What is Business Associate Agreement?
Also called: BAA · HIPAA BAA
Engaging a billing company without an executed BAA is itself a HIPAA violation, independent of whether anything goes wrong.
HHS publishes sample BAA provisions. Comparing a vendor's BAA against that baseline is a fast way to spot narrowed breach notification windows or carved-out subcontractor obligations.
Where Vizora handles this
Primary sources
Where "Business Associate Agreement" is defined by the bodies that set the rules, rather than by us.
- Sample Business Associate Agreement provisions (opens in a new tab)
HHS Office for Civil Rights — The government's own BAA language. Compare any billing company's BAA against it before signing.
- HIPAA for professionals (opens in a new tab)
HHS Office for Civil Rights — The Privacy, Security and Breach Notification Rules in their authoritative form, including what a billing vendor is permitted to do with PHI.
Last reviewed August 20, 2026
Related terms
HIPAA
HIPAA is the federal law governing the privacy and security of protected health information. For billing it establishes three obligations: the standard electronic transaction formats, the Privacy Rule limiting use and disclosure of PHI, and the Security Rule requiring safeguards for electronic PHI.
Minimum Necessary
The minimum necessary standard requires that uses and disclosures of protected health information be limited to the least amount needed to accomplish the purpose. It applies directly to billing operations, where the temptation to move whole charts rather than the relevant documentation is constant.
More in Compliance
Find out what your denials are costing you
A free billing audit reviews your denial rate, AR aging and clean claim rate against industry benchmarks. Takes about two minutes to request. No sales pitch.
No setup fees · You pay when we collect · Pricing from 3% of net collections