Glossary
Business Associate Agreement (BAA)
The contract HIPAA requires before a vendor may create, receive, maintain or transmit protected health information on a covered entity’s behalf. If a chat platform stores patient messages, its operator is a business associate and needs one.
General definition
Business Associate Agreement (BAA) is the common name for the written contract that HIPAA requires between a covered entity (a health plan, healthcare clearinghouse or provider that bills electronically) and any business associate that handles protected health information (PHI) on its behalf. The Privacy Rule sets the requirement in 45 CFR 164.502(e) and lists the mandatory contract terms in 45 CFR 164.504(e); the Security Rule adds parallel terms for electronic PHI in 45 CFR 164.314(a). The regulation itself calls the document a business associate contract.
At a minimum a BAA must:
- Define the permitted and required uses and disclosures of PHI, and prohibit any others
- Require appropriate safeguards, including the Security Rule’s administrative, physical and technical safeguards for electronic PHI
- Require the business associate to report any use or disclosure not permitted by the contract, including breaches of unsecured PHI
- Flow the same obligations down to any subcontractor that creates, receives, maintains or transmits the PHI
- Support the covered entity’s duties to individuals: access to records, amendment, and an accounting of disclosures
- Return or destroy PHI when the contract ends where feasible, and let the covered entity terminate the contract if the business associate materially breaches it
Since the HITECH Act of 2009 and the 2013 Omnibus Rule, business associates and their subcontractors are directly liable under HIPAA for their own compliance, not only under the contract. A messaging vendor that stores or transmits patient conversations, a cloud host that keeps the database, and an analytics provider with access to message content are all business associates. A carrier that only moves encrypted traffic it cannot read may fall under the narrow conduit exception; a chat server that stores messages does not.
A BAA is a necessary condition, not a sufficient one. It does not make the covered entity or the vendor HIPAA compliant by itself. Compliance is the ongoing practice of risk analysis, written policies, workforce training, access control and audit logging that the contract obliges each party to maintain. Where GDPR also applies, read the vendor’s BAA alongside its Data Processing Agreement (DPA), because the two documents answer different legal questions about the same data.
In the Ethora ecosystem
Ethora signs a Business Associate Agreement on Enterprise and dedicated plans, where the chat server runs single-tenant in your own AWS or other cloud account or on-premise, and the safeguards a BAA requires can be scoped to your deployment. The platform provides the technical safeguards the Security Rule asks for: TLS in transit, encryption at rest, role-based access controls, a compliance audit trail with immutable log export, configurable retention and per-user erasure. The HIPAA-compliant chat API page describes how these fit inside a healthcare product.
A BAA does not make your application compliant on its own, and Ethora does not claim it does. Your organisation still owns the risk analysis, the policies and the way your team configures the admin panel and API. What the agreement does is put the vendor side of that shared responsibility in writing, with the same obligations flowed down to any subcontractor Ethora relies on for your deployment.
