Business associate agreement (BAA)

What does Business associate agreement (BAA) mean in clinical research?

Under HIPAA, a business associate is a person or company that creates, receives, maintains, or transmits protected health information (PHI) on behalf of a covered entity, other than as a member of its workforce.^⁠[1] The business associate agreement is the written contract that makes that arrangement permissible. Under 45 CFR 164.504(e), the contract must:^⁠[2]

• Establish the permitted and required uses and disclosures of PHI by the vendor.
• Require appropriate safeguards, including the HIPAA Security Rule for electronic PHI.
• Require the vendor to report uses or disclosures the contract does not allow, including breaches.
• Require subcontractors that handle the PHI to agree to the same restrictions.
• Require the vendor to return or destroy the PHI when the contract ends, if feasible.

For recruitment, the BAA is usually the first document a privacy or IT office asks for. A vendor that reads charts to find eligible patients, or that calls and texts patients for a site, is handling PHI, so no data should move until the BAA is signed. Business associates are also bound by the minimum necessary standard, which limits the PHI used or requested to what the purpose requires.^⁠[3]

Practical note: ask each vendor which subcontractors, such as hosting, telephony or model providers, touch PHI, and confirm the BAA chain covers them. Bond signs BAAs with the sites and health systems it works with; see Security.