HIPAA GUIDES
What Is a BAA? Business Associate Agreements Explained
Short Answer
A Business Associate Agreement, or BAA, is a written contract between a HIPAA covered entity and a vendor that handles protected health information on its behalf. It sets out how the vendor may use that information and requires the vendor to safeguard it. If a software company stores your patient information and will not sign a BAA, that tool is not an option for patient data.
Who Counts as a Business Associate
HHS describes a business associate as a person or organization that creates, receives, maintains or transmits protected health information while doing work on behalf of a covered entity. One of the examples HHS gives is a cloud service provider engaged to store or handle electronic protected health information.
For a private practice, that usually includes the software you use for client records, intake forms, scheduling and email, whenever those tools hold patient information.
What a BAA Has to Include
HHS lists what the contract must do. In plain terms, it must:
- Say how the vendor is allowed to use and disclose protected health information
- Bar the vendor from using it in any other way
- Require appropriate safeguards, including the HIPAA Security Rule for electronic information
- Require the vendor to report improper uses and breaches to you
- Require subcontractors with access to agree to the same restrictions
- Require the information to be returned or destroyed at the end of the contract, if feasible
- Let you end the contract if the vendor violates a material term
When You Do Not Need One
HHS notes that the conduit exception is limited to entities that only provide transmission services. A platform that stores your data does not qualify.
- Sharing information with another health care provider for a patient's treatment
- Services that act only as a conduit and simply transmit information without storing it for you
- Vendors that never touch patient information at all
A BAA Is Not the Whole Job
Signing a BAA does not make a practice compliant by itself. You still decide who has access, how accounts are secured, what you collect and how your team is trained. Think of the BAA as the entry ticket, not the finish line.
How This Works at Aspire Builder Pro
The HIPAA plan at $297 per month includes a signed BAA. See HIPAA compliance at Aspire Builder Pro for how responsibilities are shared between your practice, our team and the underlying platform.
Frequently Asked Questions
Sources
This article is general information, not legal advice. Vendor plans and policies change, so confirm details with each vendor before you rely on them. Last reviewed October 10, 2026.
