They expertly mapped the overlapping controls between SOC 2 and ISO 27001, which saved us from duplicating work.
Jasreet Kaur B.Silicon Physical Design Engineer · Small-BusinessSOC 2 + ISO 27001 · August 2026
HIPAA · Business Associate Agreements
HIPAA BAA Guide Requirements & Best Practices
A Business Associate Agreement (BAA) is a contract required by HIPAA between a Covered Entity and any third party that will create, receive, maintain, or transmit PHI on their behalf.
Required clauses are defined at 45 CFR 164.504(e) — and a BAA is a contract, not a certificate: HIPAA has no official certification.
10Required BAA clauses
4Cloud provider BAAs compared
1,000+Audits delivered
45 CFR 164.504(e) · U.S. Dept. of Health & Human Services (OCR) · Last reviewed June 2026
Direct Answer
A Business Associate Agreement (BAA) is the HIPAA-required written contract that must be in place before a covered entity shares PHI with a vendor — or before a business associate shares PHI with a subcontractor — that handles that data on its behalf. The required clauses are defined at 45 CFR 164.504(e) by the HHS Office for Civil Rights (hhs.gov/hipaa). For Indian IT, BPO, and SaaS firms serving US healthcare clients, signing a BAA is mandatory because they are business associates handling US PHI — but a BAA is a contract, not a certificate: HIPAA has no official certification.
Key Takeaways
- A BAA is required before any vendor that will create, receive, maintain, or transmit PHI can be given access — and again, back-to-back, for every subcontractor.
- Required clauses (45 CFR 164.504(e)) cover permitted uses, safeguards, incident reporting, subcontractor flow-down, individual access, and return or destruction of PHI at termination.
- Indian outsourcing and SaaS companies handling US PHI are business associates and must sign BAAs — HIPAA applies based on the data, not the vendor's location.
- A signed BAA does not make a company "HIPAA certified". Compliance is evidenced through safeguards, a risk assessment, and attestations like SOC 2 or ISO 27001.
Definitions
What is a Business Associate?
A Business Associate is any person or entity that performs functions or activities involving PHI on behalf of a Covered Entity. This includes:
- IT service providers and cloud hosts
- Medical billing companies
- Claims processors
- Practice management consultants
- Data analytics vendors
- EHR/EMR vendors
- Transcription services
Indian Companies as Business Associates
Indian healthcare IT, BPO, and SaaS companies serving US healthcare clients are Business Associates and must:
• Sign BAAs with US Covered Entities
• Implement HIPAA Security Rule safeguards
• Ensure subcontractors also sign BAAs
• Report breaches to Covered Entity
45 CFR 164.504(e)
Required BAA Provisions
Every BAA must include these HIPAA-mandated provisions (45 CFR 164.504(e)):
| Required clause | What the business associate must do |
|---|---|
| Permitted Uses | Specify how the BA may use and disclose PHI |
| Safeguards | BA must use appropriate safeguards to prevent unauthorized use/disclosure |
| Reporting | Report any unauthorized use, disclosure, or security incident |
| Subcontractor Assurances | Ensure subcontractors agree to same restrictions |
| Access to PHI | Make PHI available to individual for access requests |
| Amendment | Make PHI available for amendment |
| Accounting | Make information available for accounting of disclosures |
| HHS Compliance | Make practices available to HHS for compliance review |
| Return/Destroy | Return or destroy PHI at termination |
| Termination | Authorize termination if BA violates the agreement |
Cloud Coverage
Cloud Provider BAAs
Major cloud providers offer BAAs for HIPAA-eligible services:
AWS
BAA Available
Sign via AWS Artifact. Covers most HIPAA-eligible services.
Microsoft Azure
BAA Available
Sign via Azure Portal. Online Services Terms include BAA.
Google Cloud
BAA Available
Sign via Cloud Console. Covers all HIPAA-eligible services.
Salesforce
BAA Available
Available for Health Cloud and Shield products.
Before You Share PHI
Vendor Due-Diligence Checklist
Before sharing PHI with any business associate, work through these steps:
- Verify vendor handles PHI (Business Associate status)
- Request and review vendor's HIPAA compliance documentation
- Review vendor's security certifications (SOC 2, ISO 27001)
- Execute BAA before sharing any PHI
- Verify BAA covers all required HIPAA provisions
- Document vendor due diligence process
- Establish incident reporting procedures
- Plan for annual vendor compliance reviews
Proof
In their words.
Quotes verbatim from G2. Company names added where the client confirmed them.
Instead of simply providing generic templates or checklists, their team took the time to understand our environment and requirements.
