A Business Associate Agreement (BAA) is a legal contract between a covered entity (such as a healthcare provider) and a business associate (such as an outside contractor or vendor) that ensures the business associate will also comply with HIPAA's Privacy and Security Rules. A BAA is necessary when a business associate will have access to a covered entity's protected health information.