What Is a Business Associate Agreement (BAA)? | Osto<\/title>\n<meta name=\"description\" content=\"What a HIPAA business associate agreement (BAA) is, when you need one, what it must contain, and how the obligation flows down to your subcontractors.\">\n<style>\n :root{\n --ink:#0e1330;\n --brand:#1c267a;\n --brand-2:#3a46c0;\n --accent:#00c2a8;\n --accent-soft:#e6f7f4;\n --paper:#ffffff;\n --mist:#f4f6fb;\n --line:#e3e7f2;\n --muted:#5a6284;\n --danger:#e2564d;\n --radius:16px;\n --shadow:0 1px 2px rgba(16,19,48,.04),0 12px 40px rgba(16,19,48,.06);\n --maxw:860px;\n }\n *{box-sizing:border-box}\n html{scroll-behavior:smooth}\n body{\n margin:0;\n font-family:-apple-system,BlinkMacSystemFont,\"Segoe UI\",Inter,Roboto,Helvetica,Arial,sans-serif;\n color:var(--ink);background:var(--paper);line-height:1.65;-webkit-font-smoothing:antialiased;\n }\n a{color:var(--brand-2);text-decoration:none}\n a:hover{text-decoration:underline}\n\n .topbar{border-bottom:1px solid var(--line);background:rgba(255,255,255,.9);backdrop-filter:saturate(160%) blur(8px);position:sticky;top:0;z-index:20}\n .topbar-inner{max-width:1120px;margin:0 auto;padding:14px 24px;display:flex;align-items:center;justify-content:space-between;gap:16px}\n .logo{display:flex;align-items:center;gap:9px;font-weight:800;letter-spacing:-.02em;color:var(--brand);font-size:20px}\n .logo-mark{width:26px;height:26px;border-radius:8px;background:linear-gradient(135deg,var(--brand),var(--brand-2));display:grid;place-items:center;color:#fff;font-size:14px;font-weight:800}\n .nav-cta{background:var(--brand);color:#fff;padding:9px 18px;border-radius:10px;font-weight:600;font-size:14px;white-space:nowrap}\n .nav-cta:hover{background:var(--brand-2);text-decoration:none}\n\n .wrap{max-width:var(--maxw);margin:0 auto;padding:0 24px}\n .breadcrumb{font-size:13px;color:var(--muted);padding:26px 0 6px}\n .breadcrumb a{color:var(--muted)}\n .eyebrow{display:inline-block;margin:22px 0 14px;font-size:12px;font-weight:700;letter-spacing:.14em;text-transform:uppercase;color:var(--brand-2);background:var(--mist);padding:6px 12px;border-radius:999px;border:1px solid var(--line)}\n h1{font-size:clamp(30px,5vw,46px);line-height:1.1;letter-spacing:-.03em;margin:0 0 18px;font-weight:800}\n .dek{font-size:19px;color:var(--muted);margin:0 0 8px;max-width:50ch}\n\n .meta{display:flex;flex-wrap:wrap;gap:8px 20px;align-items:center;font-size:13px;color:var(--muted);margin:22px 0 4px;padding-bottom:26px;border-bottom:1px solid var(--line)}\n .meta .dot{width:4px;height:4px;border-radius:50%;background:var(--line)}\n\n .tldr{margin:30px 0;border:1px solid var(--line);background:linear-gradient(180deg,var(--accent-soft),#fff 70%);border-radius:var(--radius);padding:22px 24px}\n .tldr h2{margin:0 0 8px;font-size:13px;letter-spacing:.14em;text-transform:uppercase;color:var(--brand)}\n .tldr p{margin:0 0 10px;font-size:16.5px}\n .tldr p:last-child{margin:0}\n\n h2.sec{font-size:27px;letter-spacing:-.02em;margin:52px 0 14px;font-weight:800;scroll-margin-top:80px}\n h3{font-size:20px;margin:34px 0 10px;letter-spacing:-.01em;font-weight:700}\n p{margin:0 0 16px;font-size:16.5px}\n .lead-in{color:var(--muted)}\n em{font-style:italic}\n\n .jump{background:var(--mist);border:1px solid var(--line);border-radius:var(--radius);padding:20px 24px;margin:30px 0}\n .jump h4{margin:0 0 12px;font-size:13px;letter-spacing:.1em;text-transform:uppercase;color:var(--muted)}\n .jump ol{margin:0;padding-left:20px;columns:2;column-gap:32px}\n .jump li{margin:6px 0;font-size:15px}\n @media(max-width:560px){.jump ol{columns:1}}\n\n .analogy{background:var(--mist);border-radius:var(--radius);padding:20px 22px;margin:22px 0;border:1px solid var(--line);font-size:16.5px}\n .analogy strong{color:var(--brand)}\n\n ul.clean{padding-left:0;list-style:none;margin:16px 0}\n ul.clean li{position:relative;padding:6px 0 6px 30px;font-size:16px;border-bottom:1px solid var(--mist)}\n ul.clean li:last-child{border-bottom:none}\n ul.clean li::before{content:\"\";position:absolute;left:4px;top:14px;width:9px;height:9px;border-radius:3px;background:var(--accent)}\n ul.warn li::before{background:var(--danger)}\n\n \/* TSC cards *\/\n .tsc{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:22px 0}\n .tsc-card{border:1px solid var(--line);border-radius:14px;padding:18px;background:#fff}\n .tsc-card.req{border-color:var(--brand);background:#f6f8ff}\n .tsc-card .tag{font-size:11px;font-weight:700;letter-spacing:.08em;text-transform:uppercase;color:var(--muted)}\n .tsc-card.req .tag{color:var(--brand)}\n .tsc-card h4{margin:6px 0 6px;font-size:16px;color:var(--ink)}\n .tsc-card p{font-size:14px;color:var(--muted);margin:0}\n @media(max-width:720px){.tsc{grid-template-columns:1fr 1fr}}\n @media(max-width:480px){.tsc{grid-template-columns:1fr}}\n\n \/* stat band *\/\n .fig{margin:30px 0;border:1px solid var(--line);border-radius:var(--radius);overflow:hidden;box-shadow:var(--shadow)}\n .fig-head{padding:16px 22px;background:var(--brand);color:#fff;display:flex;align-items:baseline;justify-content:space-between;gap:12px;flex-wrap:wrap}\n .fig-head .ttl{font-weight:700;font-size:15px;letter-spacing:.02em}\n .fig-head .src{font-size:11.5px;color:#b9c0f0}\n .fig-foot{padding:14px 22px;border-top:1px solid var(--line);font-size:12.5px;color:var(--muted);background:#fbfcfe}\n .stat-band{display:grid;grid-template-columns:repeat(3,1fr)}\n .stat-cell{padding:24px 16px;text-align:center;border-right:1px solid var(--line)}\n .stat-cell:last-child{border-right:none}\n .stat-cell .num{font-size:30px;font-weight:800;color:var(--brand);letter-spacing:-.02em;line-height:1.05}\n .stat-cell .num.accent{color:var(--accent)}\n .stat-cell .lab{font-size:12.5px;color:var(--muted);margin-top:8px;line-height:1.4}\n @media(max-width:560px){.stat-band{grid-template-columns:1fr}.stat-cell{border-right:none;border-bottom:1px solid var(--line)}.stat-cell:last-child{border-bottom:none}}\n\n \/* timeline *\/\n .timeline{padding:8px 24px 4px}\n .tl-item{display:grid;grid-template-columns:130px 1fr;gap:16px;padding:14px 0;border-bottom:1px solid var(--mist)}\n .tl-item:last-child{border-bottom:none}\n .tl-date{font-weight:800;color:var(--brand);font-size:14px}\n .tl-what{font-size:14.5px}\n .tl-what b{display:block;margin-bottom:2px}\n @media(max-width:520px){.tl-item{grid-template-columns:1fr;gap:2px}}\n\n .tablewrap{overflow-x:auto;margin:22px 0;border:1px solid var(--line);border-radius:var(--radius);box-shadow:var(--shadow)}\n table{border-collapse:collapse;width:100%;min-width:600px;font-size:14.5px}\n thead th{background:var(--mist);text-align:left;padding:14px 16px;font-size:12.5px;text-transform:uppercase;letter-spacing:.05em;color:var(--muted);border-bottom:1px solid var(--line);font-weight:700}\n thead th.osto{background:var(--brand);color:#fff}\n tbody td{padding:14px 16px;border-bottom:1px solid var(--line);vertical-align:top}\n tbody tr:last-child td{border-bottom:none}\n tbody td:first-child{font-weight:600;color:var(--ink)}\n td.osto{background:#f6f8ff;font-weight:600}\n .yes{color:var(--accent);font-weight:700}\n .no{color:var(--danger);font-weight:700}\n\n .callout{border:1px solid var(--line);border-radius:var(--radius);padding:24px;margin:44px 0;background:linear-gradient(135deg,#141b52,#2a34a0);color:#fff;box-shadow:var(--shadow)}\n .callout h3{margin:0 0 8px;color:#fff}\n .callout p{color:#cfd4f5;margin:0 0 18px}\n .callout a.btn{display:inline-block;background:#fff;color:var(--brand);font-weight:700;padding:11px 22px;border-radius:10px;font-size:15px}\n .callout a.btn:hover{text-decoration:none;background:#eef0ff}\n\n .disclaimer{font-size:13.5px;color:var(--muted);background:var(--mist);border:1px solid var(--line);border-radius:12px;padding:16px 18px;margin:34px 0}\n\n .faq{border-top:1px solid var(--line);margin-top:48px;padding-top:8px}\n details{border-bottom:1px solid var(--line);padding:6px 0}\n summary{cursor:pointer;list-style:none;padding:16px 4px;font-weight:600;font-size:17px;display:flex;justify-content:space-between;align-items:center;gap:16px}\n summary::-webkit-details-marker{display:none}\n summary::after{content:\"+\";color:var(--brand-2);font-size:22px;font-weight:400}\n details[open] summary::after{content:\"\u2013\"}\n details p{padding:0 4px 18px;color:var(--muted);margin:0}\n\n footer{border-top:1px solid var(--line);margin-top:60px;background:var(--mist)}\n .foot-inner{max-width:1120px;margin:0 auto;padding:36px 24px;display:flex;flex-wrap:wrap;gap:16px;justify-content:space-between;align-items:center;font-size:14px;color:var(--muted)}\n .foot-inner .logo{font-size:17px}\n\n .related{margin:42px 0 0}\n .related h3{margin-bottom:14px}\n .related-grid{display:grid;grid-template-columns:1fr 1fr;gap:14px}\n .rc{border:1px solid var(--line);border-radius:12px;padding:16px 18px;background:#fff}\n .rc .k{font-size:11px;letter-spacing:.1em;color:var(--brand-2);font-weight:700;text-transform:uppercase}\n .rc a{font-weight:600;color:var(--ink);display:block;margin-top:6px;font-size:15.5px}\n @media(max-width:640px){.related-grid{grid-template-columns:1fr}}\n\n \/* --- bright, clean additions --- *\/\n .bright-strip{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:30px 0}\n .bright-strip .bcard{border-radius:16px;padding:22px 20px;color:#fff}\n .bright-strip .bcard .n{font-size:26px;font-weight:800;line-height:1.1}\n .bright-strip .bcard .l{font-size:13px;margin-top:6px;opacity:.95;font-weight:500}\n .bc-navy{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n .bc-teal{background:linear-gradient(135deg,#00c2a8,#12b3d6)}\n .bc-indigo{background:linear-gradient(135deg,#3a46c0,#5a63d6)}\n @media(max-width:640px){.bright-strip{grid-template-columns:1fr}}\n\n .pillrow{display:flex;gap:10px;flex-wrap:wrap;margin:22px 0}\n .pill{border-radius:999px;padding:9px 16px;font-size:14px;font-weight:600;background:var(--accent-soft);color:#0a7a68;border:1px solid #bfece4}\n .pill.i{background:#eef0ff;color:#3a46c0;border-color:#d6dbff}\n\n .bigcards{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:26px 0}\n .bigcard{border-radius:16px;padding:22px;background:#fff;border:1px solid var(--line);box-shadow:0 8px 30px rgba(16,19,48,.05)}\n .bigcard .ic{width:44px;height:44px;border-radius:12px;display:grid;place-items:center;font-size:20px;font-weight:800;color:#fff;margin-bottom:12px}\n .bigcard h4{margin:0 0 6px;font-size:16px;color:var(--ink)}\n .bigcard p{margin:0;font-size:13.5px;color:var(--muted)}\n @media(max-width:720px){.bigcards{grid-template-columns:1fr}}\n\n .keyrow{display:grid;grid-template-columns:1fr 1fr;gap:0;border-radius:16px;overflow:hidden;border:1px solid var(--line);margin:26px 0}\n .keyrow>div{padding:20px 22px}\n .keyrow .k1{background:#eef0ff}\n .keyrow .k2{background:var(--accent-soft)}\n .keyrow .lab{font-size:11px;font-weight:800;letter-spacing:.08em;text-transform:uppercase;margin-bottom:6px}\n .keyrow .k1 .lab{color:#3a46c0}.keyrow .k2 .lab{color:#0a7a68}\n .keyrow .big{font-size:19px;font-weight:800;color:var(--brand);margin-bottom:4px}\n .keyrow .sm{font-size:13.5px;color:var(--muted)}\n @media(max-width:560px){.keyrow{grid-template-columns:1fr}}\n\n .flow{display:flex;gap:8px;flex-wrap:wrap;align-items:stretch;margin:26px 0}\n .flow .step{flex:1;min-width:130px;border-radius:14px;padding:16px 14px;text-align:center}\n .flow .step .t{font-weight:800;font-size:14px}\n .flow .step .d{font-size:12px;margin-top:4px;opacity:.9}\n .flow .arrow{align-self:center;color:#c3c9e6;font-size:20px;font-weight:700}\n\n\n .bbox{border-radius:14px;background:#fff;padding:16px 20px;margin:22px 0;font-size:14.5px;line-height:1.6}\n .bbox strong{color:var(--brand)}\n .bbox.navy{border:2px solid #1c267a}.bbox.indigo{border:2px solid #3a46c0}.bbox.teal{border:2px solid #00c2a8}\n .bbox .bt{font-size:11px;font-weight:800;letter-spacing:.06em;text-transform:uppercase;margin-bottom:5px}\n .bbox.navy .bt{color:#1c267a}.bbox.indigo .bt{color:#3a46c0}.bbox.teal .bt{color:#0a7a68}\n .checkgrid{display:grid;grid-template-columns:repeat(2,1fr);gap:12px;margin:24px 0}\n .checkarea{border:1px solid var(--line);border-radius:14px;padding:16px 18px;background:#fff;box-shadow:0 6px 24px rgba(16,19,48,.04)}\n .checkarea .h{display:flex;align-items:center;gap:10px;margin-bottom:8px}\n .checkarea .num{width:28px;height:28px;border-radius:8px;background:linear-gradient(135deg,#1c267a,#3a46c0);color:#fff;font-weight:800;font-size:13px;display:grid;place-items:center;flex:none}\n .checkarea h4{margin:0;font-size:14.5px;color:var(--ink)}\n .checkarea ul{margin:0;padding:0;list-style:none}\n .checkarea