Context
A BAA allocates obligations; it is not a certification that either party is compliant.
Example
A covered entity and hosted service provider document permitted support access and incident reporting.
References
- Business associate contracts HHS Office for Civil Rights