terms your rule-keeping program requires. Common gaps include weak breach notice timelines, limited audit rights, and insufficient subcontractor flow-down rules. Have your legal and rule-keeping team review any vendor-provided BAA against your group's rules before signing.
What happens if a business associate refuses to sign a BAA?
If a vendor that will have access to PHI refuses to sign a BAA, the covered group cannot share PHI with that vendor. Period. There is no exception or workaround. If the vendor's services are essential, the covered group must either find an alternative vendor willing to execute a BAA or restructure the engagement so that the vendor does not have access to PHI.
How often should BAAs be updated?
BAAs should be reviewed at least annually and updated whenever major changes occur --- including changes in the services provided, the types of PHI accessed, rule-based rules, or the business associate's subcontractor relationships. Many groups align BAA reviews with their annual HIPAA rule-keeping checklist actions.
Does a cloud storage provider need a BAA?
Yes. If a cloud storage provider stores, steps, or has access to ePHI, it is a business associate (or subcontractor, depending on the relationship structure) and requires a BAA. This applies even if the provider does not view or analyze the data. The fact that the provider has the tech ability to access ePHI is enough to set up the business associate relationship. data scrambling does not eliminate the need for a BAA unless the covered group retains exclusive control of the decryption keys.
What is the difference between a business associate and a covered group?
A covered group is a healthcare provider that conducts digital transactions, a health plan, or a healthcare clearinghouse --- these are groups directly subject to HIPAA. A business associate is a person or group that performs functions involving PHI on behalf of a covered group. The key distinction is that business associates handle PHI through a service relationship with a covered group rather than through a direct relationship with patients. For a broader overview, see our What is HIPAA article.
BAA Compliance Conclusion
Business associate agreements are the contractual backbone of HIPAA's third-party rule-keeping framework. A well-drafted BAA protects covered groups, business associates, and ultimately the patients whose information flows through the healthcare ecosystem. groups must approach BAAs not as admin formalities but as enforceable instruments that define real clear ownership for PHI protection.
From proper finding of business associate relationships through due diligence, contract execution, ongoing tracking, and coordinated breach response, every phase of the vendor management lifecycle demands attention. The groups that invest in robust BAA programs are the ones best positioned to withstand rule-based scrutiny and keep the trust of their patients and partners.
One Guy Consulting provides BAA templates, vendor management frameworks, and rule-keeping guidance that simplify business associate oversight. Explore our HIPAA rule-keeping guide for the full rule-keeping picture, or contact us to strengthen your business associate management program with proven tools and expert support. Manage your BAAs HIPAA compliance for business associates
Related: Vendor management