A BAA is a legally binding contract between a Covered Entity (like a doctor, dentist, or hospital) and a Business Associate (a third-party service provider like a form plugin, web host, or email service).

The agreement ensures that the third party will protect Protected Health Information (PHI) according to HIPAA standards. Without a signed BAA, a healthcare provider cannot legally share patient data with a software company.