---
title: "What Is a BAA? Business Associate Agreement Definition"
description: "A business associate agreement is the HIPAA contract a vendor signs before it handles PHI: what it must contain, who signs it, and how Cuvo Health signs one."
canonical: "https://cuvo.co/glossary/business-associate-agreement"
last-updated: "Oct 26, 2026"
---
**Definition:** A business associate agreement (BAA) is the written contract HIPAA requires before a covered entity lets a vendor create, receive, maintain or transmit protected health information on its behalf, setting how the vendor may use, safeguard and return it.

# What is a business associate agreement (BAA)?

Every vendor that handles protected health information for a medical practice signs one, and HIPAA dictates what goes in it. For a telehealth brand, the business associate agreement decides which companies may hold patient data and on what terms. Cuvo Health signs one on every plan.

Published Oct 26, 2026. Facts reviewed Oct 26, 2026.

A business associate agreement (BAA) is the written contract HIPAA requires before a covered entity lets a vendor create, receive, maintain or transmit protected health information on its behalf. Under 45 CFR 164.502(e), the covered entity must obtain the vendor's written assurance that it will safeguard the information, and 45 CFR 164.504(e) lists the terms that contract must contain, from the permitted uses of the data to its return or destruction when the relationship ends. In telehealth, the covered entity is usually the licensed practice that treats the patient, and the platform that runs the clinical layer is its business associate. Cuvo Health signs a business associate agreement on every plan, because Cuvo operates the PHI-handling infrastructure behind the brand.

**At a glance**
- What it is: The contract that lets a vendor handle protected health information for a covered entity
- Required by: 45 CFR 164.502(e), with the required terms listed in 164.504(e)
- Who signs: The covered entity and each business associate; a business associate signs with its own subcontractors
- Breach duty: The vendor reports breaches of unsecured PHI to the covered entity without unreasonable delay, within 60 days (164.410)
- On Cuvo: A signed BAA on every plan, alongside SOC 2 Type II, SSO and an uptime SLA

**What 45 CFR 164.504(e) requires a business associate agreement to contain**

| Term | What the contract must say | Rule |
| --- | --- | --- |
| **Permitted uses** | The uses and disclosures of PHI the vendor may make, and no others | 164.504(e)(2)(i) |
| **Safeguards** | Appropriate safeguards, plus Security Rule compliance for electronic PHI | 164.504(e)(2)(ii)(B) |
| **Reporting** | Report any use or disclosure the contract does not allow, including breaches of unsecured PHI | 164.504(e)(2)(ii)(C) |
| **Subcontractors** | Subcontractors that handle the PHI agree to the same restrictions and conditions | 164.504(e)(2)(ii)(D) |
| **Patient rights** | Make PHI available for access, amendment and an accounting of disclosures | 164.504(e)(2)(ii)(E) to (G) |
| **HHS review** | Open internal practices, books and records on the PHI to the Secretary of HHS | 164.504(e)(2)(ii)(I) |
| **Termination** | Return or destroy the PHI at the end if feasible, and let the covered entity end the contract for a material violation | 164.504(e)(2)(ii)(J) and (iii) |

## 01. Why does a telehealth brand need a BAA?

A telehealth program moves protected health information through several systems: intake, the provider's review, e-prescribing, lab orders and patient messaging. HIPAA's definition of a business associate in 45 CFR 160.103 names e-prescribing gateways and subcontractors outright, so every vendor that touches that data for the practice needs an agreement, and one missing agreement is a gap in the practice's compliance. On Cuvo, the clinical layer runs on HIPAA-compliant infrastructure under the business associate agreement Cuvo signs on every plan, so the agreement is in place from day one.

## 02. How is a BAA different from a HIPAA compliance letter?

A letter, badge or web page saying a vendor is HIPAA compliant is not a business associate agreement. Section 164.502(e)(2) requires the assurance to be documented in a written contract or other written agreement, and 164.504(e) sets what it must say. The practical test is to ask for the agreement itself and check it against the terms in the table above, including subcontractor flow-down and what happens to the data at termination.

