BAA stands for business associate agreement. Under HIPAA a covered entity, which is a practice, a hospital, an insurer or a pharmacy, may only let a vendor handle protected health information on its behalf if the vendor has signed a written agreement accepting the rules that bind the covered entity. An online fax vendor stores every page it moves, so it is a business associate and a BAA is the document that makes the relationship lawful. This page explains what the agreement contains, why the plan it applies to matters, and which vendors in the Fax Line Index state one beside their prices.
What the agreement says
The Department of Health and Human Services publishes sample provisions, and a vendor's BAA follows them closely. The business associate agrees not to use or disclose the information except as the agreement permits, to use appropriate safeguards, to report any use or disclosure not permitted, including breaches, to make the information available to the individual and for amendment, to make its practices available to the Secretary for compliance review, and to return or destroy the information at the end of the contract. Each of those obligations maps onto a fax account: encryption of stored pages, breach notification, export of a patient's faxes on request, and deletion on cancellation. A vendor that will sign it has built those features; one that will not has not.
Why the plan the BAA covers matters
Some vendors sign a BAA only on a business or enterprise tier and sell a cheaper plan without one. A solo practice on the cheaper plan is then handling patient information through a vendor that has not accepted the obligations, and the practice, not the vendor, carries the consequence. That is why the Fax Line Index records the BAA statement against the plan it appears on. WestFax prints a signed BAA on every plan, including Solo at $14.99 a month with 500 pages. eFax's Business plan card prints HIPAA compliance with a Business Associate Agreement on an offer starting at $14.99 with 500 pages. For the other vendors in the HIPAA class the practice should ask which plan the BAA covers and get the signed copy before the first page is sent.
What a BAA costs, at the printed prices
On the vendors that print the statement it costs nothing beyond the plan. WestFax's Solo plan at $14.99 a month billed monthly carries the signed BAA with 500 pages and a 3¢ overage. eFax's offer starts at $14.99 with 500 pages and $0.07 per page over. Elsewhere in the HIPAA class the entry prices are Fax.Plus at $6.99 with 200 pages, CocoFax at $9.99 with 60 pages, iFax at $12.49 with 200 pages and Documo at $25 a month billed annually with 300 pages; whether the BAA applies at those prices or a tier above is the question to ask each one. A practice that cannot get a signed BAA on the plan it can afford should choose a different vendor, not proceed without one.
Questions people ask about baa meaning
Does a one-person practice need a BAA with its fax vendor?
Yes, if the faxes carry protected health information. Size does not exempt a covered entity, and the vendor storing the pages is a business associate regardless.
Is a vendor's privacy policy the same as a BAA?
No. A BAA is a signed contract with the specific obligations HHS describes. A privacy policy is the vendor's own statement and binds it to nothing HIPAA requires.
Who signs the BAA?
An authorised person at the practice and at the vendor. Most vendors present it electronically during sign-up; keep the executed copy with the practice's compliance records.