li{font-size:12.8px;color:var(--muted);padding:4px 0 4px 18px;position:relative}\n .checkarea li:before{content:\"\";position:absolute;left:0;top:9px;width:9px;height:9px;border:2px solid var(--accent);border-radius:3px}\n @media(max-width:640px){.checkgrid{grid-template-columns:1fr}}\n .sampleflow{display:flex;align-items:center;gap:0;flex-wrap:wrap;margin:22px 0;border:1px solid var(--line);border-radius:14px;overflow:hidden}\n .sampleflow .sf{flex:1;min-width:150px;padding:16px 18px;text-align:center}\n .sampleflow .sf .t{font-weight:800;font-size:14px;color:var(--brand)}\n .sampleflow .sf .d{font-size:12.5px;color:var(--muted);margin-top:4px}\n .sampleflow .sf.a{background:#eef0ff}.sampleflow .sf.b{background:#f4f6fb}.sampleflow .sf.c{background:#fdeceb}\n .sampleflow .sarr{color:#c3c9e6;font-size:18px;font-weight:700;padding:0 6px}\n @media(max-width:640px){.sampleflow{flex-direction:column}.sampleflow .sarr{display:none}.sampleflow .sf{border-bottom:1px solid var(--line)}}\n .docpills{display:flex;gap:8px;flex-wrap:wrap;margin:10px 0}\n .docpills .dp{font-size:12.5px;padding:7px 13px;border-radius:999px;background:var(--mist);color:var(--brand);border:1px solid var(--line);font-weight:500}\n\n .callout a[href*=\"book-demo\"]{color:#ffffff !important;font-weight:700;text-decoration:underline}\n .callout a[href*=\"book-demo\"] span{color:#ffffff !important}\n \/* Osto branded comparison table *\/\n .otable{overflow-x:auto;margin:26px 0;border-radius:16px;border:1px solid #e3e6f5;box-shadow:0 10px 34px rgba(28,38,122,.10)}\n table.regtable{border-collapse:separate;border-spacing:0;width:100%;min-width:520px;font-size:14.5px;background:#fff;margin:0}\n table.regtable thead tr,table.regtable tr:first-child{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n table.regtable th,table.regtable tr:first-child td{background:transparent;color:#fff;text-align:left;padding:15px 18px;font-size:13px;font-weight:800;letter-spacing:.03em;border:none}\n table.regtable td{padding:14px 18px;border-bottom:1px solid #eef0f7;vertical-align:top;color:#33384f}\n table.regtable tr:nth-child(even):not(:first-child){background:#f7f9ff}\n table.regtable tr:last-child td{border-bottom:none}\n table.regtable td:first-child{font-weight:700;color:#0e1330}\n table.regtable tr td:first-child{border-right:1px solid #eef0f7}\n table.regtable tr:first-child td:first-child,table.regtable th:first-child{border-right:1px solid rgba(255,255,255,.18)}\n table.regtable tr:first-child td{border-bottom:none}\n\n<\/style>\n<\/head>\n<body>\n<div class=\"wrap\">\n <p class=\"dek\">The <a href=\"https:\/\/www.osto.one\/resources\/glossary\/business-associate\">business associate<\/a> agreement is the contract that lets health data move between a healthcare customer and a vendor. If your product touches PHI, it is the document that unlocks the deal.<\/p>\n\n <div class=\"meta\">\n <span>Osto Security Team<\/span><span class=\"dot\"><\/span><span>7 min read<\/span><span class=\"dot\"><\/span><span>Compliance & Trust<\/span>\n <\/div>\n\n <div class=\"tldr\">\n <h2>TL;DR<\/h2>\n <p>A business associate agreement (BAA) is the HIPAA contract between a <a href=\"https:\/\/www.osto.one\/resources\/glossary\/covered-entity\">covered entity<\/a> and a vendor that handles <a href=\"https:\/\/www.osto.one\/resources\/glossary\/protected-health-information\">protected health information<\/a> on its behalf. It makes your HIPAA obligations explicit and legally binding.<\/p>\n <p>A covered entity cannot share PHI with you until it is signed, so it is often the gate to a healthcare deal. The obligation flows downhill: if you pass PHI to a subcontractor, you need a BAA with them too.<\/p>\n <\/div>\n\n <div class=\"jump\">\n <h4>On this page<\/h4>\n <ol>\n <li><a href=\"#what\">What a BAA is<\/a><\/li>\n <li><a href=\"#when\">When you need one<\/a><\/li>\n <li><a href=\"#chain\">How the chain works<\/a><\/li>\n <li><a href=\"#contains\">What it must contain<\/a><\/li>\n <li><a href=\"#trap\">The signing trap<\/a><\/li>\n <li><a href=\"#osto\">The lean-team path<\/a><\/li>\n <\/ol>\n <\/div>\n\n <h2 class=\"sec\" id=\"what\">What is a business associate agreement?<\/h2>\n <p>A business associate agreement is a written contract required by HIPAA whenever a covered entity, such as a hospital or health plan, lets another organisation handle protected health information on its behalf. That other organisation is the business associate, and for most software companies serving healthcare, that is you. The BAA sets out how you will protect the data and makes your HIPAA responsibilities legally binding.<\/p>\n\n <div style=\"background:linear-gradient(135deg,#0e1444,#1c267a 55%,#242f86);border-radius:20px;padding:34px 34px 30px;margin:30px 0;box-shadow:0 18px 50px rgba(14,20,68,.28);position:relative;overflow:hidden\">\n <div style=\"position:absolute;top:-50px;right:-40px;width:260px;height:260px;background:radial-gradient(circle,rgba(58,70,192,.45),transparent 68%);pointer-events:none\"><\/div>\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#aeb6ee;margin-bottom:6px\">What a BAA does<\/div>\n <div style=\"font-size:21px;font-weight:800;color:#fff;margin-bottom:24px;letter-spacing:-.01em\">The contract that lets health data change hands<\/div>\n <div style=\"display:grid;grid-template-columns:1fr 1fr 1fr ;gap:16px\"><div style=\"background:rgba(255,255,255,.06);border:1px solid rgba(174,182,238,.28);border-radius:16px;padding:20px\">\n <div style=\"width:38px;height:38px;border-radius:10px;background:linear-gradient(135deg,#3a46c0,#2b3596);display:grid;place-items:center;font-size:18px;margin-bottom:12px\"><svg width=\"20\" height=\"20\" viewBox=\"0 0 24 24\" fill=\"none\" stroke=\"#ffffff\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\"><path d=\"M6 3h8l4 4v14a1 1 0 0 1-1 1H6a1 1 0 0 1-1-1V4a1 1 0 0 1 1-1z\"\/><path d=\"M14 3v4h4\"\/><\/svg><\/div>\n <div style=\"font-size:14.5px;font-weight:800;color:#fff;margin-bottom:6px\">Makes duties explicit<\/div>\n <div style=\"font-size:12px;color:#c3c9ee;line-height:1.5\">It puts your HIPAA obligations in writing between the two parties.