Business Associate Agreement (BAA)
A HIPAA-required contract between a healthcare entity and a vendor that handles protected health information (PHI), defining how the vendor safeguards that data.
A Business Associate Agreement (BAA) is the legal foundation for using any third-party service with protected health information under HIPAA. Without a signed BAA, sharing PHI with a vendor — including a cloud transcription service — is itself a violation. Reputable vendors offer BAAs willingly and explain their responsibilities.
For transcription specifically, the requirement pushes buyers toward two options: a cloud vendor that will sign a BAA and meet its terms, or an on-prem tool that processes audio locally so no PHI leaves the organisation and a BAA may not be needed at all. Compliant setups also expect access controls (MFA), audit logs and, often, EHR integration (Epic, Cerner, Athenahealth).