HIPAA BAA Guide
Requirements & Best Practices

A Business Associate Agreement is a HIPAA-required written contract between a covered entity (or an upstream business associate) and a vendor that creates, receives, maintains, or transmits PHI on its behalf. The BAA legally binds the business associate to safeguard PHI, limit its use and disclosure, report incidents, and flow the same obligations down to subcontractors. Required BAA elements are set out at 45 CFR 164.504(e); see https://www.hhs.gov/hipaa.

A BAA is required before a covered entity shares PHI with any business associate, and before a business associate shares PHI with a subcontractor. It is not required for the covered entity's own workforce, for disclosures to the individual, or for conduits that merely transport data without routine access (for example, the postal service). If a vendor will create, receive, maintain, or transmit PHI as part of its service, a BAA must be signed first.

Yes. An Indian IT, BPO, analytics, or SaaS firm that handles US patient PHI on behalf of a US covered entity is a HIPAA business associate and must sign a BAA with that covered entity, implement the Security Rule safeguards, and ensure its own subcontractors sign back-to-back BAAs. HIPAA applies based on the handling of US PHI, not the vendor's location, so geography does not exempt Indian business associates.

No. There is no official "HIPAA certification" — HIPAA is a compliance obligation, not a certificate. A BAA is a contract that allocates HIPAA responsibilities; it does not certify compliance. A business associate evidences its compliance through implemented safeguards, a Security Risk Assessment, policies, training, and often an independent attestation such as SOC 2 or ISO 27001 — but no document, including the BAA, constitutes government certification.

Yes. AWS, Microsoft Azure, and Google Cloud all offer BAAs covering their HIPAA-eligible services (signed via AWS Artifact, the Azure/Microsoft terms, and the Google Cloud console respectively). Signing the cloud provider's BAA is necessary but not sufficient: the customer remains responsible for configuring those services securely and for its own administrative, physical, and technical safeguards over the PHI it places in the cloud.