A Business Associate Agreement (BAA) is a written contract under HIPAA that defines how a vendor — a Business Associate — handles Protected Health Information (PHI) on behalf of a covered entity. It is the legal mechanism that makes a vendor relationship HIPAA-compliant.
When a BAA is required
Any vendor that creates, receives, maintains, or transmits PHI on behalf of a covered entity needs a BAA. That covers most telehealth platforms, e-prescribing tools, video conferencing for patient visits, messaging, and pharmacy fulfillment partners.
What operators should verify
Permitted uses and disclosures, safeguards required, breach notification timelines, return or destruction of PHI on contract termination, and subcontractor flow-down. Vendors with no public BAA template are a yellow flag.
Where Remedora fits
Remedora signs a BAA covering the entire operating layer — intake, clinical review, prescribing, pharmacy, payments, messaging, and audit. One BAA replaces what would otherwise be five or six.