A business associate agreement is a contract, not a certification. It makes a vendor contractually responsible for protecting patient information it handles for your practice. The practice is still responsible for how the tool is configured, used and governed.
Definition
A business associate agreement (BAA) is a written contract in which a vendor that handles PHI for a healthcare provider agrees to safeguard it under HIPAA. The two parties are a covered entity (the practice) and a business associate (the vendor). A business associate and any subcontractors that handle the same PHI also sign BAAs with each other.
This entry is part of the healthcare operations glossary.
In practice at a clinic or small practice
Office managers meet BAAs when choosing software or services that will hold patient information. Common examples are a billing service, cloud storage, an after-hours answering service, outside IT support and a staff chat tool. The BAA has to be signed before staff put any PHI into the tool. Usually the vendor provides its standard agreement and the practice signs it. A copy goes into the vendor file, noting the date and the service or plan it covers.
Front desk staff and nurses rarely see the contract itself. They feel its effect in the rules about which tools they may use for patient details. A personal text thread or a free app with no BAA is off limits for PHI, even for a quick note about a rescheduled appointment.
BAAs are often tied to a plan tier. For example, a staff chat tool such as Chanty offers a signed BAA on its Business and Enterprise plans but not on Free. That BAA covers the messages, files, voice notes, tasks and Teambook in the workspace, while its AI agents need a separate written agreement. See security, HIPAA and BAA details.
Each connected integration that touches PHI needs its own BAA with that vendor. The chat vendor's agreement does not extend to tools like Google Drive or Zapier.
Not to be confused with
- Business associate: the vendor or person that handles PHI on behalf of the practice. The BAA is the contract that business associate signs.
- HIPAA certification or "HIPAA compliant" status: a BAA does not certify a vendor or make a practice compliant. HIPAA has no official certification. The practice still owns its policies, staff training, access control and offboarding of departing employees.
- NDA or general confidentiality agreement: an NDA sets whatever terms the parties agree on. A BAA must contain specific terms required by HIPAA.
What the rules say
The definition of "business associate" under HIPAA comes from 45 CFR 160.103.
A covered entity may share PHI with a business associate only after getting satisfactory written assurances that the business associate will protect it. Those assurances must be documented in a contract (45 CFR 164.502(e) and 164.504(e)). The Security Rule has a parallel requirement for electronic PHI (45 CFR 164.308(b) and 164.314(a)).
In plain English, the contract must cover:
- What the business associate may and may not do with the PHI
- The safeguards it will use to protect the PHI
- Reporting breaches and security incidents to the practice
- Passing the same terms down to its subcontractors
- Helping patients access their records, where applicable
- Returning or destroying the PHI when the contract ends
This is a summary, not the complete list of required terms in 45 CFR 164.504(e)(2).
Business associates are directly liable for certain HIPAA violations, not only through their contract with the practice. A narrow "conduit" exception applies to services that only transmit data and store it no longer than transmission requires.
HHS publishes sample BAA provisions. Sample language is a starting point, not legal advice. Have counsel review any BAA before you sign it.
Related reading
- Business associate: who counts as a business associate.
- Protected health information (PHI): what information the BAA protects.
- Security, HIPAA and BAA details: how BAA availability works for staff chat, plan by plan.
Where Chanty fits. chanty.health is published by Chanty, a team chat for clinic staff with a signed BAA from the Business plan. If your team still coordinates in personal group chats, see how HIPAA-compliant staff chat works or start free.