Business Associate Agreement (BAA)

For healthcare organizations, it's important to comply with Health Insurance Portability and Accountability Act (HIPAA) regulations and keep patient data safe. To do that, they must create a Business Associate Agreement (BAA) that establishes clear responsibilities for business associates handling protected health information (PHI). In this article, we cover BAAs in depth and share best practices for drafting and executing them.

What Is a BAA? 

A BAA is a legal contract between HIPAA-covered entities and business associates that describes how the business associate will protect PHI. This agreement is important because it defines how to use PHI correctly, how to report security incidents, and more. For individuals, medical information is deeply personal. It may include details about their physical and mental health, lifestyle choices, family history, and intimate aspects of their life that they may not want others to know. Think of a BAA as a promise between two parties to keep patient information safe and secure. For developers, a BAA is important if they build applications that process and store PHI on behalf of covered entities like healthcare providers.

Who Are Considered Business Associates and Covered Entities? 

Many telehealth services don't perform all their activities themselves. They outsource some of these to other persons and businesses. Any person or entity that performs certain functions or activities involving the use or disclosure of PHI on behalf of a covered entity is called a business associate.

Business associates may perform any of these activities: processing claims, administration, data analysis, quality assurance, billing, and benefits management. The Privacy Rule in HIPAA lets providers share PHI with these business associates. Some common business associates include: 

• Medical transcriptionist 
• Pharmacists 
• Third-party administrator 
• A consultant who reviews hospitals 
• Cloud service providers 
• Medical billing companies 
• Health information exchanges (HIEs) 
• Software developers who create apps that handle PHI

An example is a company that processes insurance claims for a hospital — it will have access to patient records to verify treatment and coverage. Or an accountant who does bookkeeping for a dental practice and has access to patient billing information. Covered entities include healthcare providers, health plans, and healthcare clearinghouses who are subject to HIPAA regulations. Not everyone who works with a healthcare provider is considered a business associate. Some examples of who typically wouldn't be considered business associates include:

• Members of a hospital's workforce, like employees or trainees
• Other healthcare providers involved in a patient's treatment (like a specialist a patient is referred to) The key difference is whether the person or entity needs PHI to perform their tasks for the covered entity. If they don't need that access, they won't be a business associate. 

How Does a BAA Work? 

A BAA clearly defines the roles, responsibilities, and expectations between a covered entity and a business associate regarding the handling of PHI.

The agreement also specifies what constitutes acceptable use of PHI. This is particularly important for developers who might be using real patient data for testing purposes. Without clear guidelines, they might inadvertently expose sensitive information in non-production environments. We'll also share what you should include in a BAA, but before that let's see in which scenarios a BAA can be essential. Situations where BAAs are needed:

• When a software company or a developer creates and maintains an application to handle PHI for a covered entity (like a hospital or health insurance company)
• When you implement APIs that help you process PHI between healthcare providers or between providers and patients
• When you use data analytics tools that access PHI for healthcare organizations
• When you create or manage cloud-based storage solutions for medical records or other health-related data
• When businesses develop telemedicine platforms that help patients communicate with healthcare providers and involve the transmission of PHI
• When you create a billing or practice management software that processes patient information for healthcare providers
• When you develop mobile health apps that collect, store, or transmit user health data that falls under HIPAA regulations

Apart from this, you should also know about the key HIPAA regulations related to BAAs: 

• Privacy rule: States that business associates should commit to safeguarding PHI 
• Security rule: States that covered entities should make sure that business associates implement proper safeguards to keep electronic PHI safe
• Breach notification rule: States that business associates should notify covered entities about breaches
• Enforcement rule: Outlines penalties for HIPAA violations

Key Components of a BAA Contract 

When you're creating a HIPAA BAA contract, what should you keep in mind? Below are the key components all business associate contracts must include.

PHI Definition

Specify what constitutes PHI under the agreement. When you clearly define what is exactly PHI, you set the scope for the entire agreement and prevent accidental exposure. For example, a developer may not realize that appointment dates combined with other information can be harmful. So you need to make sure that both parties understand what information is to be protected. 

Permitted Uses

Outline the specific purposes for which the business associate can use PHI. This prevents misuse of data and makes sure that PHI is only used for its intended purposes. For example, a business associate may use patient data for marketing or data mining. 

Access Controls

Allow only authorized individuals to view or modify PHI. Some access controls could include user authentication and authorization.

