Documentation
Business Associate Agreement (BAA)
A written contract required by HIPAA between a covered entity and a business associate. It establishes permitted uses and disclosures of PHI, requires safeguards, and mandates breach notification.
Definition
A written contract required by HIPAA between a covered entity and a business associate. It establishes permitted uses and disclosures of PHI, requires safeguards, and mandates breach notification.
What This Means for Your Facility
Under HIPAA (45 CFR §164.502(e)), a covered entity may not disclose PHI to a business associate without a signed BAA in place. Business associates include any person or organization that creates, receives, maintains, or transmits PHI on behalf of a covered entity, waste haulers who handle documents containing patient information, IT vendors with access to EHR systems, billing companies, cloud storage providers, and shredding services all qualify. Since the 2013 HIPAA Omnibus Rule, business associates are directly liable for HIPAA compliance, not just contractually bound.
A common compliance gap is the failure to execute BAAs with all qualifying vendors. Many facilities have BAAs with their EHR vendor and clearinghouse but overlook their medical waste hauler, their document destruction provider, or their answering service. Each missing BAA is a separate HIPAA violation. HHS has pursued enforcement actions specifically for BAA failures, with settlements reaching $1.55 million for a single provider.
BayArea Compliance executes a BAA with every client as standard practice, we handle medical waste that may contain PHI on labels, manifests, and containers. Our HIPAA|360 program also includes a vendor audit that identifies all of your business associate relationships and verifies that current, compliant BAAs are in place for each one.
Related Terms
Chain of Custody
Documentation that tracks the possession and handling of waste from generation through final disposal. Required for controlled substance destruction and hazardous waste shipments to ensure regulatory compliance and prevent diversion.
IIPP (Injury and Illness Prevention Program)
Required by Cal/OSHA (Title 8, Section 3203) for all California employers. A written program that identifies workplace hazards, provides employee training, ensures hazard correction, and documents safety activities. Must be reviewed and updated annually.
Manifest (Waste Tracking)
A document (EPA Form 8700-22) that tracks hazardous waste from the point of generation to final disposal. Required by RCRA for all hazardous waste shipments.
SDS (Safety Data Sheet)
Standardized 16-section document providing information about a chemical substance's properties, hazards, safe handling, storage, and emergency procedures. Required by OSHA's HazCom standard for every hazardous chemical in the workplace.
Ready to Simplify Your Compliance?
One vendor for waste disposal, training, and regulatory compliance across the Bay Area, led by the 2025 NRC Recycler of the Year. Get a free assessment today.