HIPAA & Business Associate Agreements — What a BAA is, and what it isn't

Under HIPAA, a vendor that handles protected health information (PHI) on a covered entity's behalf is a Business Associate, and that relationship is created by a signed contract - the Business Associate Agreement. It commits us to specific obligations: administrative, physical and technical safeguards, breach notification within defined timeframes, and equivalent agreements with any subprocessor that could touch your data. It is worth knowing that HIPAA has no certification. There is no auditor who inspects a product and declares it HIPAA compliant, so any vendor showing you a "HIPAA certificate" is describing something that does not exist. The agreement is the real artefact - which is why RowFold offers one rather than a badge.