What is Business Associate Agreement (BAA)?
A Business Associate Agreement is the HIPAA-required contract between a covered entity (your clinic) and any vendor that creates, receives, stores, or transmits protected health information on its behalf. It binds the vendor to HIPAA safeguards and breach-notification duties. Without a signed BAA, the vendor cannot lawfully handle your clients' PHI.
How it works in an aesthetic clinic
A med spa lists every vendor touching client health data: the practice platform, forms tool, texting provider, labs, billing service, IT support with system access. Each signs a BAA before getting access, and the signed agreements live in one folder. When the clinic adopts new software, the BAA is part of onboarding; platforms built for clinics, Gracero included, sign one as standard practice.
Business Associate Agreement (BAA) vs an NDA
| Business Associate Agreement (BAA) | HIPAA-specific: mandates safeguards, permitted uses, and breach duties for PHI |
|---|---|
| An NDA | General confidentiality with no HIPAA force and no safeguard requirements |
Why it matters for clinic operators
Operating without BAAs is itself a HIPAA violation, regardless of whether any breach ever occurs, and it is one of the easiest findings for an auditor to make. The fix costs a signature; the gap costs penalties.
On the platform: HIPAA & security at Gracero
See Gracero run your clinic.
A 15-minute demo: booking, payments, memberships, and the aesthetic layer, all in one platform.
Book a demo