Business Associate Agreement (BAA)

A Business Associate Agreement is the contract HIPAA requires between a healthcare provider and any vendor that handles protected health information on its behalf.

It sets out how the vendor may use the information and what safeguards it must keep. A voice AI vendor that answers patient calls is a business associate and must sign a BAA before handling real calls. Its own subcontractors need agreements too.