A BAA and a BASA are both HIPAA-related agreements, but they apply to different relationships and responsibilities. A BAA, or business associate agreement, is an agreement between a covered entity and a business associate. A business associate subcontractor agreement (BASA) is one between a business associate and a business associate’s subcontractor. They both ensure HIPAA compliance, but with different parties.
To understand the difference between a BAA and a BASA, it’s important to first clarify the roles HIPAA defines. A covered entity under HIPAA is any organization that is involved in the electronic creation, receipt, maintenance, or transmission of protected health information (PHI). The primary categories include health plans, healthcare clearinghouses, and specific healthcare providers that electronically transmit PHI for designated transactions.
The US Department of Health and Human Services (HHS) defines a business associate as a “person or entity that performs certain functions or activities that involve the use or disclosure of protected health information on behalf of, or provides services to, a covered entity.” Their “functions and activities” include “claims processing or administration; data analysis, processing or administration; utilization review; quality assurance; billing; benefit management; practice management; and repricing. Business associate services are: legal; actuarial; accounting; consulting; data aggregation; management; administrative; accreditation; and financial.”
A subcontractor, on the other hand, is “a person to whom a business associate has delegated a function, activity, or service the business associate has agreed to perform for a covered entity or business associate. A subcontractor is then a business associate where that function, activity, or service involves the creation, receipt, maintenance, or transmission of protected health information,” writes the HHS. Both the business associate and the subcontractor are required to adhere to HIPAA regulations under their respective agreements.
A BAA is required under HIPAA when a business associate handles PHI on behalf of a covered entity. As the HHS states, “The HIPAA Rules generally require that covered entities and business associates enter into contracts with their business associates to ensure that the business associates will appropriately safeguard protected health information.”
The BAA ensures that when a covered entity shares PHI with a vendor, that vendor:
Without a valid BAA, a covered entity cannot legally share PHI with a vendor, even if the vendor claims to be HIPAA compliant.
Go deeper: What is the purpose of a business associate agreement?
According to the HHS, a BAA “serves to clarify and limit, as appropriate, the permissible uses and disclosures of protected health information by the business associate, based on the relationship between the parties and the activities or services being performed by the business associate.”
The BAA must:
A BAA is mandatory whenever PHI is involved.
A BASA applies when a business associate hires another vendor, also known as a subcontractor, who will also have access to PHI.
HIPAA recognizes that business associates often rely on other vendors to deliver services. Without BASAs, PHI could pass through multiple hands without consistent protection.
HIPAA closed this gap by making subcontractors:
According to the HHS, “Contracts between business associates and business associates that are subcontractors are subject to these [BAA] same requirements.”
This means a BASA:
Mandatory whenever a subcontractor can access PHI.
Read also: How to handle subcontractors under HIPAA
Failing to have a BAA or a BASA in place can have serious legal, financial, and operational consequences under HIPAA, even if no data breach ever occurs. The consequences include:
HIPAA explicitly requires BAAs and BASAs when PHI is involved. Not having one in place is itself a violation of the HIPAA Privacy Rule. Overall, it’s important to remember that:
It’s important to note that no breach is required for enforcement action to occur.
Read more: Case studies: HIPAA violations and their consequences
The U.S. Department of Health and Human Services (HHS) can impose significant fines for noncompliance. Penalties range from $147 to over $2 million.
Fines are based on:
Go deeper: Higher HIPAA penalties announced
If a breach occurs and no BAA or BASA exists:
This frequently results in:
HHS may require:
Many healthcare organizations may:
For vendors and subcontractors, this can mean:
Read also: Can HIPAA violations lead to termination?
Without a BAA or BASA:
This can result in additional violations, even if the breach itself was limited.
Healthcare organizations are trusted with sensitive patient data. Noncompliance can lead to:
See also: HIPAA Compliant Email: The Definitive Guide (2025 Update)
A vendor may refuse, but the covered entity or business associate cannot legally share PHI with that vendor. Continuing the relationship would be a HIPAA violation.
Signing an agreement retroactively does not eliminate the original HIPAA violation. However, executing the agreement promptly and documenting corrective action may reduce penalties during an HHS investigation.
Yes. Geographic location does not exempt vendors from HIPAA requirements. Any vendor, domestic or international, that accesses PHI must sign the appropriate agreement.
Ideally, no. While the clauses may be similar, the agreement must reflect the correct legal relationship. Using the wrong agreement can create compliance gaps.