Business associate agreement (BAA): what it is and what it means for you as a buyer

A business associate agreement (BAA) is the written contract that HIPAA, the US health privacy law, requires before an outside company handles patient health information for a healthcare provider, health plan or clearinghouse. It limits how the data is used and requires safeguards and breach reporting.

What it means for you as a buyer

If you are a US healthcare provider, health plan or clearinghouse and your agent will see patient details, you need a signed BAA with the provider before your dedicated agent's first shift. Names tied to appointments, insurance or bills are what HIPAA calls protected health information, and the HIPAA Privacy Rule (45 CFR 164.502(e)) requires the provider's promises in a written contract. Ask for the draft BAA, check who the provider's subcontractors are, and check that the agreement covers them too. If a provider will not sign, keep patient information out of the agent's work entirely.

A worked example with numbers

An example dental practice that wants an agent to confirm 40 appointments a day by phone needs one BAA, signed before the first call. Each call uses a patient's name and appointment time, so the practice is the covered entity and the provider is its business associate.

Under 45 CFR 164.504(e)(2), the agreement must say, in short, that the provider will:

1. Use and share patient data only as the contract allows or the law requires.
2. Use safeguards, and follow the HIPAA Security Rule for electronic records.
3. Report any use or disclosure the contract does not allow, including breaches.
4. Make its subcontractors agree to the same limits in writing.
5. Help you answer patients who ask to see, correct or track their records.
6. Open its records on this to the US Department of Health and Human Services if asked.
7. Return or destroy the data when the contract ends, where it can.

The contract must also let you end it if the provider breaks a material term.

Where this appears in our pricing or process

The provider has confirmed in writing that it signs HIPAA business associate agreements with US healthcare clients, so raise it on your first call and have it signed before any agent sees patient data. The security section of the home page lists everything else the provider has confirmed. For personal data that is not health data, read about the Philippine Data Privacy Act of 2012.