By Eric Andrew Kristof, RN, CAHIMS | Healthcare IT Professional | HIMSS Arkansas Chapter Member
About This Series: The HIMSS Word of the Day is a running blog series drawing from the HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025) — the authoritative reference for healthcare IT professionals and the primary study resource for CAHIMS and CPHIMS certification. Each post paraphrases the term in plain language, grounds it in real-world healthcare IT context, and adds a bedside nursing perspective you won’t find in a textbook.
📖 The Term: Business Associate Agreement (BAA)
Source: HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025)
🔍 Plain-Language Definition
A business associate agreement (BAA) is a contract required by HIPAA when a healthcare organization shares protected health information with an outside company or person that works on its behalf. It spells out how that partner may use the information and how it must protect it.
The HIMSS Dictionary, which also calls it a HIPAA business associate agreement, describes the BAA as the HIPAA-defined contract between a covered entity and a business associate (BA) that protects protected health information (PHI) according to HIPAA requirements, and it points readers to the definition of a covered entity.
Three roles matter:
| Role | Who It Is | Examples |
|---|---|---|
| Covered Entity | Health plans, healthcare clearinghouses, and providers that conduct certain transactions electronically | Hospitals, clinics, physician practices, insurers |
| Business Associate | A person or organization that creates, receives, maintains, or transmits PHI on behalf of a covered entity, or provides certain services involving PHI | Billing companies, cloud hosting providers, transcription services, health information exchange organizations, consultants |
| Subcontractor | An organization that handles PHI on behalf of a business associate | A data center used by a billing company |
Not every outside party is a business associate. Members of the organization’s own workforce are not business associates, and a hospital that sends records to another provider for treatment does not need a BAA with that provider.
⚠️ Exam Alert: A covered entity is directly regulated by HIPAA because of what it is. A business associate is regulated because of what it does with PHI for a covered entity. A BAA is the contract between them. A data use agreement (DUA) is a different contract, used when sharing a limited data set for research, public health, or operations. Since the HITECH Act and the 2013 Omnibus Rule, business associates and their subcontractors are directly liable for certain HIPAA requirements, not just contractually bound.
🌐 Why It Matters: Real-World Healthcare IT Context
Modern healthcare runs on vendors. EHR hosting, revenue cycle services, transcription, data analytics, patient communication platforms, telehealth services, and many apps all handle PHI for hospitals and clinics. Every one of those relationships is a path the data can travel, and the BAA is how HIPAA’s protections travel with it.
HIPAA’s regulations list what a BAA must address. Among other things, the contract must describe the permitted uses and disclosures of PHI, require the business associate to use appropriate safeguards and comply with the Security Rule for electronic PHI, require reporting of improper uses and disclosures, including breaches, and require subcontractors to agree to the same restrictions. It must also support patients’ rights to access and amend their information and to receive an accounting of disclosures, make records available to HHS when needed, and require the return or destruction of PHI when the relationship ends.
Cloud computing raised a common question: does a cloud provider that stores only encrypted data, without the key, need a BAA? HHS guidance says yes. A cloud service provider that maintains electronic PHI for a covered entity is a business associate even if it cannot view the data.
Vendor incidents can have enormous reach. The 2024 Change Healthcare cyberattack, which HHS reported had affected roughly 192.7 million individuals as of mid-2025, showed how one company that serves thousands of healthcare organizations can become a single point of failure for privacy, claims, and pharmacy operations.
Common BAA problems:
- Vendors that handle PHI without any BAA in place
- Outdated agreements that predate the Omnibus Rule
- Missing subcontractor agreements further down the supply chain
- Vague breach reporting timelines and responsibilities
- No process to verify that vendors actually follow the security terms
- Staff adopting free apps or online tools that have no BAA
Elements of a strong vendor privacy program:
- An inventory of every vendor that touches PHI
- Standard BAA templates reviewed by legal and compliance
- Security risk assessments before contracting, not after
- Clear breach notification timelines and contacts
- Periodic review of vendor access and data flows
- Policies telling staff which tools are approved for PHI
🏥 The Nurse’s Perspective: Clinical, Bedside, & Workflow
Nurses rarely sign BAAs, but they make daily choices that depend on whether one exists.
