What is a business associate agreement (BAA) under HIPAA?

• A. A privacy policy for patients to read.
• B. A contract ensuring privacy and security compliance when PHI is handled by a business associate.
• C. A contract primarily governing patient billing arrangements.
• D. A consent form used to authorize data sharing with a business associate.

Answer: (B)

A business associate agreement is a contract between a covered entity and a business associate that handles protected health information on its behalf. It ensures privacy and security compliance by spelling out how PHI can be used or disclosed, what safeguards must be in place to protect it, and the business associate’s responsibilities for safeguarding data. It also requires breach reporting, and it often covers responsibilities for subcontractors who may handle PHI. This is a binding HIPAA-focused agreement about protecting PHI, not a patient-facing privacy policy, not primarily a contract about billing arrangements, and not a consent form authorizing data sharing.