Requirements for Using Business Associate Services

All the following steps must be completed before providing the business associate access to UW-Madison PHI:

1. Use the BAA Decision Tool to determine if a business associate agreement can be used for these services. 
2. Confirm the vendor is willing to sign a business associate agreement.
   1. If not, reach out to the UW-Madison HIPAA Privacy Officer for guidance on alternatives. 
3. Submit a Onetrust ticket to initiate a Cybersecurity review of the external organization.
4. While the Cybersecurity review is pending, get the business associate agreement signed.
   1. Use the UW-Madison template BAA whenever possible.
   2. Work with your departmental business service or research admin staff to route the agreement to the appropriate signatory authority (e.g. Purchasing, RSP).
   3. Send a copy of the fully signed BAA to hipaa@wisc.edu.