Business Associate Relationships and Agreements at UW-Madison
A business associate (BA) is a person or organization that provides a HIPAA-covered entity with certain services or tools described in the regulations that require the use of the covered entity’s protected health information (PHI).
The BA can create, receive, or maintain PHI on behalf of the covered entity if they agree to specific terms laid out in a business associate agreement. To be valid, a business associate agreement (BAA) must contain specific terms required by HIPAA. These terms require the business associate to protect the PHI like the covered entity.
Remember: A business associate relationship can only exist when a covered entity uses an outside person or organization to perform work on its behalf that involves access to PHI.
UW-Madison can be a Covered Entity or a Business Associate
In most cases, UW-Madison acts as a covered entity working with external business associates. Only the units that are part of UW-Madison’s covered entity, as listed in UW-100: Designation of the UW-Madison Health Care Component (UW HCC), can receive the services of a BA.
Less commonly, UW-Madison can provide services as a business associate to an outside covered entity. Any campus unit (whether inside or outside the UW HCC) can provide services as a BA.
HIPAA regulations and UW-Madison policy have different requirements depending on whether you are seeking business associate services or serving as a business associate. Choose the option below to view the requirements that apply to your situation.