What a BAA is
A Business Associate Agreement is the contract HIPAA requires before a covered entity lets a vendor handle protected health information. Under 45 CFR 164.504(e), it must state the permitted uses of the data, bar any other use, require safeguards, require breach and incident reporting, bind subcontractors to the same terms, and require return or destruction of the data at the end.
For AI tools this is the deciding line. An AI chat tool, voice agent, or web-chat widget that touches patient data is a business associate. Read the scope: vendors often limit a BAA to certain plans or features. A tool that is HIPAA-eligible on its enterprise plan is not covered on the plan your staff signed up for with a personal email.
Many vendors gate the BAA behind a paid or enterprise plan. Rivvi's free organization plan is you and two colleagues, with a HIPAA BAA included. The free personal plan is public information only. No card to start.