Security Measures

Detail the required technical, physical, and administrative safeguards to protect PHI. Inadequate security measures leave PHI vulnerable to theft. For example, if physical security isn't addressed, someone could steal a server containing unencrypted patient data.

Breach Notification 

Define procedures for reporting and responding to potential security incidents. This way, all parties are informed in case of a data breach, allowing for rapid response. 

Subcontractor Details

Clearly define how you'll manage subcontractors. Subcontractors often need access to PHI, and how you let them handle this data needs to be regulated. This way, all entities handling PHI are bound by the same strict standards, even if they're not directly a part of the agreement. 

Audit Rights

Grant the covered entity the right to audit the business associate's PHI handling practices. A business associate might claim that they're following best practices, but without audits, there's no way to verify this.

Termination Conditions

Outline the procedures for terminating the agreement and handling PHI upon termination. You don't want any business associate to misuse the data once the relationship ends.

Data Return/Destruction

Clarify how to safely delete PHI when no longer needed or when the contract ends.

Best Practices for Drafting and Executing BAAs 

In the next section, we cover some best practices for creating BAAs. While these practices are useful for all stakeholders involved in managing BAAs, here we'll focus on how these are valuable in software development.  

Use Simple Language and Proper Definition of Terminology

When drafting a BAA document, use clear, non-confusing language. In the case of software development, you may want to avoid vague technical vocab. Also, remember to define all terms simply, especially those specific to your application or development process. Key steps you can take:

• Use specific, measurable language
• Define all technical and legal terms
• Provide examples for complex concepts

Example: Instead of "data will be secured," specify "PHI will be encrypted using AES-256 at rest and in transit."

Complete a Thorough Requirement Analysis and Adopt a Security-First Design

Analyze BAA requirements properly and incorporate them into your initial design phases. This means you build compliance into your application from the start, not later. Some things to consider:

• Identify all potential sources and uses of PHI in your system
• Incorporate security features into your initial architecture plans

Design a Robust Breach Notification Process

Nobody likes to think about data breaches, but having a plan in place is vital. Define a clear process for responding to potential data breaches. This helps with timely action and compliance with BAA and HIPAA requirements. Here's what you can consider here: 

• Define specific timeframes for reporting breaches
• Outline the exact steps to be taken in case of a breach
• Specify who is responsible for each step of the process
• Simulate a data breach quarterly, like accidental PHI exposure in a public code repository. Use insights to improve your response plan

Example: "In the event of a suspected breach, the development team will notify the compliance officer within two hours, who will then initiate the incident response plan within 24 hours."

Create a Comprehensive Subcontractor Management Process

Extend BAA requirements to all entities that may handle PHI, including third-party services or contractors. This is important in software development, where external tools and services are common. Keep these things in mind:

• Create a list of all subcontractors who might access PHI
• Validate whether each subcontractor has signed a BAA
• Regularly review and update subcontractor agreements to avoid any loopholes

Ensure Continuous Compliance Through CI/CD and Automated Testing

Integrate compliance checks into your development workflow. This helps catch potential issues early and helps in following BAA requirements. Some activities that you can undertake:

• Set up automated compliance checks in your CI/CD pipeline
• Create and maintain a compliance checklist for code reviews
• Implement regular security scans of your codebase

Adopt Comprehensive Logging Methods

Implement robust logging and monitoring to maintain an audit trail, detect potential security incidents, and demonstrate BAA compliance. This can also include tracking patient interactions with the Notice of Privacy Practices (which explains patients and clients how a telehealth service provider will use their data). Key steps you can plan:

• Log all access to PHI, including who accessed it and when
• Implement real-time alerts for suspicious activities
• Regularly review and analyze logs

Example: "The system will log every instance of PHI access, including user ID, timestamp, and specific data accessed, and retain these logs for three years."

Conduct Regular Training and Awareness Programs

Make sure that all team members understand BAA requirements and their impact on development. This is helpful for maintaining compliance and security. Here's what you can do: 

• Hold quarterly training sessions on HIPAA and BAA requirements
• Incorporate BAA compliance into onboarding for new team members
• Create and distribute easy-to-understand compliance guidelines

Example: "All developers must complete a HIPAA compliance training course annually and pass a certification test with a score of at least 80%."

Implementing these practices helps development teams comply with BAA requirements while building secure applications that protect health information. Regularly review and update your practices as BAAs and compliance requirements evolve. Always consult legal and compliance experts to ensure your implementation meets all necessary standards.

Frequently asked questions