Controls & evidence
Business associate agreement (BAA)
A HIPAA-required contract between a covered entity and a vendor that handles protected health information on its behalf.
Overview
The agreement binds the vendor to safeguard the information, limits its use and requires breach reporting.
It connects most directly to HIPAA and Vendor risk management.
Check the official sources below for legal scope, applicable dates and exceptions. This entry is an explanatory reference, not legal advice.
Why it matters
Without one, sharing health data with a vendor can itself breach HIPAA.
Who it affects
Healthcare organisations and their vendors.
Where it sits
Ten linked steps connect where you operate to the proof that you complied.
- 01Jurisdiction
- 02Industry
- 03Activity
- 04Authority
- 05Regulation
- 06Requirement
- 07Guidance
- 08Control
- 09Evidence
- 10Enforcement
Connections
The terms most closely tied to BAA. Select one to open it.
What to do about it
- 1Define the owner, frequency, data and pass condition.
- 2Automate the test on source data where you can.
- 3Capture evidence on every run, including exceptions.
- 4Review exceptions and failures and record the decision.
In Regulation Layer
From requirement to evidence.
BAAs are tracked as contract obligations linked to vendor controls.
Request early access →