What is a Business Associate Agreement (BAA) for MedTech Vendors?

A Business Associate Agreement (BAA) is the contract a covered entity uses to require a vendor to safeguard protected health information (PHI). If your product or service can create, receive, maintain, or transmit PHI on behalf of a covered entity, a BAA is almost always required.

When is a BAA required?

• You host, process, or analyze PHI for a customer, such as storing case schedules with patient identifiers.
• You are a subcontractor to another vendor that already signed a BAA and you touch PHI downstream.
• You provide on-site services where photos, serials, or logs may contain PHI.

What does a BAA cover?

• Permitted uses and disclosures of PHI
• Safeguards: administrative, physical, and technical
• Breach reporting timelines and cooperation
• Subcontractor flow-down requirements
• Return or destruction of PHI at the end of the contract

Worked example

A device company offers a cloud app where field teams upload case photos that can include labels with patient MRNs. The hospital uses the app to coordinate with sterile processing. Because PHI can be present and the app stores it, a BAA is required. The company should sign a BAA, enable access controls and logging, and restrict exports. If storage is outsourced, those obligations have to flow to that provider too.

Common mistakes

• Saying "we don't store PHI" when photos, logs, and free-text notes often contain it.
• Relying on a generic NDA. An NDA does not satisfy HIPAA's required assurances.
• Missing the subcontractor flow-down. Downstream vendors have to be bound too.
• Leaving the breach timeline vague.

Try the tool

Use the Vendor BAA helper to decide whether a BAA is likely required and to capture talking points for the customer's privacy office. This is not a legal template.