Related Terms
HIPAA
PHI
See Also
A BAA is one of the first checks for any texting vendor. See what else makes patient texting compliant
HIPAA Compliant Texting
ABOUT THIS ENTRY
Category Core: Compliance
Reading time: 1 min
Updated: Nov 2026
Business Associate Agreement (BAA)
Definition
A business associate agreement (BAA) is a contract that HIPAA requires between a covered entity, like a medical practice, and any vendor that creates, receives, stores, or sends PHI on its behalf.
Why the distinction matters
Practices rely on outside vendors for billing, IT, cloud storage, texting, and transcription. Each of those vendors is a business associate if it touches PHI.
The BAA spells out what the vendor may do with the data and makes it legally responsible for protecting it.
HIPAA sets the required terms in 45 CFR 164.504(e). A BAA must limit how the vendor uses and shares PHI, require safeguards, require breach reporting to the practice, flow the same duties down to subcontractors, and require return or destruction of PHI when the contract ends.
Without a signed BAA, sharing PHI with a vendor is a HIPAA violation even if nothing leaks.
Example
A practice picks a patient texting tool. Before importing its patient list, the office manager requests the vendor's BAA, checks that it covers breach reporting and subcontractors, and files the signed copy with its HIPAA records.
Frequently Asked
-
When does a practice need a BAA?
Whenever a vendor will create, receive, store, or send PHI for the practice. Common examples are billing, IT, cloud, and messaging vendors.
-
Who writes the BAA?
Either side can. Many vendors offer a standard BAA, and practices can request changes before signing.
-
Does a BAA make a vendor HIPAA-compliant?
It's required, but it's only a contract. The vendor still has to follow the Security Rule in practice.