[LT-07]
The BAA Satisfactory Assurances Requirement
HIPAA's Privacy Rule requires that covered entities (hospitals, health plans, healthcare clearinghouses) execute Business Associate Agreements with all vendors who access, use, or create protected health information on their behalf. The BAA must include "satisfactory assurances" that the business associate will implement appropriate safeguards to protect PHI — specifically the administrative, physical, and technical safeguard requirements of 45 CF...