Requirements for Using Business Associate Services

All the following steps must be completed before providing the business associate access to UW–Madison PHI:

1. Use the BAA Decision Tool to determine if a business associate agreement can be used for these services. 
2. Confirm the vendor is willing to sign a business associate agreement.
   1. If not, reach out to the UW–Madison HIPAA Privacy Officer for guidance on alternatives. 
3. Submit a Onetrust ticket to initiate a Cybersecurity review of the external organization.
4. While the Cybersecurity review is pending, get the business associate agreement signed.
   1. Use the UW–Madison template BAA whenever possible.
   2. Work with your departmental business service or research admin staff to route the agreement to the appropriate signatory authority (e.g. Purchasing, RSP).
   3. Send a copy of the fully signed BAA to hipaa@wisc.edu.