Business Associate Agreement (BAA)
A HIPAA-required contract defining permitted PHI uses and safeguard, reporting, and subcontractor duties between regulated parties.
In practice
Execute a BAA before ePHI processing begins and align its incident and return/deletion terms with operations.
Common confusion
Signing a BAA does not by itself make a service or configuration HIPAA compliant.