← All guides
Owner guide
What is a Business Associate Agreement?
A Business Associate Agreement (BAA) is a contract HIPAA requires with any vendor that handles or can access your patients' information.
Who needs one
Your EHR vendor, billing company, IT support, cloud email, and security vendors with system access. If a vendor could see patient data, you likely need a BAA with them.
What it covers
- How the vendor may use and protect the information
- What happens if there is a breach
- Returning or destroying data when the work ends
A quick check
List your vendors and confirm you have a signed BAA on file for each one that touches patient data. Missing BAAs are among the most common gaps we find.
Questions? Talk to us, or start with a free exposure check.