Requirements for Serving as a Business Associate 

If a covered entity asks UW-Madison to serve as a business associate, all the following steps must be completed before receiving access to the covered entity’s PHI: 

1. Complete the UW-Madison Business Associate Attestation and its requirements, including UW-Madison HIPAA training and a Cybersecurity review of the arrangement (initiate by submitting a OneTrust ticket).  
2. Get the business associate agreement signed.
   1. Use the UW-Madison template BAA whenever possible.
   2. Work with your departmental business service or research admin staff to route the agreement to the appropriate signatory authority (e.g. Purchasing, RSP).
   3. Send a copy of the fully signed BAA to hipaa@wisc.edu.