# Business associate agreement

Concept · [Business and metrics](https://ecosystem.samcarlton.com/business)

Also called: BAA, BAAs, HIPAA BAA

A contract that US health [privacy](https://ecosystem.samcarlton.com/data-privacy) law ([HIPAA](https://ecosystem.samcarlton.com/compliance)) requires before a clinic, health plan or other covered organization lets an outside company, such as a software vendor, handle [protected health information](https://ecosystem.samcarlton.com/protected-health-information) for it. The vendor [promises](https://ecosystem.samcarlton.com/promise-chain) to [safeguard](https://ecosystem.samcarlton.com/guardrails) the information and to report breaches. [Common Paper](https://ecosystem.samcarlton.com/common-paper) publishes a free, standard template for this (Business Associate Agreement).

**For example:** Before a clinic puts patient appointments into a startup's scheduling product, the clinic and the startup sign a BAA.

## Connects to (4)

- [Protected health information](https://ecosystem.samcarlton.com/protected-health-information): Under US health privacy law (HIPAA), health information that can identify a person, such as a diagnosis tied to a name.
- [Compliance](https://ecosystem.samcarlton.com/compliance): Meeting the laws, regulations and standards that apply to a company.
- [Data privacy](https://ecosystem.samcarlton.com/data-privacy): How a company collects, uses, stores and shares information about people.
- [Common Paper](https://ecosystem.samcarlton.com/common-paper): A contract company for startups that publishes free, standard agreements anyone may use and modify, along with software for sending…

> This glossary is plain-language orientation, not legal or financial advice. Before you decide on a company structure, a contract, taxes or a fundraising deal, talk with a lawyer or an accountant.

Map view: https://ecosystem.samcarlton.com/business-associate-agreement