What is a business associate agreement?

A business associate agreement (BAA) is a contract required by HIPAA whenever a covered entity (a health plan, provider or clearinghouse) or an existing business associate shares protected health information with a vendor that performs services on its behalf. The BAA obligates the vendor to safeguard PHI, restrict its use, report breaches and flow the same obligations down to its own subcontractors.

Why BAAs matter for NEMT

NEMT providers sign BAAs with brokers and health plans, and must in turn hold BAAs with any vendor that touches rider data: dispatch and billing software, cloud storage, answering services and billing companies. A software vendor that will not sign a BAA is not usable for NEMT. Keep every BAA on file; broker credentialing and state audits ask for them.