Glossary · HIPAA
No signed BAA, no patient data: the contract comes before the access.
The written contract HIPAA requires before a vendor creates, receives, keeps or sends protected health information on behalf of a covered entity or another business associate.
Back to the glossary01 · In plain words
In plain words
The written contract HIPAA requires before a vendor creates, receives, keeps or sends protected health information on behalf of a covered entity or another business associate.
Hospitals, insurers and clinics in the US often hand health data to outside vendors: billing firms, cloud hosts, transcription services, software makers. HIPAA says that before this happens, the two sides must sign a business associate agreement (BAA) that limits what the vendor may do with the data and makes it protect it.
Spelled out: BAA, the contract HIPAA requires between a covered entity and a business associate.
02 · Why it matters
Why it matters
Who cares about this, and what depends on it.
For an Indian company selling to US healthcare, the BAA is usually the first legal document on the table and the one that turns a sales deal into a compliance programme. Signing it makes you a business associate, and since the HITECH Act and the 2013 Omnibus Rule a business associate is directly liable to the US Department of Health and Human Services (HHS) for complying with the Security Rule and parts of the Privacy Rule. The agreement also flows downward: if you use a cloud host or a subcontractor that touches the data, you need a BAA with them too. HHS guidance on cloud computing says a cloud provider that stores encrypted health data is still a business associate even without the key.
03 · Where you meet it
Where you will meet it
The documents, meetings and reports where it appears.
- 45 CFR 164.504(e)
- Lists what the agreement must contain on uses and disclosures, safeguards, reporting, subcontractors, patient rights and termination.
- 45 CFR 164.308(b) and 164.314(a)
- The Security Rule's side: written assurances that electronic health data will be safeguarded.
- The master services agreement
- Usually signed as an addendum, and it can override friendlier terms elsewhere in the contract.
- Your vendor list
- Every sub-processor that touches the data needs its own downstream BAA.
04 · An example
A worked example
An illustration, not a real client.
Illustrative: a medical transcription firm in Bengaluru
A transcription company signs a BAA with a group of US orthopaedic clinics. The agreement says it may use dictations only to produce reports, must report any security incident and any breach of unsecured data, and must return or destroy files when the contract ends. The firm stores audio on a cloud platform and uses a freelance editor network. Its own counsel points out that both need downstream agreements with matching terms, and that a freelance editor with a personal laptop cannot meet them. The firm moves editing into a managed virtual desktop and signs the cloud provider's standard BAA after checking which services it covers.
05 · Easy to mix up
Easy to mix up with
Neighbouring terms that mean something different.
- Data processing agreement (DPA)
- The GDPR contract between a controller and a processor. Similar idea, different law and different required clauses; one does not satisfy the other.
- Non-disclosure agreement
- An NDA protects confidential business information. It contains none of the HIPAA terms and does not make a vendor compliant.
06 · What to do
What to do with it
Practical steps, and the guides that go deeper.
- Check whether your service touches protected health information at all; if not, you may not need a BAA.
- Read the reporting clause closely: the time you have to tell the client is often shorter than the regulatory limit.
- List every subcontractor and cloud service that handles the data and get matching downstream agreements.
- Confirm the cloud provider's BAA covers the specific services you use, from the provider's own current list.
- GuideBusiness Associate AgreementsWho needs one, what it must contain, and where teams go wrong.
- GuideHIPAA in the cloudShared responsibility, the BAA, and what stays with you.
- GuideHIPAA for companies based in IndiaServing US clients as a business associate from India.
Sources: 45 CFR Part 160, Section 160.103 (definition of business associate); 45 CFR Part 164, Sections 164.308(b), 164.314(a), 164.410, 164.502(e) and 164.504(e); HHS guidance on business associates and on HIPAA and cloud computing.
Questions about Business associate agreement
How fast must a business associate report a breach?
Within 60 days at the latest, often sooner by contract.
Under 45 CFR 164.410, a business associate must tell the covered entity without unreasonable delay and no later than 60 calendar days after discovering a breach of unsecured protected health information. Many BAAs shorten this to days, and the contract governs your relationship with the client. Counsel should confirm how the rule applies to your contracts.
Does a signed BAA make us HIPAA compliant?
No.
The agreement records your promises. Compliance comes from doing what it promises: a risk analysis, safeguards, training, incident handling and records. HHS does not certify anyone as HIPAA compliant.
Want this applied to your own systems?
Our team can walk through where this term touches your scope, your contracts and your evidence.