[Glossary](https://telxpress.com/glossary/) / Security & compliance # HIPAA business associate agreement A **HIPAA business associate agreement** (BAA) is the written contract a healthcare provider must have with any vendor that creates, receives, stores or transmits protected health information on its behalf. - Security & compliance - Updated October 11, 2026 - Written by the Telxpress advisory team 01 In depth ## What it is, why it matters and *what to ask a vendor* Under HIPAA, a business associate is a person or company that handles protected health information (PHI) for a covered entity such as a clinic, practice or care facility. The rules at 45 CFR 164.504(e) spell out what the contract must contain: permitted uses, safeguards, breach reporting, subcontractor terms and access for patients and regulators. For a growing practice this decides which tools are allowed. A phone system that stores voicemail transcripts, an AI voice agent that books appointments, a cloud recording service: each one touches PHI and needs a signed BAA before patient data flows through it. A vendor that will not sign one is not an option, however good the product. Ask every vendor whether they sign a BAA as standard, what it excludes, where PHI is stored and encrypted, how long recordings and transcripts are kept, and how breaches are reported. Ask who their subcontractors are, because the obligations follow the data. Review the agreement with your compliance officer or attorney. 02 Related terms ## Terms that usually come up *alongside it* - Voice ### [AI voice agent](https://telxpress.com/glossary/ai-voice-agent/) An AI voice agent is software that answers phone calls in natural conversation, understands what the caller wants, answers questions, books appointments and transfers or takes messages when a person is needed. - Security & compliance ### [Call recording consent](https://telxpress.com/glossary/call-recording-consent/) Call recording consent is the permission the law requires before a phone call is recorded; in California, every party to a confidential call must be told and agree, which is often called two-party consent. - Security & compliance ### [MFA (multi-factor authentication)](https://telxpress.com/glossary/mfa/) Multi-factor authentication (MFA) requires a second proof of identity beyond a password, such as a code from an app or a hardware key, and it defeats most attacks that rely on stolen passwords. - AI ### [AI governance policy](https://telxpress.com/glossary/ai-governance-policy/) An AI governance policy is the written set of rules a business adopts for how AI tools may be used, what data they may touch, who approves them and how their output is checked. 03 At Telxpress ## Where this shows up *at Telxpress* The pages and articles where this term does real work: what we advise, build and support. - Industry ### [AI & Business Technology for Healthcare](https://telxpress.com/industries/healthcare/) Three AI use cases for clinics and care facilities, HIPAA considerations, and the phones, networks and AV we install for healthcare teams. - Page ### [Donya AI Voice Agent: Never Miss a Call](https://telxpress.com/solutions/ai/voice-agent/) Donya answers every call 24/7, qualifies leads and books appointments. Call the demo line to hear it. Built and run by Telxpress. - Page ### [Business VoIP & Cloud Phone Systems in Irvine](https://telxpress.com/solutions/business-technology/phone-systems/) VoIP, cloud phone systems, UCaaS and SIP trunks from Yealink, Nextiva, Avaya, Yeastar and Polycom, installed, supported and ready for AI call handling. 04 Sources ## Public *references* The standard or law this definition rests on, as published by its owner. Fetched and checked on the review date above. - [45 CFR 164.504, business associate contract requirements (Cornell LII)](https://www.law.cornell.edu/cfr/text/45/164.504) law.cornell.edu - [45 CFR 160.103, HIPAA definitions (Cornell LII)](https://www.law.cornell.edu/cfr/text/45/160.103) law.cornell.edu Next step ## Want This Applied *to Your Business?* Book a free 30-minute AI readiness consultation. You'll leave with three AI opportunities specific to your business, whether you work with us or not. [Book My Free Consultation](https://telxpress.com/book/) [Take the Free AI Readiness Assessment](https://telxpress.com/ai-readiness/) [Or call 24/7: (949) 861-4500](tel:+19498614500) Last reviewed: October 11, 2026. Published by Telxpress, Irvine, CA.