Definition
Business Associate Agreement (BAA)
A Business Associate Agreement (BAA) is a HIPAA-required contract between a covered entity (such as a medical practice) and any vendor that handles protected health information on its behalf. It legally obligates the vendor to safeguard that data. Any AI or software tool used on real patient information needs a signed BAA to be compliant.
Definition
What a BAA is
A Business Associate Agreement is a contract required by HIPAA whenever a covered entity, like a practice or pharmacy, lets a vendor create, receive, store, or transmit protected health information on its behalf. The BAA binds the vendor to HIPAA's safeguard, use, and breach-notification rules.
For AI tools this is the deciding line. An AI voice agent or web-chat widget that touches patient data is a business associate, so it needs a signed BAA. Without one, running real patient data through the tool is a compliance violation, no matter how capable the model is.
Vendors often gate the BAA behind a paid or enterprise plan. Rivvi includes the signed BAA on its free trial, e-signed inside the signup flow before any patient data moves, so a practice is compliant on day one rather than after an upgrade.
BAAs, answered
- Who needs to sign a BAA?
- A covered entity (a healthcare provider, health plan, or clearinghouse) and any business associate that handles protected health information on its behalf both sign the BAA. That includes software vendors, so an AI patient-communication tool must sign one with each practice it serves.
- Do free AI tools include a BAA?
- Usually no. Most vendors gate the BAA to paid or enterprise plans, or offer no self-serve signup, so their free tier cannot legally touch patient data. Rivvi is an exception: the signed BAA is included on its free trial, e-signed in the app.
- When is the BAA signed with Rivvi?
- In the app, before anything goes live. You can e-sign it yourself or send it to whoever signs contracts and keep going. Nothing is public until it's signed.