Requirements for Serving as a Business Associate 

If a covered entity asks UW–Madison to serve as a business associate, all the following steps must be completed before receiving access to the covered entity’s PHI: 

1. Complete the UW–Madison Business Associate Attestation and its requirements, including UW–Madison HIPAA training and a Cybersecurity review of the arrangement (initiate by submitting a OneTrust ticket).  
2. Get the business associate agreement signed.
   1. Use the UW–Madison template BAA whenever possible.
   2. Work with your departmental business service or research admin staff to route the agreement to the appropriate signatory authority (e.g. Purchasing, RSP).
   3. Send a copy of the fully signed BAA to hipaa@wisc.edu.