Describe what a Business Associate Agreement (BAA) is and why it is required.

• A. A contract that removes all PHI restrictions.
• B. A contract between patients and providers regarding payments.
• C. A contract between a covered entity and a business associate ensuring PHI is safeguarded; it specifies permissible uses/disclosures, security measures, breach notification, and subcontractor obligations.
• D. A contract between hospitals and insurers detailing coverage.

Answer: (C)