## 03. Who signs the BAA in a white-label telehealth model?

The covered entity signs with its business associates, and each business associate signs with the subcontractors it lets handle the data (164.502(e)(1)(ii)). In a white-label model the covered entity is generally the professional corporation whose clinicians treat the patient, and the clinical platform is its business associate. A brand whose own tools receive protected health information, such as a support desk that reads patient messages, needs those vendors under an agreement too. This describes the general structure, not legal advice on a particular arrangement.

## 04. What happens to the data when a BAA ends?

Section 164.504(e)(2)(ii)(J) requires the vendor, if feasible, to return or destroy all protected health information it still holds and keep no copies, or else extend the agreement's protections to whatever it cannot return. That return runs to the covered entity, the treating practice. On Cuvo, the brand owns the patient relationship, the customer list and every business record, exportable at any time, while the medical charts belong to the treating professional corporation and its licensed clinicians, as HIPAA and state law require.

**Primary sources**
- [45 CFR 164.502(e): disclosures to business associates](https://www.ecfr.gov/current/title-45/section-164.502): eCFR, checked Oct 26, 2026
- [45 CFR 164.504(e): business associate contracts](https://www.ecfr.gov/current/title-45/section-164.504): The required contract terms
- [45 CFR 160.103: definitions of business associate and subcontractor](https://www.ecfr.gov/current/title-45/section-160.103): eCFR, checked Oct 26, 2026
- [45 CFR 164.410: notification by a business associate](https://www.ecfr.gov/current/title-45/section-164.410): The 60-day ceiling

## Frequently asked questions

**Q: What is a business associate agreement?**

A: It is the written contract HIPAA requires before a vendor creates, receives, maintains or transmits protected health information for a covered entity, with the terms listed in 45 CFR 164.504(e). On Cuvo, a signed business associate agreement comes with every plan.

**Q: What is a BAA in HIPAA?**

A: BAA stands for business associate agreement, the contract that documents a vendor's promise to safeguard a covered entity's protected health information under 45 CFR 164.502(e). On Cuvo, the BAA is in place from day one because Cuvo operates the PHI-handling infrastructure behind the brand.

**Q: Covered entity vs business associate: what is the difference?**

A: A covered entity is a health plan, a health care clearinghouse or a health care provider that conducts standard transactions electronically; a business associate handles protected health information on a covered entity's behalf under a written agreement. On Cuvo, Cuvo signs the business associate agreement on every plan for the clinical layer it runs.

**Q: Does a telehealth brand need a BAA?**

A: Yes, wherever a vendor handles protected health information for the practice that treats the brand's patients: the clinical platform, hosting, messaging, labs and e-prescribing. Cuvo Health signs a business associate agreement on every plan, so the clinical layer it runs is covered from launch.

**Q: What should a business associate agreement include?**

A: 45 CFR 164.504(e) requires permitted uses, safeguards with Security Rule compliance, reporting of improper uses and breaches, subcontractor flow-down, support for patient access, amendment and accounting, HHS access to records, and return or destruction of the data at termination. Cuvo Health signs one on every plan, alongside SOC 2 Type II, SSO and an uptime SLA.

**Related pages**

- [HIPAA business associate agreements for telehealth brands](/blog/hipaa-business-associate-agreement-telehealth-brand): The full guide: required terms, roles, breach duties and vendor questions
- [Covered entity (HIPAA)](/glossary/covered-entity): Who signs on the other side of the agreement
- [Protected health information (PHI)](/glossary/protected-health-information): The data the agreement governs
- [Telehealth HIPAA compliance for non-clinician founders](/blog/hipaa-for-founders): What HIPAA asks of a founder who is not a clinician
- [Cuvo compliance](/compliance): HIPAA, the BAA and the rest of the regulated layer Cuvo runs
- [Telehealth glossary](/glossary): Every term a telehealth founder meets

Canonical page: https://cuvo.co/glossary/business-associate-agreement