Business associate agreement

What it is

A business associate agreement (BAA) is a contract that binds a vendor to protect health information it creates, receives, keeps or sends for someone else. HIPAA requires one between a covered entity (a provider, health plan or clearinghouse) and its business associates, and between a business associate and its subcontractors.

The federal rule

Under 45 CFR 164.502(e) and 164.504(e), a BAA must set the permitted uses and disclosures of the information and require the vendor to:

• Not use or disclose it except as the contract permits or the law requires
• Use appropriate safeguards and comply with the Security Rule for electronic information
• Report uses or disclosures the contract doesn't allow, including breaches of unsecured information
• Make sure its subcontractors agree to the same restrictions
• Support patients' rights to access and amend their records and get an accounting of disclosures
• Open its books and records to HHS
• Return or destroy the information when the contract ends, where feasible

Why it matters to a plaintiff firm

A plaintiff firm that gets a client's records through the client's own authorization usually isn't a covered entity, and it becomes a business associate mainly when it does legal work for one. Even so, plaintiff firms hold large volumes of medical records, and many require a BAA from every vendor that touches them, because it puts safeguards, breach notice and return of data in writing. When vetting software, ask whether the BAA covers every place records go, including the AI models. See our legal AI security checklist and security page.