Customer data glossary

Business associate agreement (BAA)

By Art Kukharenko · Published 2026-10-17 · Updated 2026-10-18

A business associate agreement (BAA) is the contract HIPAA requires between a covered entity and a business associate that handles protected health information for it.

Part of the Learn hub and the customer data glossary.

What it means in practice

The definition of business associate is in 45 CFR 160.103. Broadly, it is a person who, on behalf of a covered entity, creates, receives, maintains or transmits protected health information for a regulated function or activity (including claims processing, data analysis, utilisation review, billing and benefit management), or who provides legal, actuarial, accounting, consulting, data aggregation, management, administrative, accreditation or financial services where the service involves disclosure of PHI to it 1. Covered entities are health plans, clearinghouses and providers that transmit health information electronically in covered transactions.

Where a vendor is a business associate, a contract must exist. Under 45 CFR 164.504(e)(2) it must set the permitted uses and disclosures; bar other use; require appropriate safeguards and compliance with the Security Rule for electronic PHI; require reporting of unauthorised uses and breaches; pass the same restrictions to subcontractors; support access, amendment and accounting of disclosures; make books and records available to HHS; and provide for return or destruction of PHI at termination where feasible 2.

Example (hospital group): a hospital signs a BAA with its messaging vendor before sending appointment reminders that contain PHI.

Protected health information: the data a BAA covers.
Data processing agreement: the GDPR counterpart.
Destination: each recipient in the chain.
Single-tenant vs multi-tenant: tenancy does not replace a BAA.
Audit ledger: evidence of safeguards.

Where it matters

BAA checklist for martech and customer data vendors: what to confirm.
HIPAA-compliant customer data platforms: what "compliant" requires.

Back to the customer data glossary or the Learn hub.

Frequently asked questions

Is there a HIPAA-certified customer data platform?

No. HIPAA creates no certification for software. A vendor can offer a BAA and support the safeguards, but the covered entity remains responsible for how it configures and uses the platform.

When is a BAA not needed?

When the vendor does not create, receive, maintain or transmit PHI for you. Check with counsel, because identifiers combined with health context can be PHI.

Is a BAA the same as a DPA?

No. A BAA is a HIPAA contract for PHI; a GDPR data processing agreement covers personal data under Article 28. A vendor handling both may need both.

Sources

45 CFR 160.103, definitions Open source
45 CFR 164.504(e) and 164.502(e), business associate contracts Open source

This entry is general information, not legal advice.