<\/div>\n <\/div><div style=\"background:rgba(255,255,255,.06);border:1px solid rgba(174,182,238,.28);border-radius:16px;padding:20px\">\n <div style=\"width:38px;height:38px;border-radius:10px;background:linear-gradient(135deg,#3a46c0,#2b3596);display:grid;place-items:center;font-size:18px;margin-bottom:12px\"><svg width=\"20\" height=\"20\" viewBox=\"0 0 24 24\" fill=\"none\" stroke=\"#ffffff\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\"><circle cx=\"8\" cy=\"12\" r=\"3.5\"\/><path d=\"M11.5 12H20l-2.5 2.5M17 12v3\"\/><\/svg><\/div>\n <div style=\"font-size:14.5px;font-weight:800;color:#fff;margin-bottom:6px\">Unlocks the data<\/div>\n <div style=\"font-size:12px;color:#c3c9ee;line-height:1.5\">A covered entity cannot legally share PHI with you until it is signed.<\/div>\n <\/div><div style=\"background:rgba(255,255,255,.06);border:1px solid rgba(174,182,238,.28);border-radius:16px;padding:20px\">\n <div style=\"width:38px;height:38px;border-radius:10px;background:linear-gradient(135deg,#3a46c0,#2b3596);display:grid;place-items:center;font-size:18px;margin-bottom:12px\"><svg width=\"20\" height=\"20\" viewBox=\"0 0 24 24\" fill=\"none\" stroke=\"#ffffff\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\"><path d=\"M12 4v16M7 20h10\"\/><path d=\"M12 6l-6 2 6-2 6 2-6-2z\"\/><path d=\"M6 8l-2.5 5a2.5 2.5 0 0 0 5 0L6 8z\"\/><path d=\"M18 8l-2.5 5a2.5 2.5 0 0 0 5 0L18 8z\"\/><\/svg><\/div>\n <div style=\"font-size:14.5px;font-weight:800;color:#fff;margin-bottom:6px\">Assigns liability<\/div>\n <div style=\"font-size:12px;color:#c3c9ee;line-height:1.5\">It commits you, the business associate, to protect that data by law.<\/div>\n <\/div><\/div>\n<\/div>\n\n <h2 class=\"sec\" id=\"when\">When you need a BAA<\/h2>\n <p>The rule is simple: if you create, receive, store, or transmit PHI on behalf of a covered entity, you need a signed BAA before any of that data changes hands. This catches many companies that do not think of themselves as healthcare businesses, a cloud host, an analytics tool, a billing platform. If PHI flows through your product for a healthcare customer, a BAA is required.<\/p>\n\n <div class=\"bbox teal\"><div class=\"bt\">The gate to the deal<\/div>For a covered entity, sharing PHI without a signed BAA is itself a HIPAA violation. That is why your ability to sign one, and actually meet it, often decides whether a healthcare deal can close at all.<\/div>\n\n <h2 class=\"sec\" id=\"chain\">How the BAA chain works<\/h2>\n <p>HIPAA obligations do not stop at the first vendor. They flow down every link where PHI is shared.<\/p>\n\n <div style=\"background:#f6f8ff;border:1px solid #e3e6f5;border-radius:20px;padding:32px 34px;margin:30px 0;box-shadow:0 12px 40px rgba(28,38,122,.08)\">\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#2b3596;margin-bottom:6px\">How the chain works<\/div>\n <div style=\"font-size:20px;font-weight:800;color:#0e1330;margin-bottom:6px\">Every party that touches PHI needs a BAA<\/div>\n <div style=\"font-size:13.5px;color:#5b6178;margin-bottom:26px\">The obligation flows down the chain. If you pass PHI to a subcontractor, you need a BAA with them too.<\/div>\n <svg viewBox=\"0 0 720 210\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto;display:block\" role=\"img\" aria-label=\"Covered entity to business associate to subcontractor BAA chain\">\n<defs><marker id=\"baArr\" markerWidth=\"10\" markerHeight=\"10\" refX=\"6\" refY=\"4\" orient=\"auto\"><path d=\"M0 0 L8 4 L0 8 Z\" fill=\"#5b64c8\"\/><\/marker><\/defs>\n<g font-family=\"Inter,Arial,sans-serif\" text-anchor=\"middle\">\n \n <rect x=\"30\" y=\"70\" width=\"180\" height=\"90\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#1c267a\" stroke-width=\"2\"\/>\n <text x=\"120\" y=\"105\" font-size=\"14.5\" font-weight=\"800\" fill=\"#1c267a\">Covered entity<\/text>\n <text x=\"120\" y=\"128\" font-size=\"11\" fill=\"#5b6178\">hospital, clinic,<\/text>\n <text x=\"120\" y=\"144\" font-size=\"11\" fill=\"#5b6178\">health plan<\/text>\n \n <rect x=\"270\" y=\"70\" width=\"180\" height=\"90\" rx=\"16\" fill=\"#e7ebfa\" stroke=\"#3a46c0\" stroke-width=\"2\"\/>\n <text x=\"360\" y=\"105\" font-size=\"14.5\" font-weight=\"800\" fill=\"#3a46c0\">Business associate<\/text>\n <text x=\"360\" y=\"128\" font-size=\"11\" fill=\"#5b6178\">your SaaS, cloud host,<\/text>\n <text x=\"360\" y=\"144\" font-size=\"11\" fill=\"#5b6178\">billing or analytics<\/text>\n \n <rect x=\"510\" y=\"70\" width=\"180\" height=\"90\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#2b3596\" stroke-width=\"2\"\/>\n <text x=\"600\" y=\"105\" font-size=\"14.5\" font-weight=\"800\" fill=\"#2b3596\">Subcontractor<\/text>\n <text x=\"600\" y=\"128\" font-size=\"11\" fill=\"#5b6178\">any vendor you use<\/text>\n <text x=\"600\" y=\"144\" font-size=\"11\" fill=\"#5b6178\">that also touches PHI<\/text>\n \n <line x1=\"210\" y1=\"115\" x2=\"268\" y2=\"115\" stroke=\"#5b64c8\" stroke-width=\"2.5\" marker-end=\"url(#baArr)\"\/>\n <line x1=\"450\" y1=\"115\" x2=\"508\" y2=\"115\" stroke=\"#5b64c8\" stroke-width=\"2.5\" marker-end=\"url(#baArr)\"\/>\n <text x=\"239\" y=\"60\" font-size=\"10.5\" font-weight=\"700\" fill=\"#3a46c0\">BAA<\/text>\n <text x=\"479\" y=\"60\" font-size=\"10.5\" font-weight=\"700\" fill=\"#3a46c0\">BAA<\/text>\n <text x=\"360\" y=\"190\" font-size=\"11\" fill=\"#5b6178\">A signed BAA is required at every link where PHI is shared<\/text>\n<\/g><\/svg>\n \n<\/div>\n\n <p>If you are a business associate and you use a subcontractor that also touches PHI, your cloud provider, a support tool, a data processor, you are required to have a BAA with them as well. The chain of responsibility follows the data.<\/p>\n\n <h2 class=\"sec\" id=\"contains\">What a BAA must contain<\/h2>\n <p>A compliant BAA covers a defined set of commitments. At a minimum, it should address these.<\/p>\n\n <div class=\"otable\"><table class=\"regtable\">\n <tr><th>Element<\/th><th>What it commits the business associate to<\/th><\/tr>\n <tr><td><strong>Permitted uses<\/strong><\/td><td>How PHI may and may not be used and disclosed<\/td><\/tr>\n <tr><td><strong>Safeguards<\/strong><\/td><td>Implementing appropriate protections for the data<\/td><\/tr>\n <tr><td><strong>Breach reporting<\/strong><\/td><td>Notifying the covered entity of any breach of PHI<\/td><\/tr>\n <tr><td><strong>Subcontractors<\/strong><\/td><td>Ensuring any subcontractors agree to the same terms<\/td><\/tr>\n <tr><td><strong>Return or destruction<\/strong><\/td><td>Returning or destroying PHI when the contract ends<\/td><\/tr>\n <\/table><\/div>\n\n <h2 class=\"sec\" id=\"trap\">The signing trap to avoid<\/h2>\n <p>The most common and dangerous mistake is signing a BAA you cannot actually honour. A BAA commits you to real safeguards on PHI. Signing one when those controls are not genuinely in place does not create compliance, it creates documented, legally binding exposure. The signature must be backed by controls that operate.