Vendors vs. Business Associates

Vendors are entities the Covered Entity does business with, that are not members of the Covered Entity’s workforce, which activities do NOT involve uses or disclosures of Protected Health Information (PHI). A Business Associate Agreement (BAA) is not required.

Business Associates (BAs) are entities the Covered Entity does business with, that are not members of the Covered Entity’s workforce, which activities involve uses or disclosures of Protected Health Information (PHI). A Business Associate Agreement (BAA) is required between the Covered Entity and the Business Associate.