Definition
A Business Associate Agreement (BAA) is the contract HIPAA requires between a covered entity and a vendor that handles protected health information on its behalf, setting out how the vendor may use and must safeguard that PHI.
Under HIPAA, a business associate is any person or company that creates, receives, maintains, or transmits PHI for a covered entity, such as a billing service, cloud host, or patient-outreach platform. The BAA limits the vendor's permitted uses of PHI, requires appropriate safeguards, obliges it to report breaches, and requires it to flow the same terms down to its own subcontractors. Since the 2013 Omnibus Rule, business associates are also directly liable for HIPAA compliance.
A buyer evaluating voice AI for patient calls should confirm a BAA is in place before any PHI is shared, and should understand which subprocessors, including any language-model providers in the call path, the vendor's obligations extend to.
How Consig handles it
Consig's privacy policy requires healthcare customers to have a signed Business Associate Agreement with Consig before sharing PHI.