BAA (business associate agreement)

A business associate agreement is the contract HIPAA requires between a covered entity and any vendor that creates, receives, maintains or transmits protected health information on its behalf, setting out the permitted uses, the safeguards, the breach-reporting duties and the obligation to return or destroy the data.

The required contract terms are at 45 CFR § 164.504(e), and the definition of "business associate" is at 45 CFR § 160.103; since the 2013 Omnibus Rule, business associates are directly liable for compliance with the Security Rule and for the uses and disclosures their contracts permit (eCFR, 45 CFR § 164.504; HHS, Business associates). Subcontractors of a business associate need their own BAAs down the chain.

In advertising the BAA question is who receives PHI. A DSP, SSP, measurement vendor or clean-room operator that receives an identifier plus a health-related signal from a covered entity's page is, in HHS's reading of its tracking guidance, a business associate and must sign a BAA, which most ad tech vendors refuse to do (HHS, tracking technologies guidance). The two ways out are to prevent PHI from reaching the vendor at all, by design, or to bring the function in-house so that no vendor exists; an on-premise ad server operated by the covered entity's own staff under its own security program is inside the covered entity, not a business associate.

Example: a hospital system wants to retarget visitors of its orthopaedics pages on the open web; the pixel vendor and the DSP would receive PHI (IP address plus a health condition) and would each need a BAA; the system instead buys contextual placements on sports sites with no visitor data, which needs none.

Related: HIPAA, PHI, clean room, data residency.

Source: 45 CFR § 164.504(e); 45 CFR § 160.103; HHS guidance on business associates.

1. eCFR, 45 CFR § 164.504
2. HHS, Business associates
3. HHS, tracking technologies guidance