A simple explanation of when Business Associate Agreements are required under HIPAA.
A Business Associate Agreement (BAA) is a written contract required in certain relationships where a business associate creates, receives, maintains, or transmits protected health information (PHI) on behalf of a covered entity.
A BAA may be required when a third party creates, receives, maintains, or transmits PHI on your behalf as a business associate. Working as a solo provider does not remove applicable BAA requirements.
The safest first step is to review how vendors interact with PHI in your workflow.
Use the HIPAA Compliance Assessment to review potential gaps in vendor management, BAAs, and other HIPAA compliance areas.
Need a simple checklist? Get HIPAA checklist PDF →