Business Associate Agreement (BAA)

What is a BAA?

A Business Associate Agreement (BAA) is a contract required by HIPAA between a healthcare provider (the covered entity) and a vendor that handles protected health information (PHI) on its behalf (the business associate). It sets out how that vendor must protect PHI, what it may and may not do with it, and what happens if something goes wrong.

Do we sign BAAs?

Yes. MedCare Agency signs a Business Associate Agreement with every client whose services involve PHI, at no extra cost and on every plan. The BAA is signed before any patient information is collected, stored or transmitted through systems we manage.

What our BAA covers

• Permitted uses and disclosures of PHI, limited to providing the services you hired us for.
• Administrative, physical and technical safeguards we maintain under the HIPAA Security Rule.
• Breach and security incident notification to your practice.
• Requirements for any subcontractors who handle PHI to agree to the same protections.
• Support for patient rights requests, such as access and amendment, where they involve data we hold.
• Return or secure destruction of PHI when our services end.

Why it matters for your website

Many popular website builders and form tools will not sign a BAA. If your website collects intake details, appointment requests or symptom information through a vendor without a BAA, your practice may be exposed to HIPAA risk. Moving that data flow to vendors that sign BAAs, and configuring them correctly, is one of the first things we fix for new clients.

How to get a copy

Current clients can request a copy of their signed BAA at any time. Prospective clients can request our standard BAA for review by their compliance officer or attorney before signing anything. Email info@medcareagency.net with "BAA request" in the subject line, or book a short call.