# What Is a Business Associate Agreement (BAA)?

Source: https://insertchat.com/glossary/business-associate-agreement

> A business associate agreement is the HIPAA contract between a health practice and vendors handling patient data. Learn what it covers and when AI needs one.

A business associate agreement, or BAA, is a contract required by HIPAA between a healthcare provider or health plan and a vendor that creates, receives, stores, or transmits protected health information on its behalf. The BAA requires the vendor to safeguard that information, limits how it can be used, and sets duties such as reporting breaches.

## How a business associate agreement works

HIPAA defines a business associate in [45 CFR 160.103](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103), and [45 CFR 164.504(e)](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.504) sets what the contract must contain, such as permitted uses of the information, safeguards, breach reporting, and returning or destroying data at the end of the relationship.

For a medical, dental, or therapy practice, any tool that hears or stores patient details, including an AI receptionist taking appointment requests with symptoms, is likely a business associate. Without a signed BAA, the practice should keep protected health information out of that tool entirely. A BAA is a contract, not a certification; there is no official “HIPAA certified” label.

## Example: a family medicine practice

A family medicine practice wants an AI receptionist to book visits and collect the reason for the appointment. Because callers will describe symptoms, the assistant will handle protected health information, so the practice signs a BAA with the vendor before going live and limits what the assistant collects to what scheduling needs. This scenario is illustrative.

## BAAs and InsertChat

InsertChat can sign a business associate agreement on its Enterprise plan, which starts at $998 per month, for healthcare organizations that handle protected health information. On other plans, do not add patient health information to the assistant’s knowledge or workflows.

InsertChat does not claim HIPAA certification. Healthcare setups are covered for [medical practices](https://insertchat.com/industries/healthcare), [dental offices](https://insertchat.com/industries/dental), and [therapists](https://insertchat.com/industries/therapy); compare plans on [pricing](https://insertchat.com/pricing).

## Does an AI receptionist need a BAA?

If it will create, receive, store, or transmit protected health information for a covered healthcare provider, yes. Check with your compliance advisor about your specific use.

## Is a BAA the same as being HIPAA compliant?

No. A BAA is a required contract between a practice and a vendor. Compliance also depends on how the practice and vendor actually handle information.

## Which InsertChat plan includes a BAA?

Enterprise. Healthcare organizations that need to handle protected health information should start on Enterprise and sign the BAA before adding patient information.

## Related terms

- [AI receptionist](https://insertchat.com/glossary/ai-receptionist): An AI receptionist is software that answers a business’s phone calls with a natural, conversational voice.
- [Knowledge base](https://insertchat.com/glossary/knowledge-base): A knowledge base is an organized collection of information that people or software use to answer questions.
- [Shared inbox](https://insertchat.com/glossary/shared-inbox): A shared inbox is one workspace where a team sees and answers customer conversations together instead of in separate personal inboxes.
- [TCPA (Telephone Consumer Protection Act)](https://insertchat.com/glossary/tcpa): The Telephone Consumer Protection Act, or TCPA, is a 1991 US federal law that restricts telemarketing calls, autodialed calls and texts, and calls using prerecorded or artificial voices.

## Related InsertChat pages

- [AI front desk for medical practices](https://insertchat.com/industries/healthcare)
- [AI receptionist for dental offices](https://insertchat.com/industries/dental)
- [Pricing and plans](https://insertchat.com/pricing)

## Sources

- [45 CFR 160.103, definition of business associate](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103)
- [45 CFR 164.504(e), business associate contracts](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.504)