Glossary
BAA
What a BAA, a business associate agreement, is under HIPAA, and what it means for AI at a medical or dental office.
Updated
BAA: A BAA, short for business associate agreement, is the written contract a health care provider covered by HIPAA needs with a vendor before that vendor creates, receives, keeps or sends patients' protected health information on the provider's behalf, beyond only carrying it. In it the vendor gives its assurance that the information will be safeguarded, and the contract sets what the vendor may do with it. A vendor that passes the work on needs the same assurance from the company it passes it to. The rules are federal, in 45 CFR 164.502(e) and 164.504(e).
Where it shows up
It comes up when a medical or dental office brings in software that would handle patient records or patient calls, AI tools included, and asks the vendor to sign one. Whether a given vendor needs one, and what it has to say, is for the practice and its advisers to settle.
We do not offer a BAA today. That is why no AI job we build is set up where patients' health information would reach it, and why, for a medical practice, the written plan settles the question before anything is built.
Start with a written plan
Tell us about the business and what you need. We reply with questions, then a written plan that lists the work and its price, and nothing starts until you have read it.