What Is a Business Associate Agreement (BAA) Under HIPAA?
By Michael Jann, EVP, Vertical Industry Solutions, Abacus · Published October 29, 2026 · Updated October 29, 2026
Short answer: A business associate agreement (BAA) is a written contract that HIPAA requires between a healthcare organization and any vendor that creates, receives, maintains, or transmits protected health information (PHI), including electronic protected health information (ePHI), on its behalf. The BAA commits the vendor to safeguard that information, report breaches, and limit how the information is used. Sharing protected health information with a vendor that has not signed a BAA is itself a HIPAA violation.
Most healthcare organizations meet the business associate agreement the same way: a vendor sends a contract, someone signs it, and the file goes into a drawer. That works until an auditor asks for the agreement, or until the vendor is breached and the healthcare organization has to explain what the contract required.
Who needs a business associate agreement?
A covered entity needs a business associate agreement with every vendor that handles protected health information on its behalf. Covered entities include healthcare providers that bill electronically, health plans, and healthcare clearinghouses. Business associates can include billing companies, IT providers, cloud hosting vendors, shredding services, attorneys, medical transcription firms, etc.
The true question is really what the vendor does for your organization. A vendor that creates, receives, maintains, or transmits protected health information to perform a service for a healthcare organization is a business associate under 45 CFR 160.103. A cleaning crew that walks past a workstation is not. A managed IT provider that administers the servers holding patient records is.
Business associates also need agreements with their own subcontractors. Under 45 CFR 164.502(e)(1)(ii), a business associate that passes protected health information to a downstream vendor must obtain the same written assurances the covered entity obtained from it. That requirement runs the full length of the chain, so a healthcare organization’s data can sit behind three or four stacked agreements.
One common gap sits with cloud vendors. According to HHS guidance on HIPAA and cloud computing, a cloud service provider that stores electronic protected health information is a business associate “even if the entity cannot actually view the ePHI.” HHS states plainly that lacking the encryption key “does not exempt a CSP from business associate status.”
What must a business associate agreement include?
HHS specifies the required contents at 45 CFR 164.504(e). The agreement must set out the permitted uses and disclosures of protected health information, require appropriate safeguards, require the business associate to report breaches and unauthorized disclosures, and require the return or destruction of that information when the contract ends.
HHS also requires the agreement to bind subcontractors to the same conditions, support patient requests for access under 45 CFR 164.524, support amendments and accountings of disclosures, and make the business associate’s internal books and records available to HHS for compliance review.
An agreement that omits a required element is not compliant, even if both parties signed it. HHS publishes sample business associate agreement provisions, and most vendor templates are built from that sample. The real differences appear in the terms vendors add around the minimum – liability caps, breach notification timelines, and the definition of a reportable incident.
Who is responsible for what under a business associate agreement?
A business associate agreement splits accountability between the covered entity and the vendor, but it does not transfer it. The healthcare organization keeps its obligations to analyze risk, train staff, and notify patients after a breach. The vendor takes on safeguarding the data, reporting incidents, and binding its own subcontractors to the same terms.
| Responsibility | Covered entity (the healthcare organization) | Business associate (the vendor) |
|---|---|---|
| Execute a written BAA before sharing PHI | Required with every business associate | Required with every subcontractor |
| Conduct a Security Rule risk analysis | Required | Required |
| Notify affected individuals after a breach | Required, within 60 days of discovery | Notifies the covered entity, not individuals |
| Notify HHS of a breach | Required | Generally handled by the covered entity |
| Respond to a patient request for records | Required | Must support the covered entity’s response |
| Face direct OCR enforcement | Yes | Yes, since the 2013 Omnibus Rule |
| Return or destroy PHI at contract end | Enforces the term | Required |
How does a business associate agreement relate to HIPAA?
A business associate agreement is how HIPAA extends its rules past the walls of a healthcare organization. The Privacy Rule bars a covered entity from disclosing protected health information to a vendor unless the vendor has given written satisfactory assurances, and the business associate agreement is that assurance.
The 2013 HIPAA Omnibus Rule changed the relationship. Before it, business associates answered to the covered entity through contract law. After it, business associates became directly liable for Security Rule compliance and breach notification, so the HHS Office for Civil Rights can investigate and penalize a vendor directly.
A signed business associate agreement does not move liability off the organization. The covered entity keeps its own obligations to conduct a risk analysis, train staff, and notify patients. The agreement adds a second accountable party; it does not subtract the first.
What happens if you do not have a business associate agreement?
Disclosing protected health information to a vendor without a signed business associate agreement is an impermissible disclosure under the Privacy Rule, enforceable on its own. The Office for Civil Rights does not need to find a breach to cite a missing agreement; the missing agreement is the violation.
Penalties scale with culpability. Under the HIPAA civil monetary penalty tiers that took effect January 28, 2026, a violation attributed to lack of knowledge starts at $145, while willful neglect that is not corrected within 30 days carries penalties up to $2,190,294 per violation category per year.
The practical exposure is usually larger than the penalty. When a vendor without an agreement is breached, the healthcare organization has no contractual right to breach details, no agreed notification timeline, and no documented basis for the vendor’s security obligations, while still owing patients notification within 60 days of discovery.
Third-party exposure is not rare. The Verizon 2026 Data Breach Investigations Report found that 32% of healthcare breaches involved a third party.
