Free to play, no signup
Monsters Ate My BAA: Who Needs a Business Associate Agreement?
Ten vendors are out on the street and the breach monsters are coming. Reach each one and decide: do they need a business associate agreement, or not? Squirt safeguards to hold the monsters off.
Move with the arrow keys. Press Space next to a vendor to talk, then Left for “needs a BAA” or Right for “no BAA.” Space also squirts safeguards. On a phone, use the buttons.
Turn your phone sideways for a bigger game.
What the game teaches
The Rule Behind Every Point
- A business associate handles PHI on your behalf: a billing service, a cloud backup provider, an accountant, a law firm or an IT consultant (45 CFR 160.103).
- Some are named outright, such as health information exchanges and e-prescribing gateways.
- Not business associates: another provider who gets PHI to treat your patient, and your own staff.
- Every BAA has to say what the vendor may do with PHI, require safeguards and breach reporting, and pass the same terms to subcontractors (45 CFR 164.504(e)(2)).
Source: 45 CFR 160.103, definition of business associate
Need the paperwork? Get our free business associate agreement template.
Free 30-minute intro
Want Every Vendor Covered?
Vendor management with digital BAAs comes with both plans. Book a free 30-minute intro call to see how it works for your practice.