HIPAA Business Associate Agreement (BAA)
Also called BAA
A contract required by HIPAA between a covered entity and any vendor that handles protected health information on its behalf, setting out permitted uses and breach obligations.
A BAA defines what the vendor may do with protected health information, what safeguards it must maintain, and what it must do when a breach occurs. Without one in place, disclosing PHI to that vendor is itself a HIPAA violation.
A signed BAA is not the same thing as being secure. It is the contractual layer; the technical controls, encryption, access control and audit logging, are what actually protect the data.
The breach notification terms matter more than operators usually realise, because they determine how quickly you learn about an incident on records you are responsible for.
If your platform is breached, the notification obligation reaches your patients under your brand. The BAA is what governs how fast you find out and what the vendor owes you.
HIPAA Business Associate Agreement (BAA), in practice
Yes, as standard on every tier including Launch, alongside encryption in transit and at rest, role-based access control and per-patient audit logging.