Governance & Compliance
BAA (Business Associate Agreement)
A BAA is the HIPAA contract required before any vendor touches protected health information — including AI vendors. Without one, PHI in a prompt is a violation.
A business associate agreement is HIPAA's mandatory contract between a covered entity (or business associate) and any vendor that will create, receive, or store PHI on its behalf. It binds the vendor to HIPAA safeguards and breach duties.
AI vendors sign BAAs selectively: typically for API or enterprise healthcare arrangements, often paired with zero-data-retention, and never for consumer tiers. The practical rule for health organizations is absolute — no BAA in writing for the specific tier in use, no PHI in the tool.
Where this shows up
Related terms
See it in your own organization.
Sanitized AI inventories the AI tools in use and redacts sensitive data from prompts before it leaves.