HIPAA Glossary · Entities & roles
BAA
Also: business associate agreement
The mandatory contract establishing what a business associate may do with PHI, the safeguards required, and breach reporting duties.
Context
Required by §164.504(e). The BAA must cover permitted uses, safeguards, breach reporting, subcontractor flow-down, support for individual rights, return or destruction at termination, and termination for breach. Operating without one when PHI is shared is a standalone violation. See [the BAA guide](/guides/business-associate-agreement/) and [the free BAA template](/hipaa-templates/business-associate-agreement-template/).
Related terms
- Business associate — A person or organisation that creates, receives, maintains, or transmits PHI on behalf of a covered entity.
- Subcontractor — A business associate's business associate. Obligations flow downstream: each link in the chain needs its own agreement.
Where this fits
This is one of 50+ terms in the HIPAA Glossary. For how HIPAA is structured end-to-end, see the Security Rule guide and the Privacy Rule guide.