What is the purpose of a business associate agreement?

A business associate agreement (BAA) is a legally binding document required under the Health Insurance Portability and Accountability Act (HIPAA). It establishes the responsibilities and obligations of a business associate when handling protected health information (PHI) on behalf of a covered entity.

Purpose of a BAA

The purpose of a BAA is to ensure compliance with HIPAA by formalizing the responsibilities and obligations of a business associate when handling PHI on behalf of a covered entity.

Key objectives

• Protect PHI: Ensure that PHI is kept confidential, secure, and used only for authorized purposes.
• Define responsibilities: Clearly outline the permitted uses and disclosures of PHI by the business associate.
• Establish safeguards: Require the implementation of administrative, physical, and technical measures to prevent unauthorized access, use, or disclosure of PHI.
• Ensure accountability: Specify the consequences of non-compliance, including reporting breaches or violations.
• Regulate subcontractors: Ensure any subcontractors working with PHI on behalf of the business associate also comply with HIPAA.
• Mitigate risk: Protect both the covered entity and the business associate from legal and financial liabilities associated with data breaches or HIPAA violations.

BAA provisions

The provisions of a BAA are key elements that establish the terms and conditions under which a business associate will handle PHI. These provisions ensure compliance with HIPAA and safeguard PHI. Key provisions include: 

• Permitted uses and disclosures: Specifies how the business associate can use or disclose PHI.
• Safeguards: Requires appropriate administrative, physical, and technical measures to protect PHI.
• Reporting: Obligates the business associate to report breaches or unauthorized disclosures of PHI.
• Subcontractors: Ensures that any subcontractors handling PHI also comply with HIPAA.
• Termination: Outlines actions if the agreement is breached, such as termination and returning or destroying PHI.

See also: HIPAA Compliant Email: The Definitive Guide

When to request a BAA

A BAA should be requested whenever a covered entity engages a business associate to perform services that involve the use, disclosure, or access to PHI. Below are specific situations in which a BAA is required:

Engaging third-party vendors or service providers

• Examples: IT service providers, data storage companies, billing companies, contractors, consultants, or any third-party service providers who will have access to PHI while performing work on behalf of the covered entity.
• When to request: Before allowing the vendor to access, store, or process PHI. The BAA must be in place before any PHI is shared with the vendor.
  
  

Outsourcing healthcare functions

• Examples: Outsourcing medical transcription, claims processing, data analysis, or customer service.
• When to request: As soon as a business associate is contracted to perform such functions that require access to PHI.
  
  

Engaging subcontractors

• Examples: If a business associate uses subcontractors to help with services (e.g., a cloud storage provider that hires a subcontractor to manage servers).
• When to request: Before subcontractors access PHI, as they are also required to comply with HIPAA under the BAA terms.
  
  

Collaborating on research or data analysis

• Examples: A research institution or data analysis company accessing PHI for studies or clinical trials.
• When to request: Before sharing any PHI for research purposes or data analysis tasks.
  
  

Transitioning to a new business associate

• Examples: When changing service providers.
• When to request: Prior to transferring any PHI to the new Business Associate.
  
  

Modifying existing contracts

• Examples: If an existing vendor/service provider will now access PHI or their role changes to require PHI access.
• When to request: A new BAA or an amendment to the existing contract should be executed to cover the new scope of work involving PHI.
  
  

General Rule

A BAA should be in place before any PHI is shared or accessed by a business associate. This ensures that both the covered entity and business associate are clear about their responsibilities and obligations under HIPAA, reducing the risk of violations and data breaches.

Related: When should you ask for a business associate agreement?

FAQs

Who is required to sign a BAA?

Covered entities and business associates must sign a BAA if the business associate will have access to PHI in the course of providing services.

Who is responsible for ensuring the BAA is in place?

The covered entity is responsible for ensuring that a BAA is in place with any business associate before PHI is shared. However, the business associate must also ensure they adhere to the terms outlined in the BAA.

What happens if a BAA is not signed?

If a BAA is not signed, it can lead to HIPAA non-compliance for both the covered entity and business associate. This may result in legal and financial penalties, including fines and sanctions.

See also: Who is responsible for a data breach?