GRC Oversight
Glossary

BAA

Business Associate Agreement: a contract required under HIPAA between a covered entity and any vendor that handles protected health information on its behalf.

A BAA (Business Associate Agreement) is a HIPAA-required contract. If your company processes, stores, or transmits protected health information (PHI) for a healthcare customer, that customer is legally required to have a signed BAA with you before sharing PHI. It's often one of the first things a healthcare buyer's security review checks for.

Looking for another term or the full list?