October 2026Dataset Refreshed: Expanded to 15.17M+ Unique Contacts
[email protected]+1 727-617-0017

What is a business associate agreement (BAA)?

Also called: BAA, HIPAA business associate agreement

A business associate agreement (BAA) is the contract HIPAA requires between a covered entity, such as a hospital or health plan, and a vendor that creates, receives, maintains or transmits protected health information on its behalf.

By John Britton, VP of Marketing, MedicalProspects · Updated November 4, 2026 · Compliance

Why it matters for healthcare sales and marketing

Vendors selling software or services to hospitals often hear "you'll need to sign a BAA". Knowing when that's true matters: a BAA brings HIPAA obligations for safeguarding patient data, and procurement won't move forward without one when patient data is involved.

How it works

  • When it's needed. A vendor that handles protected health information (PHI) for a covered entity, for example hosting patient records, processing claims or analyzing clinical data, is a business associate and needs a BAA.
  • What it covers. Permitted uses of PHI, safeguards, breach reporting, subcontractor obligations, and return or destruction of PHI at the end of the contract.
  • When it isn't. Buying or using professional contact data about clinicians, such as names, NPIs and work emails, involves no PHI and doesn't make you a business associate.
Comparison: when a BAA is needed (hosting patient records, processing claims, analyzing clinical data, pilots with patient data) and when it isn't (buying clinician contact data, B2B email to clinicians, sales and marketing outreach).
A BAA is needed when a vendor handles patient information, not when it uses clinicians' professional contact data.

Example

Illustrative scenario. A health IT company uses a contact list to reach chief medical information officers; no BAA is involved. When a hospital signs up for a pilot that will process real patient records, the hospital's legal team sends a BAA, and the company puts HIPAA safeguards in place for that work.

Common mistakes

  • Asking for a BAA to buy HCP contact data. Professional contact data isn't PHI.
  • Starting a pilot with patient data before the BAA is signed. Sign first.
  • Forgetting subcontractors. Business associates must pass obligations down to subcontractors who handle PHI.

Related terms

  • HIPAA and B2B Healthcare OutreachHIPAA protects patients' health information held by health plans, healthcare clearinghouses, most healthcare providers and their business associates. A clinician's professional contact details are not patient health information, so B2B email to healthcare professionals is governed by marketing laws such as CAN-SPAM rather than by HIPAA.
  • CAN-SPAM ActThe CAN-SPAM Act is the U.S. law that sets the rules for commercial email, including business-to-business email. It doesn't require prior consent, but it does require honest sender information and subject lines, a physical postal address, a working opt-out, and handling opt-outs within 10 business days.
  • HCP List (Healthcare Professional List)An HCP list is a database of individual healthcare professionals, such as physicians, nurse practitioners, pharmacists and nurses, with identifiers, specialties and contact details used for sales and marketing. Its counterpart, an HCO list, covers healthcare organizations.

Put it to work

Sources

  1. Business Associate Contracts: Sample Provisions, U.S. Department of Health and Human Services
  2. Covered Entities and Business Associates, U.S. Department of Health and Human Services

← Back to the healthcare GTM glossary