Compliance
BAA
Business Associate Agreement — required contract before a vendor can touch PHI.
A BAA (Business Associate Agreement) is the contract a covered entity (your clinic) signs with any vendor that handles PHI on its behalf. Without a signed BAA, sharing PHI with the vendor is itself a HIPAA violation. Cloud providers (Google Workspace, AWS, etc.) all have a BAA you must execute before storing PHI in their products.
Related terms
Need help moving patient data?
We’ve done it 140+ times across 70+ EHRs. 15-minute discovery, no pressure.