<\/p>\n\n <div class=\"bbox indigo\"><div class=\"bt\">Sign only what you can back<\/div>A BAA is a promise about your security. Before you sign, make sure the access control, encryption, logging, and breach process it commits you to are real and running, not aspirational.<\/div>\n\n <h2 class=\"sec\" id=\"osto\">The lean-team path to BAA-ready<\/h2>\n <p>Being able to sign a BAA with confidence comes down to one thing: having the safeguards it commits you to already in place and evidenced. For a lean team, assembling those across separate tools is slow, and it is what makes founders hesitate at the signature line.<\/p>\n\n <div class=\"bbox navy\"><div class=\"bt\">Why Osto is the startup default<\/div>Osto is the one-stop security and compliance platform purpose-built for fast-moving startups. The safeguards a BAA commits you to, access control, encryption, audit logging, monitoring, and a breach process, run on one platform and produce evidence automatically, then map to HIPAA alongside 200+ other frameworks. You can sign the BAA knowing the controls behind it are real, which is why lean teams treat Osto as the default foundation for handling PHI.<\/div>\n\n <div class=\"callout\">\n <h3>Sign the BAA with confidence.<\/h3>\n <p>Osto is the one-stop cybersecurity and compliance platform built for fast-moving startups. Put the safeguards a BAA requires on one platform, evidenced automatically, so your signature is backed by controls that run. No security team required.<\/p>\n <p style=\"margin-top:16px;\"><a href=\"https:\/\/osto.one\/book-demo\/\" style=\"color:#ffffff;font-weight:700;text-decoration:underline;\" target=\"_blank\" rel=\"noopener\"><span style=\"color:#ffffff;\">Book a Demo →<\/span><\/a><\/p>\n <\/div>\n\n <h2 class=\"sec\" id=\"faq\">Frequently asked questions<\/h2>\n <details><summary>What is a business associate agreement?<\/summary><p>A BAA is a HIPAA-required contract between a covered entity and a vendor that handles protected health information on its behalf. It makes the vendor’s HIPAA obligations explicit and legally binding, covering how PHI is used, protected, and reported.<\/p><\/details>\n <details><summary>When do I need a BAA?<\/summary><p>Whenever you create, receive, store, or transmit PHI on behalf of a covered entity. A signed BAA is required before any PHI changes hands, even if you do not consider yourself a healthcare company.<\/p><\/details>\n <details><summary>Do I need a BAA with my subcontractors?<\/summary><p>Yes. If you are a business associate and use a subcontractor that also touches PHI, you must have a BAA with them too. HIPAA obligations flow down every link in the chain where PHI is shared.<\/p><\/details>\n <details><summary>What must a BAA include?<\/summary><p>At a minimum: permitted uses and disclosures of PHI, a commitment to appropriate safeguards, <a href=\"https:\/\/www.osto.one\/resources\/glossary\/hipaa-breach-notification-rule\">breach<\/a> reporting to the covered entity, terms binding subcontractors, and return or destruction of PHI when the contract ends.<\/p><\/details>\n <details><summary>What happens if I sign a BAA I cannot meet?<\/summary><p>You create legally binding exposure. A BAA commits you to real safeguards; signing without those controls in place does not create compliance, it documents a promise you are not keeping. Sign only what your controls can back.<\/p><\/details>\n <details><summary>Who provides the BAA?<\/summary><p>Usually the covered entity provides its standard BAA, though business associates often have their own. Either way, both parties must sign before PHI is shared, and the terms must reflect HIPAA’s required commitments.<\/p><\/details>\n<\/div>\n<\/body>\n<\/html>\n","protected":false},"excerpt":{"rendered":"<p>What Is a Business Associate Agreement (BAA)? | Osto The business associate agreement is the contract that lets health data\u2026<\/p>\n","protected":false},"author":8,"featured_media":862,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12],"tags":[117,347],"class_list":["post-861","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-business-associate-agreement","tag-do-i-need-a-business-associate-agreement"],"_links":{"self":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/861","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/comments?post=861"}],"version-history":[{"count":1,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/861\/revisions"}],"predecessor-version":[{"id":863,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/861\/revisions\/863"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media\/862"}],"wp:attachment":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media?parent=861"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/categories?post=861"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/tags?post=861"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

