VU Architectural and HIPAA System requirements

Business Associate Agreement


The Business Associate Agreement (BAA) MUST be included with each information system procurement contract if that system will contain electronic protected health information (EPHI) and the data will be visible to an outside entity, either by maintenance, support or information sharing. 


The BAA is not designed to be a stand alone agreement. The agreement either needs to be a reference in the main agreement that ties the BAA to the specific relationship or an amendment needs to be drafted if the main agreement has already been signed. 





Click here to access the latest BAA on our HIPAA webpage

Click here to write to the IT Procurement and Contract team.  One of us will reply to you within 2 business days.





This page was last updated February 1, 2008 and is maintained by