A BAA is used when fully identifiable PHI is being shared with another party.
A Business Associate is a person or entity who performs functions or activities on behalf of, or provides certain services to, a covered entity (CE) (i.e. the University) that involve access by the BA to protected health information (PHI).
A "business associate" also is a subcontractor that creates, receives, maintains, or transmits protected health information on behalf of another business associate. A CE may be a BA of another CE if it performs such services for the other CE.
HIPAA generally requires that CEs and BAs enter into contracts with their BAs to ensure that BAs appropriately safeguard PHI. The BAA also serves to clarify and limit, as appropriate, the permissible uses and disclosures of PHI by the BA, based on the relationship between the parties and the activities or services being performed by the BA. A BA is directly liable under HIPAA for any uses or disclosures of PHI not authorized by the BAA or required by law.
The University’s BAA template fulfills all regulatory requirements and can be requested via the Data Sharing Request Portal.