HIPAA & Business Associate Agreements — Good to know

• A requested BAA is not a signed BAA. Storing PHI before the agreement is executed leaves you uncovered, whatever the request card says. • The BAA belongs to the paying account. If your access is covered by a colleague's plan, they have to raise the request from their own settings.