--- title: "What is a business associate agreement?" description: "Business Associate Agreement explained in plain English: definition, how it works in a remote team, an example. See an example and the common mistakes." url: https://assistbpo.com/glossary/business-associate-agreement/ updated: 2026-09-20 publisher: AssistBPO (SS Support Network LLC) language: en-US --- # What is a business associate agreement? Glossary What is a business associate agreement? A business associate agreement (BAA) is a written contract required under HIPAA between a covered entity, such as a medical or dental practice, and any vendor that handles protected health information on its behalf. It sets out permitted uses, safeguards, breach reporting and data return at contract end. The HHS Office for Civil Rights (OCR) enforces the rule. Updated September 2026 · Reviewed by [Nimra Khalid](https://assistbpo.com/team/nimra-khalid/) ## How does a business associate agreement work? 1. The practice lists every vendor that touches PHI: billing, scheduling, remote front-desk staff, cloud storage and answering services. 2. Both parties sign the BAA before any PHI is shared, naming the permitted uses and the safeguards the vendor must keep in place. 3. The vendor limits access to the minimum necessary, trains its staff, and reports any suspected breach within the agreed window. 4. Subcontractors of the vendor sign their own downstream BAA so the chain of responsibility stays unbroken. 5. At termination, PHI is returned or destroyed and the vendor confirms the destruction in writing. ## A worked example A three-dentist practice in Ohio wants a remote scheduler to confirm appointments and post insurance eligibility notes in Open Dental. Before onboarding, the office manager sends the staffing provider's BAA template to the practice's attorney, who adds a five-business-day breach notification clause. The signed BAA is filed with the practice's HIPAA policies. The scheduler then receives a named Open Dental login limited to the schedule and eligibility tabs, and the practice records the BAA date in its annual risk assessment. ## Where does a business associate agreement show up in your tools? A BAA shows up as a signed PDF in the practice's compliance binder, as a checkbox in the vendor onboarding form, and as a user-access record in practice management systems such as Dentrix, Open Dental or athenahealth where the vendor's login is tied to the agreement. ## Common mistakes - Treating a non-disclosure agreement as a substitute: an NDA covers confidentiality in general, while a BAA carries specific HIPAA obligations and breach duties. - Signing the BAA after the assistant has already started, which leaves a gap where PHI was shared without a contract. - Forgetting subcontractors, so the practice has a BAA with the staffing firm but nothing covers the firm's own cloud or telephony vendors. ## Why does a business associate agreement matter? Without a BAA, a practice that shares patient data with a remote assistant is out of compliance from the first shared record, and OCR has settled cases over exactly this gap. The agreement also gives the practice a clear breach process and a named party responsible for safeguards. This is a plain-language summary, not legal advice. ## How does AssistBPO handle a business associate agreement? AssistBPO signs a BAA with every healthcare client before a single patient record is opened, drawing on the medical practice work of our sister brand SS Support Network. Every healthcare engagement runs with HIPAA-trained staff and a BAA in place from day one, with access limited to the screens the role needs. [A front desk that never misses a recall](https://assistbpo.com/services/dental-front-desk/)[Get a staffing plan](https://assistbpo.com/get-a-staffing-plan/) ## Related terms - [HIPAA](https://assistbpo.com/glossary/hipaa/) - [Non-disclosure agreement](https://assistbpo.com/glossary/non-disclosure-agreement/) - [Least privilege access](https://assistbpo.com/glossary/least-privilege-access/) - [Eligibility verification](https://assistbpo.com/glossary/eligibility-verification/) - [Onboarding](https://assistbpo.com/glossary/onboarding/) ## Where it is used - [A front desk that never misses a recall](https://assistbpo.com/services/dental-front-desk/) ## Next in the A to Z - [Calendar blocking](https://assistbpo.com/glossary/calendar-blocking/) - [Call monitoring](https://assistbpo.com/glossary/call-monitoring/) - [Call recording consent](https://assistbpo.com/glossary/call-recording-consent/) - [Call routing](https://assistbpo.com/glossary/call-routing/) [All 148 terms, A to Z](https://assistbpo.com/glossary/) Next step ## Your desk, staffed. Wherever you are. Tell us what is overloaded. A named person replies within 1 business day with a staffing plan, and we propose your assistant within 72 hours. [Get a staffing plan](https://assistbpo.com/get-a-staffing-plan/) [Book a 20-minute call](https://assistbpo.com/book-a-call/) Or call [+1-657-777-0006](tel:+16577770006) during US, UK or Australian business hours, or [hear our demo receptionist](https://assistbpo.com/demo-line/). - A named assistant proposed within 72 hours - Employed, screened and managed staff, never freelancers - Your hours, your tools, your data --- Source: https://assistbpo.com/glossary/business-associate-agreement/ · Contact: https://assistbpo.com/contact/ · Full site map for agents: https://assistbpo.com/llms.txt