Anand .Market Risk Analyst · Mid-MarketCompliance readiness · September 2026
The team’s willingness to work with us and ease of communication.
sam v.CEO · Small-BusinessSOC 2 Type I + ISO 27001 · August 2026
They delivered the project with speed, accuracy, and cost-effectiveness.
Maneet P.Mid-MarketSOC 2 · August 2026
My only regret is that we didn’t engage them sooner in our compliance journey, which would have saved us even more time.
Mahesh Raju C. · XonarSmall-BusinessSOC 2 · GRC · August 2026
They were always responsive and willing to go the extra mile whenever we had questions or needed guidance.
Chandan J. · DsiderSmall-BusinessSOC 2 Type I · August 2026
Managing the auditor relationship on our behalf was especially valuable — it took a lot of pressure off our internal team.
Achyut B.Senior Software Engineer · Small-BusinessSOC 2 + ISO 27001 · September 2026
Their focus on ensuring that we were genuinely audit-ready rather than simply completing documentation.
Ravi V.Founder & CEO · Mid-MarketSOC 2 Type II · August 2026
The guidance was not generic or simply based on a standard checklist — they suggested practical approaches that made sense for our business.
Verified UserInternational Trade and Development · Small-BusinessSOC 2 + ISO 27001 · September 2026
What I like best is the hands-on support and clear guidance throughout the SOC 1 and SOC 2 process.
Sai Sudha S. · ExcersSmall-BusinessSOC 1 + SOC 2 · September 2026
Frequently Asked Questions
Common questions on HIPAA Business Associate Agreements, required clauses, and cloud BAAs.
What is a Business Associate Agreement (BAA)?
A Business Associate Agreement is a HIPAA-required written contract between a covered entity (or an upstream business associate) and a vendor that creates, receives, maintains, or transmits PHI on its behalf. The BAA legally binds the business associate to safeguard PHI, limit its use and disclosure, report incidents, and flow the same obligations down to subcontractors. Required BAA elements are set out at 45 CFR 164.504(e). See https://www.hhs.gov/hipaa.
When is a BAA required?
A BAA is required before a covered entity shares PHI with any business associate, and before a business associate shares PHI with a subcontractor. It is not required for the covered entity's own workforce, for disclosures to the individual, or for conduits that merely transport data without routine access (for example, the postal service). If a vendor will create, receive, maintain, or transmit PHI as part of its service, a BAA must be signed first.
Are Indian outsourcing and SaaS companies required to sign BAAs?
Yes. An Indian IT, BPO, analytics, or SaaS firm that handles US patient PHI on behalf of a US covered entity is a HIPAA business associate and must sign a BAA with that covered entity, implement the Security Rule safeguards, and ensure its own subcontractors sign back-to-back BAAs. HIPAA applies based on the handling of US PHI, not the vendor's location, so geography does not exempt Indian business associates.
Does signing a BAA make a company "HIPAA certified"?
No. There is no official "HIPAA certification" — HIPAA is a compliance obligation, not a certificate. A BAA is a contract that allocates HIPAA responsibilities. It does not certify compliance. A business associate evidences its compliance through implemented safeguards, a Security Risk Assessment, policies, training, and often an independent attestation such as SOC 2 or ISO 27001 — but no document, including the BAA, constitutes government certification.
Do cloud providers like AWS, Azure, and Google Cloud sign BAAs?
Yes. AWS, Microsoft Azure, and Google Cloud all offer BAAs covering their HIPAA-eligible services (signed via AWS Artifact, the Azure/Microsoft terms, and the Google Cloud console respectively). Signing the cloud provider's BAA is necessary but not sufficient: the customer remains responsible for configuring those services securely and for its own administrative, physical, and technical safeguards over the PHI it places in the cloud.
Continue your HIPAA research
- HIPAA compliance hub — the Privacy Rule, Security Rule, breach notification, and penalties in one place.
- HIPAA consulting for Indian companies — BAA review and business-associate readiness (indicative ₹1.5–4L).
- HIPAA for Indian business associates — why US PHI work makes you a business associate that must sign BAAs.
- Tranquility Cybersecurity credentials & proof.
Keep Exploring
Related Reading
HIPAA
HIPAA Knowledge Hub
Privacy Rule, Security Rule, BAAs, cloud guides and penalties.
Read moreHIPAA
HIPAA Privacy Rule
Use and disclosure standards for protected health information.
Read moreHIPAA
HIPAA Security Rule
Administrative, physical and technical safeguards for ePHI.
Read moreHIPAA
HIPAA Cloud Compliance
Running PHI workloads on AWS, Azure and GCP compliantly.
Read moreService
HIPAA Consulting in India
HIPAA programs for Indian healthtech and BPO business associates.
Read moreHIPAA
HIPAA Compliance
US health-data rules for healthtech and business associates.
Read more