{"id":861,"date":"2026-08-17T06:05:45","date_gmt":"2026-08-17T06:05:45","guid":{"rendered":"https:\/\/www.osto.one\/resources\/?p=861"},"modified":"2026-08-17T06:06:12","modified_gmt":"2026-08-17T06:06:12","slug":"business-associate-agreement-hipaa","status":"publish","type":"post","link":"https:\/\/www.osto.one\/resources\/blog\/business-associate-agreement-hipaa\/","title":{"rendered":"What Is a Business Associate Agreement (BAA)?"},"content":{"rendered":"\n\n\n\n\n\nWhat Is a Business Associate Agreement (BAA)? | Osto<\/title>\n<meta name=\"description\" content=\"What a HIPAA business associate agreement (BAA) is, when you need one, what it must contain, and how the obligation flows down to your subcontractors.\">\n<style>\n :root{\n --ink:#0e1330;\n --brand:#1c267a;\n --brand-2:#3a46c0;\n --accent:#00c2a8;\n --accent-soft:#e6f7f4;\n --paper:#ffffff;\n --mist:#f4f6fb;\n --line:#e3e7f2;\n --muted:#5a6284;\n --danger:#e2564d;\n --radius:16px;\n --shadow:0 1px 2px rgba(16,19,48,.04),0 12px 40px rgba(16,19,48,.06);\n --maxw:860px;\n }\n *{box-sizing:border-box}\n html{scroll-behavior:smooth}\n body{\n margin:0;\n font-family:-apple-system,BlinkMacSystemFont,\"Segoe UI\",Inter,Roboto,Helvetica,Arial,sans-serif;\n color:var(--ink);background:var(--paper);line-height:1.65;-webkit-font-smoothing:antialiased;\n }\n a{color:var(--brand-2);text-decoration:none}\n a:hover{text-decoration:underline}\n\n .topbar{border-bottom:1px solid var(--line);background:rgba(255,255,255,.9);backdrop-filter:saturate(160%) blur(8px);position:sticky;top:0;z-index:20}\n .topbar-inner{max-width:1120px;margin:0 auto;padding:14px 24px;display:flex;align-items:center;justify-content:space-between;gap:16px}\n .logo{display:flex;align-items:center;gap:9px;font-weight:800;letter-spacing:-.02em;color:var(--brand);font-size:20px}\n .logo-mark{width:26px;height:26px;border-radius:8px;background:linear-gradient(135deg,var(--brand),var(--brand-2));display:grid;place-items:center;color:#fff;font-size:14px;font-weight:800}\n .nav-cta{background:var(--brand);color:#fff;padding:9px 18px;border-radius:10px;font-weight:600;font-size:14px;white-space:nowrap}\n .nav-cta:hover{background:var(--brand-2);text-decoration:none}\n\n .wrap{max-width:var(--maxw);margin:0 auto;padding:0 24px}\n .breadcrumb{font-size:13px;color:var(--muted);padding:26px 0 6px}\n .breadcrumb a{color:var(--muted)}\n .eyebrow{display:inline-block;margin:22px 0 14px;font-size:12px;font-weight:700;letter-spacing:.14em;text-transform:uppercase;color:var(--brand-2);background:var(--mist);padding:6px 12px;border-radius:999px;border:1px solid var(--line)}\n h1{font-size:clamp(30px,5vw,46px);line-height:1.1;letter-spacing:-.03em;margin:0 0 18px;font-weight:800}\n .dek{font-size:19px;color:var(--muted);margin:0 0 8px;max-width:50ch}\n\n .meta{display:flex;flex-wrap:wrap;gap:8px 20px;align-items:center;font-size:13px;color:var(--muted);margin:22px 0 4px;padding-bottom:26px;border-bottom:1px solid var(--line)}\n .meta .dot{width:4px;height:4px;border-radius:50%;background:var(--line)}\n\n .tldr{margin:30px 0;border:1px solid var(--line);background:linear-gradient(180deg,var(--accent-soft),#fff 70%);border-radius:var(--radius);padding:22px 24px}\n .tldr h2{margin:0 0 8px;font-size:13px;letter-spacing:.14em;text-transform:uppercase;color:var(--brand)}\n .tldr p{margin:0 0 10px;font-size:16.5px}\n .tldr p:last-child{margin:0}\n\n h2.sec{font-size:27px;letter-spacing:-.02em;margin:52px 0 14px;font-weight:800;scroll-margin-top:80px}\n h3{font-size:20px;margin:34px 0 10px;letter-spacing:-.01em;font-weight:700}\n p{margin:0 0 16px;font-size:16.5px}\n .lead-in{color:var(--muted)}\n em{font-style:italic}\n\n .jump{background:var(--mist);border:1px solid var(--line);border-radius:var(--radius);padding:20px 24px;margin:30px 0}\n .jump h4{margin:0 0 12px;font-size:13px;letter-spacing:.1em;text-transform:uppercase;color:var(--muted)}\n .jump ol{margin:0;padding-left:20px;columns:2;column-gap:32px}\n .jump li{margin:6px 0;font-size:15px}\n @media(max-width:560px){.jump ol{columns:1}}\n\n .analogy{background:var(--mist);border-radius:var(--radius);padding:20px 22px;margin:22px 0;border:1px solid var(--line);font-size:16.5px}\n .analogy strong{color:var(--brand)}\n\n ul.clean{padding-left:0;list-style:none;margin:16px 0}\n ul.clean li{position:relative;padding:6px 0 6px 30px;font-size:16px;border-bottom:1px solid var(--mist)}\n ul.clean li:last-child{border-bottom:none}\n ul.clean li::before{content:\"\";position:absolute;left:4px;top:14px;width:9px;height:9px;border-radius:3px;background:var(--accent)}\n ul.warn li::before{background:var(--danger)}\n\n \/* TSC cards *\/\n .tsc{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:22px 0}\n .tsc-card{border:1px solid var(--line);border-radius:14px;padding:18px;background:#fff}\n .tsc-card.req{border-color:var(--brand);background:#f6f8ff}\n .tsc-card .tag{font-size:11px;font-weight:700;letter-spacing:.08em;text-transform:uppercase;color:var(--muted)}\n .tsc-card.req .tag{color:var(--brand)}\n .tsc-card h4{margin:6px 0 6px;font-size:16px;color:var(--ink)}\n .tsc-card p{font-size:14px;color:var(--muted);margin:0}\n @media(max-width:720px){.tsc{grid-template-columns:1fr 1fr}}\n @media(max-width:480px){.tsc{grid-template-columns:1fr}}\n\n \/* stat band *\/\n .fig{margin:30px 0;border:1px solid var(--line);border-radius:var(--radius);overflow:hidden;box-shadow:var(--shadow)}\n .fig-head{padding:16px 22px;background:var(--brand);color:#fff;display:flex;align-items:baseline;justify-content:space-between;gap:12px;flex-wrap:wrap}\n .fig-head .ttl{font-weight:700;font-size:15px;letter-spacing:.02em}\n .fig-head .src{font-size:11.5px;color:#b9c0f0}\n .fig-foot{padding:14px 22px;border-top:1px solid var(--line);font-size:12.5px;color:var(--muted);background:#fbfcfe}\n .stat-band{display:grid;grid-template-columns:repeat(3,1fr)}\n .stat-cell{padding:24px 16px;text-align:center;border-right:1px solid var(--line)}\n .stat-cell:last-child{border-right:none}\n .stat-cell .num{font-size:30px;font-weight:800;color:var(--brand);letter-spacing:-.02em;line-height:1.05}\n .stat-cell .num.accent{color:var(--accent)}\n .stat-cell .lab{font-size:12.5px;color:var(--muted);margin-top:8px;line-height:1.4}\n @media(max-width:560px){.stat-band{grid-template-columns:1fr}.stat-cell{border-right:none;border-bottom:1px solid var(--line)}.stat-cell:last-child{border-bottom:none}}\n\n \/* timeline *\/\n .timeline{padding:8px 24px 4px}\n .tl-item{display:grid;grid-template-columns:130px 1fr;gap:16px;padding:14px 0;border-bottom:1px solid var(--mist)}\n .tl-item:last-child{border-bottom:none}\n .tl-date{font-weight:800;color:var(--brand);font-size:14px}\n .tl-what{font-size:14.5px}\n .tl-what b{display:block;margin-bottom:2px}\n @media(max-width:520px){.tl-item{grid-template-columns:1fr;gap:2px}}\n\n .tablewrap{overflow-x:auto;margin:22px 0;border:1px solid var(--line);border-radius:var(--radius);box-shadow:var(--shadow)}\n table{border-collapse:collapse;width:100%;min-width:600px;font-size:14.5px}\n thead th{background:var(--mist);text-align:left;padding:14px 16px;font-size:12.5px;text-transform:uppercase;letter-spacing:.05em;color:var(--muted);border-bottom:1px