A business associate agreement (BAA) outlines the responsibilities of healthcare organizations (also called covered entities) and their vendors (also called business associates) in properly handling protected health information (PHI). Healthcare organizations rely heavily on business associates to perform important functions that could involve patients’ PHI. The objective of covered entities is to ensure that their business associates comply with the HIPAA Act.