A Business Associate Agreement is a legal contract used in U.S. healthcare privacy compliance. It sets the rules for how a vendor, cloud provider, or other service company may create, receive, maintain, or transmit protected health information on behalf of a covered entity. The BAA defines permitted uses, safeguards, breach reporting duties, subcontractor limits, and what happens when the relationship ends.
In cyber security, a BAA matters because the contract helps turn privacy obligations into operational controls. If a vendor handles ePHI without the right agreement, the customer may face compliance gaps even if the technology is secure. In real attacks, BAAs are often reviewed after a cloud compromise, ransomware event, or data exposure to determine whether the provider was authorized to hold the data and whether notice, logging, encryption, and access controls were sufficient. Defenders use BAAs to assign responsibility, reduce vendor ambiguity, and make incident response and audit expectations explicit.