Business associate agreement (BAA)

A business associate agreement, or BAA, is the contract that HIPAA requires when a healthcare provider or health plan (a covered entity) lets an outside company handle patient health information for it. The rule is that a covered entity may allow a business associate to create, receive, maintain or transmit electronic protected health information on its behalf only if it obtains satisfactory assurances that the business associate will safeguard it ¹. In practice, the written assurance is the BAA.

Who counts as a business associate

HIPAA defines a business associate as a person who, other than as a member of the covered entity's workforce, creates, receives, maintains or transmits protected health information ². A company does not become a business associate by being a vendor alone. It becomes one when its service touches patient information.

HHS applies the same test to cloud providers. It says the covered entity, or a business associate, and the cloud service provider must enter into a HIPAA-compliant business associate agreement ³. HHS also says that most vendors and contractors that provide services to covered entities, where the services involve access to protected health information, are business associates ⁴.

An example: a clinic's dictation tool

A physician dictates visit notes into a cloud transcription service. The notes name patients and list diagnoses, so the service receives protected health information. Under HIPAA, the clinic should have a BAA with that service before using it. If the service will not sign one, the clinic should not send patient notes to it. A tool that runs entirely on the clinic's own computers may avoid that vendor relationship, but the clinic still has its own HIPAA duties.

What a BAA does not do

A BAA is a contract, not a certificate. Microsoft states that by offering a Business Associate Agreement it helps support HIPAA compliance, but that using its services does not on its own achieve HIPAA compliance ⁵. The customer still has to configure, use and monitor the system within the rules.

Check three things. Does the vendor sign a BAA for the exact product you will use, since some services are covered and others are not. Does the BAA cover the data the tool stores, such as audio, transcripts and logs. And does your own use follow the vendor's settings.

Why it matters for dictation

Dictation is a common way patient information enters a system. A tool that sends audio to a server may make that server a business associate. A tool that runs on the device may avoid a vendor relationship for that step, but each organization still carries its own obligations. Ask the vendor for its BAA terms before you dictate patient information, and do not rely on a marketing claim of "HIPAA compliant."

This page describes the rules and is not legal advice. Your compliance team or counsel should decide what your organization needs.

Related terms and guides

A BAA applies to protected health information, which is the data it protects. Speech recognition that runs on the device is described in on-device speech recognition. For the clinical side, read HIPAA-compliant dictation: what makes speech to text safe, and the question on whether Apple dictation is HIPAA compliant. For the wider rules on where voice data goes, see is voice to text safe? How to dictate privately.