# Business associate agreement

URL: https://sellmydatatoai.net/glossary/business-associate-agreement

A business associate agreement is the HIPAA contract a covered entity must sign with any vendor that handles protected health information on its behalf.

A business associate agreement is a contract required by HIPAA between a covered entity, such as a health plan or provider, and a business associate that creates, receives, maintains or transmits protected health information on its behalf. [45 CFR 160.103](https://www.law.cornell.edu/cfr/text/45/160.103) lists data analysis, billing, legal, consulting and data aggregation among business associate functions.

## What must a business associate agreement say?

HHS publishes [sample provisions](https://www.hhs.gov/hipaa/for-professionals/covered-entities/sample-business-associate-agreement-provisions/index.html). The agreement must limit the vendor's uses and disclosures to those it permits, require safeguards, require breach reporting and require return or destruction of the data at the end of the contract.

## Can a business associate license data for AI training?

A business associate generally cannot license protected health information for AI training. Under [45 CFR 164.502(a)(5)(ii)](https://www.law.cornell.edu/cfr/text/45/164.502), a covered entity or business associate "may not sell protected health information" without an authorization from each individual. A vendor that wants to license health data generally needs it properly de-identified first, and should check that its agreement allows it to de-identify the data.

Under UK and EU GDPR the nearest equivalent is a [data processing agreement](https://sellmydatatoai.net/glossary/data-processing-agreement) between a controller and a processor.