Business associate agreement
Also known as BAA
A contract required under HIPAA between a covered entity and any vendor that handles protected health information on its behalf.
If a vendor can access PHI, a BAA is mandatory. It sets out permitted uses, required safeguards, breach notification duties, and what happens to the data at the end of the relationship.
It does not make a vendor secure. It makes them contractually accountable, which is necessary but not the same thing as due diligence on how they actually operate.
Where this comes up
Business associate agreement sits inside our compliance and frameworks work. If you are trying to work out what this means for your own environment rather than in the abstract, that is the page worth reading next, and a short call will get you a straight answer faster than either.