Business Associate | BA Agreements

BA (business associate) is the HIPAA term for organizations that are not covered entities, but that do have access to PHI and extend the “chain of trust.” A BA can be a claims processor, a modality service vendor, or any other third party that has access to personal health information.

HIPAA requires that BA agreements be established between covered entities (i.e., the healthcare institution) and BAs. In general, BA agreements commit the BA to not misuse or disclose PHI, to employ safeguards to protect PHI, to assist the covered entity with patient access as appropriate, and to return or destroy PHI when the contract ends.