At the Bedside
The most important question a nurse can ask before using a new tool with patient information is whether the organization has approved it. A consumer texting app, a personal cloud storage account, or a free transcription or translation website may be convenient, but if the organization has no BAA with that company, sending PHI through it can be an impermissible disclosure.
The same principle applies to artificial intelligence. Pasting patient details into a public chatbot is very different from using an AI tool the organization has contracted for and covered under a BAA. Approved tools usually appear inside the EHR or on organization-managed devices.
In Clinical Workflow
Many clinical workflows rely on business associates without nurses noticing. Telehealth platforms, interpreter services, secure messaging systems, remote monitoring vendors, and patient education services often handle PHI under BAAs. When nurses use the organization’s approved versions of these tools, the contractual safeguards are already in place.
Nurses can also help spot problems. A vendor representative asking for patient lists, a new app being piloted informally on a unit, or a request to email PHI to an outside address are good reasons to check with the privacy office.
In EHR Implementation (Go-Live Perspective)
During an Epic Go-Live, many of the people at the elbow are consultants from outside firms. Their access to patient information is governed by agreements between the hospital and the consulting company, along with confidentiality and security training. Support analysts follow the same rules as employees: access only what is needed to help the user, never take PHI off site, and report any suspected privacy issue.
Go-Live projects also bring new vendors into the environment, such as interface partners, third-party applications, and cloud services. Confirming that each one is covered by a BAA before production data flows is part of a well-run implementation plan.
🎓 CAHIMS / CPHIMS & HIMSS Perspective
CAHIMS Exam Domain Mapping
BAAs are a frequently tested HIPAA topic:
| CAHIMS Domain | How BAAs Appear |
|---|---|
| Healthcare & Technology Environments | HIPAA roles; HITECH and the Omnibus Rule; direct liability of business associates |
| Clinical Informatics | Approved tools for PHI; telehealth and messaging vendors; AI tools in clinical work |
| Healthcare Information & Systems Management | Cloud hosting, interfaces, third-party apps, security requirements in contracts |
| Management & Leadership | Vendor management, contract review, third-party risk assessment, breach response |
Key Terms to Know Alongside BAA
- Covered Entity — a health plan, healthcare clearinghouse, or provider that conducts certain transactions electronically and must comply with HIPAA
- Business Associate — a person or organization that handles PHI on behalf of a covered entity
- Subcontractor — an entity that handles PHI on behalf of a business associate and is itself treated as a business associate
- Data Use Agreement (DUA) — a contract governing the use of a limited data set
- Minimum Necessary — the HIPAA principle of limiting uses and disclosures of PHI to what is needed for the purpose
- Third-Party Risk Management — processes for assessing and monitoring the security of vendors and partners
HIMSS Organizational Position
HIMSS addresses business associate relationships through its privacy and cybersecurity work, including third-party and supply chain risk. Its Healthcare Cybersecurity Community shares practices for vendor risk management, and HIMSS engages on HIPAA policy through its public policy work. Members can find related education and research through the HIMSS Resource Center.
🔗 Explore Further: External References
- HHS — Business Associates https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/business-associates/index.html
- HHS — Sample Business Associate Agreement Provisions https://www.hhs.gov/hipaa/for-professionals/covered-entities/sample-business-associate-agreement-provisions/index.html
- HHS — Guidance on HIPAA and Cloud Computing https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html
- HHS — Covered Entities and Business Associates https://www.hhs.gov/hipaa/for-professionals/covered-entities/index.html
- eCFR — 45 CFR 164.504, Uses and Disclosures: Organizational Requirements https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.504
- HHS — Change Healthcare Cybersecurity Incident FAQ https://www.hhs.gov/hipaa/for-professionals/special-topics/change-healthcare-cybersecurity-incident-frequently-asked-questions/index.html
Term source: HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025). All definitions in this series are paraphrased for editorial purposes. Readers are encouraged to consult the primary source for exact language.
Eric Andrew Kristof, RN, CAHIMS is a Healthcare IT professional and HIMSS Arkansas Chapter member based in Hot Springs Village, AR, with hands-on Epic Go-Live experience and a diverse healthcare and IT background. He writes at kristof.org at the intersection of clinical care and healthcare technology.
Leave a Reply