BAA (Business Associate Agreement)

A BAA is the contract required under HIPAA between a covered entity (e.g., a hospital) and any vendor (a 'business associate') that handles PHI on their behalf — including AI vendors and their sub-processors.

If your AI tool reads, writes, stores, or processes patient health information, you legally need a BAA with that vendor. The BAA passes HIPAA obligations down the chain: each vendor must have BAAs with its own sub-processors. Without the chain, the data isn't safely processed and your covered entity is liable.

Example

Hospital signs BAA with AI vendor → AI vendor signs BAAs with Anthropic and AWS → entire stack is BAA-covered. One missing link breaks the chain.

How OpenLabor uses it

OpenLabor signs BAAs with healthcare customers and maintains BAAs with downstream model + infra providers.

Can a vendor process PHI without a BAA?

Not legally if you're a covered entity or business associate. The BAA is non-negotiable.

Related: hipaa, data-residency, audit-trail.

AI Labor Glossary