Business Associate Agreement (BAA) — A legally required contract under HIPAA between a covered entity (such as a healthcare provider or health plan) and a business associate (a vendor or third party that handles protected health information on their behalf). Without a signed BAA, sharing PHI with a vendor would be a HIPAA violation.
