Business Associate Agreement (BAA)
If you use any outside entity to assist with your EMR, including a hosting company, you must have a BAA signed with that organization. That document does not clear you of your own responsibilities related to HIPAA, but it does delineate the role that the hosting company takes and ways in which they should be held liable for any breaches, etc.
What is a BAA (business associate agreement)?
A HIPAA business associate agreement is a legal contract between a HIPAA covered entity and business associate, as defined via the US Health Insurance Portability and Accountability Act of 1996. These agreements safeguard ePHI (electronic protected health information), which is the sensitive personal data and records of patients.
Covered entities are healthcare providers, plans, and data clearinghouses, while business associates are any organization doing business with covered entities in a manner that involves ePHI.