What should you look for in a vendor’s business associate agreement?
Read past the required terms and into the timelines, definitions, and limits. The HHS-required provisions are nearly identical across vendors, so the real differences sit in how fast a vendor must report an incident, what counts as one, and what the vendor owes if it is at fault. Six terms deserve a close read:
Breach notification timeline. A covered entity must notify individuals within 60 days of discovery. A vendor agreement allowing 30 or 45 days to notify the healthcare organization consumes most of that window. Look for a specific number of business days rather than “without unreasonable delay.”
Definition of a reportable incident. Some agreements limit reporting to confirmed breaches. Language covering suspected unauthorized access gives earlier warning.
Subcontractor disclosure. The agreement should require disclosure of downstream vendors that will touch protected health information.
Security Rule specificity. “Appropriate safeguards” is the floor. Stronger agreements name controls: encryption at rest and in transit, multi-factor authentication, logging, and access review.
Breach response cost allocation. Notification, credit monitoring, and forensics are expensive. Silence usually means the healthcare organization pays.
Termination and data return. Confirm the format, the timeline, and what happens to backups.
Does signing a business associate agreement make a vendor HIPAA compliant?
No. A signed business associate agreement is a contract, not an assessment. It records what a vendor has promised to do and says nothing about whether the vendor does it. HIPAA has no government certification program, so no vendor can be “HIPAA certified” by HHS.
What an organization can verify is the evidence behind the promise. A SOC 2 Type II report shows that an outside auditor tested the operating effectiveness of a vendor’s controls over a review period. HITRUST certification maps controls to HIPAA and is validated by an approved external assessor. A current risk analysis and documented incident response testing carry more weight than a signature.
The 2026 HITRUST Trust Report, published in April 2026, found that 99.62% of HITRUST-certified environments reported no security breach during 2025, while more than 40% of organizations in the broader market did report one. Independent validation is not proof of security, but it is stronger evidence than an unexamined contract.
What do healthcare organizations get wrong about business associate agreements?
The most common mistake is treating the business associate agreement as a filing task rather than a vendor control. A signed agreement that nobody has read, inventoried, or revisited provides documentation and nothing else, and documentation alone does not tell a healthcare organization which vendors hold patient data or what those vendors promised.
Five recurring problems show up in HIPAA compliance reviews of healthcare organizations:
No vendor inventory. Without a current list of every vendor that touches protected health information, including software bought by individual departments, a healthcare organization cannot confirm its agreement coverage is complete.
Agreements signed but never reviewed. Vendors change subcontractors, hosting, and security posture. An agreement signed years ago may describe a service that no longer exists.
Assuming the vendor’s template is sufficient. A vendor template is written to protect the vendor. It usually meets the HHS minimum and stops there.
Missing agreements with small vendors. Answering services, patient outreach agencies, and document scanning firms are business associates. Size does not change the requirement.
No retention discipline. HIPAA requires documentation to be kept six years from creation or from the last date it was in effect, under 45 CFR 164.530(j)(2). Terminated agreements still have to be retained.
A practical fix: hold the vendor inventory and the agreement file in one place, review both annually, and tie that review to the Security Rule risk analysis a healthcare organization already performs. HHS proposed a Security Rule overhaul in January 2025 that would strengthen business associate oversight, but it is not in effect; HHS moved it to its long-term agenda with anticipated final action in July 2027.
About Abacus
Abacus is a managed IT and cybersecurity provider serving financial services firms and healthcare organizations globally since 2004, with 24×7 monitoring and help desk coverage. With in-house incident response specialists, a cyber R&D team, and a deep bench of GRC experts, Abacus supports more than 1,200 clients and 100,000 users globally, holding SOC 2 Type II attestation and CREST accreditation, with infrastructure and processes designed to support HIPAA and HITRUST compliance requirements.
Frequently asked questions
Yes. An electronic health record vendor creates, receives, maintains, and transmits protected health information on behalf of an organization, which makes it a business associate under 45 CFR 160.103. The agreement should be executed before any patient data moves into the system. Organizations that use a hosted or cloud-based EHR also need the agreement to address where data is stored and which subcontractors have access.
HIPAA does not set a renewal interval, so an agreement stays in force under its own terms. Annual review is still the practical standard, because vendors change subcontractors, hosting, and security controls between signatures. Many organizations tie the review to the Security Rule risk analysis. HIPAA requires the signed agreement to be retained for six years from creation or from the last date it was in effect.
Usually yes, unless the vendor qualifies for the narrow conduit exception. HHS limits that exception to transmission-only services where access to protected health information is “transient in nature,” such as an internet service provider or a courier. A vendor that stores data, even briefly and even encrypted, falls outside the exception and needs a business associate agreement.
Yes. The covered entity keeps its own obligations regardless of who caused the breach, including notifying affected individuals within 60 days of discovery and notifying HHS. The Office for Civil Rights can also examine whether the healthcare organization performed adequate due diligence and held a compliant agreement. A business associate can be penalized directly as well, a change introduced by the 2013 HIPAA Omnibus Rule.
Next step
Schedule an IT assessment with Abacus. The session reviews your current vendor inventory, your business associate agreement coverage, and the gaps most likely to surface in an Office for Civil Rights review.