solid var(--line);font-weight:700}\n thead th.osto{background:var(--brand);color:#fff}\n tbody td{padding:14px 16px;border-bottom:1px solid var(--line);vertical-align:top}\n tbody tr:last-child td{border-bottom:none}\n tbody td:first-child{font-weight:600;color:var(--ink)}\n td.osto{background:#f6f8ff;font-weight:600}\n .yes{color:var(--accent);font-weight:700}\n .no{color:var(--danger);font-weight:700}\n\n .callout{border:1px solid var(--line);border-radius:var(--radius);padding:24px;margin:44px 0;background:linear-gradient(135deg,#141b52,#2a34a0);color:#fff;box-shadow:var(--shadow)}\n .callout h3{margin:0 0 8px;color:#fff}\n .callout p{color:#cfd4f5;margin:0 0 18px}\n .callout a.btn{display:inline-block;background:#fff;color:var(--brand);font-weight:700;padding:11px 22px;border-radius:10px;font-size:15px}\n .callout a.btn:hover{text-decoration:none;background:#eef0ff}\n\n .disclaimer{font-size:13.5px;color:var(--muted);background:var(--mist);border:1px solid var(--line);border-radius:12px;padding:16px 18px;margin:34px 0}\n\n .faq{border-top:1px solid var(--line);margin-top:48px;padding-top:8px}\n details{border-bottom:1px solid var(--line);padding:6px 0}\n summary{cursor:pointer;list-style:none;padding:16px 4px;font-weight:600;font-size:17px;display:flex;justify-content:space-between;align-items:center;gap:16px}\n summary::-webkit-details-marker{display:none}\n summary::after{content:\"+\";color:var(--brand-2);font-size:22px;font-weight:400}\n details[open] summary::after{content:\"\u2013\"}\n details p{padding:0 4px 18px;color:var(--muted);margin:0}\n\n footer{border-top:1px solid var(--line);margin-top:60px;background:var(--mist)}\n .foot-inner{max-width:1120px;margin:0 auto;padding:36px 24px;display:flex;flex-wrap:wrap;gap:16px;justify-content:space-between;align-items:center;font-size:14px;color:var(--muted)}\n .foot-inner .logo{font-size:17px}\n\n .related{margin:42px 0 0}\n .related h3{margin-bottom:14px}\n .related-grid{display:grid;grid-template-columns:1fr 1fr;gap:14px}\n .rc{border:1px solid var(--line);border-radius:12px;padding:16px 18px;background:#fff}\n .rc .k{font-size:11px;letter-spacing:.1em;color:var(--brand-2);font-weight:700;text-transform:uppercase}\n .rc a{font-weight:600;color:var(--ink);display:block;margin-top:6px;font-size:15.5px}\n @media(max-width:640px){.related-grid{grid-template-columns:1fr}}\n\n \/* --- bright, clean additions --- *\/\n .bright-strip{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:30px 0}\n .bright-strip .bcard{border-radius:16px;padding:22px 20px;color:#fff}\n .bright-strip .bcard .n{font-size:26px;font-weight:800;line-height:1.1}\n .bright-strip .bcard .l{font-size:13px;margin-top:6px;opacity:.95;font-weight:500}\n .bc-navy{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n .bc-teal{background:linear-gradient(135deg,#00c2a8,#12b3d6)}\n .bc-indigo{background:linear-gradient(135deg,#3a46c0,#5a63d6)}\n @media(max-width:640px){.bright-strip{grid-template-columns:1fr}}\n\n .pillrow{display:flex;gap:10px;flex-wrap:wrap;margin:22px 0}\n .pill{border-radius:999px;padding:9px 16px;font-size:14px;font-weight:600;background:var(--accent-soft);color:#0a7a68;border:1px solid #bfece4}\n .pill.i{background:#eef0ff;color:#3a46c0;border-color:#d6dbff}\n\n .bigcards{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:26px 0}\n .bigcard{border-radius:16px;padding:22px;background:#fff;border:1px solid var(--line);box-shadow:0 8px 30px rgba(16,19,48,.05)}\n .bigcard .ic{width:44px;height:44px;border-radius:12px;display:grid;place-items:center;font-size:20px;font-weight:800;color:#fff;margin-bottom:12px}\n .bigcard h4{margin:0 0 6px;font-size:16px;color:var(--ink)}\n .bigcard p{margin:0;font-size:13.5px;color:var(--muted)}\n @media(max-width:720px){.bigcards{grid-template-columns:1fr}}\n\n .keyrow{display:grid;grid-template-columns:1fr 1fr;gap:0;border-radius:16px;overflow:hidden;border:1px solid var(--line);margin:26px 0}\n .keyrow>div{padding:20px 22px}\n .keyrow .k1{background:#eef0ff}\n .keyrow .k2{background:var(--accent-soft)}\n .keyrow .lab{font-size:11px;font-weight:800;letter-spacing:.08em;text-transform:uppercase;margin-bottom:6px}\n .keyrow .k1 .lab{color:#3a46c0}.keyrow .k2 .lab{color:#0a7a68}\n .keyrow .big{font-size:19px;font-weight:800;color:var(--brand);margin-bottom:4px}\n .keyrow .sm{font-size:13.5px;color:var(--muted)}\n @media(max-width:560px){.keyrow{grid-template-columns:1fr}}\n\n .flow{display:flex;gap:8px;flex-wrap:wrap;align-items:stretch;margin:26px 0}\n .flow .step{flex:1;min-width:130px;border-radius:14px;padding:16px 14px;text-align:center}\n .flow .step .t{font-weight:800;font-size:14px}\n .flow .step .d{font-size:12px;margin-top:4px;opacity:.9}\n .flow .arrow{align-self:center;color:#c3c9e6;font-size:20px;font-weight:700}\n\n\n .bbox{border-radius:14px;background:#fff;padding:16px 20px;margin:22px 0;font-size:14.5px;line-height:1.6}\n .bbox strong{color:var(--brand)}\n .bbox.navy{border:2px solid #1c267a}.bbox.indigo{border:2px solid #3a46c0}.bbox.teal{border:2px solid #00c2a8}\n .bbox .bt{font-size:11px;font-weight:800;letter-spacing:.06em;text-transform:uppercase;margin-bottom:5px}\n .bbox.navy .bt{color:#1c267a}.bbox.indigo .bt{color:#3a46c0}.bbox.teal .bt{color:#0a7a68}\n .checkgrid{display:grid;grid-template-columns:repeat(2,1fr);gap:12px;margin:24px 0}\n .checkarea{border:1px solid var(--line);border-radius:14px;padding:16px 18px;background:#fff;box-shadow:0 6px 24px rgba(16,19,48,.04)}\n .checkarea .h{display:flex;align-items:center;gap:10px;margin-bottom:8px}\n .checkarea .num{width:28px;height:28px;border-radius:8px;background:linear-gradient(135deg,#1c267a,#3a46c0);color:#fff;font-weight:800;font-size:13px;display:grid;place-items:center;flex:none}\n .checkarea h4{margin:0;font-size:14.5px;color:var(--ink)}\n .checkarea ul{margin:0;padding:0;list-style:none}\n .checkarea li{font-size:12.8px;color:var(--muted);padding:4px 0 4px 18px;position:relative}\n .checkarea li:before{content:\"\";position:absolute;left:0;top:9px;width:9px;height:9px;border:2px solid var(--accent);border-radius:3px}\n @media(max-width:640px){.checkgrid{grid-template-columns:1fr}}\n .sampleflow{display:flex;align-items:center;gap:0;flex-wrap:wrap;margin:22px 0;border:1px solid var(--line);border-radius:14px;overflow:hidden}\n .sampleflow .sf{flex:1;min-width:150px;padding:16px 18px;text-align:center}\n .sampleflow .sf .t{font-weight:800;font-size:14px;color:var(--brand)}\n .sampleflow .sf .d{font-size:12.5px;color:var(--muted);margin-top:4px}\n .sampleflow .sf.a{background:#eef0ff}.sampleflow .sf.b{background:#f4f6fb}.sampleflow .sf.c{background:#fdeceb}\n .sampleflow .sarr{color:#c3c9e6;font-size:18px;font-weight:700;padding:0 6px}\n @media(max-width:640px){.sampleflow{flex-direction:column}.sampleflow .sarr{display:none}.sampleflow .sf{border-bottom:1px solid var(--line)}}\n .docpills{display:flex;gap:8px;flex-wrap:wrap;margin:10px 0}\n .docpills .dp{font-size:12.5px;padding:7px 13px;border-radius:999px;background:var(--mist);color:var(--brand);border:1px solid var(--line);font-weight:500}\n\n .callout a[href*=\"book-demo\"]{color:#ffffff !important;font-weight:700;text-decoration:underline}\n .callout a[href*=\"book-demo\"] span{color:#ffffff !important}\n \/* Osto branded comparison table *\/\n .otable{overflow-x:auto;margin:26px 0;border-radius:16px;border:1px solid #e3e6f5;box-shadow:0 10px 34px rgba(28,38,122,.10)}\n table.regtable{border-collapse:separate;border-spacing:0;width:100%;min-width:520px;font-size:14.5px;background:#fff;margin:0}\n table.regtable thead tr,table.regtable tr:first-child{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n table.regtable th,table.regtable tr:first-child td{background:transparent;color:#fff;text-align:left;padding:15px 18px;font-size:13px;font-weight:800;letter-spacing:.03em;border:none}\n table.regtable td{padding:14px 18px;border-bottom:1px solid #eef0f7;vertical-align:top;color:#33384f}\n table.regtable tr:nth-child(even):not(:first-child){background:#f7f9ff}\n table.regtable tr:last-child td{border-bottom:none}\n table.regtable td:first-child{font-weight:700;color:#0e1330}\n table.regtable tr td:first-child{border-right:1px solid #eef0f7}\n table.regtable tr:first-child td:first-child,table.regtable th:first-child{border-right:1px solid rgba(255,255,255,.18)}\n table.regtable tr:first-child td{border-bottom:none}\n\n<\/style>\n<\/head>\n<body>\n<div class=\"wrap\">\n <p class=\"dek\">The <a href=\"https:\/\/www.osto.one\/resources\/glossary\/business-associate\">business associate<\/a> agreement is the contract that lets health data move between a healthcare customer and a vendor. If your product touches PHI, it is the document that unlocks the deal.<\/p>\n\n <div class=\"meta\">\n <span>Osto Security Team<\/span><span class=\"dot\"><\/span><span>7 min read<\/span><span class=\"dot\"><\/span><span>Compliance & Trust<\/span>\n <\/div>\n\n <div class=\"tldr\">\n <h2>TL;DR<\/h2>\n <p>A business associate agreement (BAA) is the HIPAA contract between a <a href=\"https:\/\/www.osto.one\/resources\/glossary\/covered-entity\">covered entity<\/a> and a vendor that handles <a href=\"https:\/\/www.osto.one\/resources\/glossary\/protected-health-information\">protected health information<\/a> on its behalf. It makes your HIPAA obligations explicit and legally binding.<\/p>\n <p>A covered entity cannot share PHI with you until it is signed, so it is often the gate to a healthcare deal. The obligation flows downhill: if you pass PHI to a subcontractor, you need a BAA with them too.<\/p>\n <\/div>\n\n <div class=\"jump\">\n <h4>On this page<\/h4>\n <ol>\n <li><a href=\"#what\">What a BAA is<\/a><\/li>\n <li><a href=\"#when\">When you need one<\/a><\/li>\n <li><a href=\"#chain\">How the chain works<\/a><\/li>\n <li><a href=\"#contains\">What it must contain<\/a><\/li>\n <li><a href=\"#trap\">The signing trap<\/a><\/li>\n <li><a href=\"#osto\">The lean-team path<\/a><\/li>\n <\/ol>\n <\/div>\n\n <h2 class=\"sec\" id=\"what\">What is a business associate agreement?<\/h2>\n <p>A business associate agreement is a written contract required by HIPAA whenever a covered entity, such as a hospital or health plan, lets another organisation handle protected health information on its behalf. That other organisation is the business associate, and for most software companies serving healthcare, that is you. The BAA sets out how you will protect the data and makes your HIPAA responsibilities legally binding.<\/p>\n\n <div style=\"background:linear-gradient(135deg,#0e1444,#1c267a 55%,#242f86);border-radius:20px;padding:34px 34px 30px;margin:30px 0;box-shadow:0 18px 50px rgba(14,20,68,.28);position:relative;overflow:hidden\">\n <div style=\"position:absolute;top:-50px;right:-40px;width:260px;height:260px;background:radial-gradient(circle,rgba(58,70,192,.45),transparent 68%);pointer-events:none\"><\/div>\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#aeb6ee;margin-bottom:6px\">What a BAA does<\/div>\n <div style=\"font-size:21px;font-weight:800;color:#fff;margin-bottom:24px;letter-spacing:-.01em\">The contract that lets health data change hands<\/div>\n <div style=\"display:grid;grid-template-columns:1fr 1fr 1fr ;gap:16px\"><div style=\"background:rgba(255,255,255,.06);border:1px solid rgba(174,182,238,.28);border-radius:16px;padding:20px\">\n <div style=\"width:38px;height:38px;border-radius:10px;background:linear-gradient(135deg,#3a46c0,#2b3596);display:grid;place-items:center;font-size:18px;margin-bottom:12px\"><svg width=\"20\" height=\"20\" viewBox=\"0 0 24 24\" fill=\"none\" stroke=\"#ffffff\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\"><path d=\"M6 3h8l4 4v14a1 1 0 0 1-1 1H6a1 1 0 0 1-1-1V4a1 1 0 0 1 1-1z\"\/><path d=\"M14 3v4h4\"\/><\/svg><\/div>\n <div style=\"font-size:14.5px;font-weight:800;color:#fff;margin-bottom:6px\">Makes duties explicit<\/div>\n <div style=\"font-size:12px;color:#c3c9ee;line-height:1.5\">It puts your HIPAA obligations in writing between the two parties.<\/div>\n <\/div><div style=\"background:rgba(255,255,255,.06);border:1px solid rgba(174,182,238,.28);border-radius:16px;padding:20px\">\n <div style=\"width:38px;height:38px;border-radius:10px;background:linear-gradient(135deg,#3a46c0,#2b3596);display:grid;place-items:center;font-size:18px;margin-bottom:12px\"><svg width=\"20\" height=\"20\" viewBox=\"0 0 24 24\" fill=\"none\" stroke=\"#ffffff\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\"><circle cx=\"8\" cy=\"12\" r=\"3.5\"\/><path d=\"M11.5 12H20l-2.5 2.5M17 12v3\"\/><\/svg><\/div>\n <div style=\"font-size:14.5px;font-weight:800;color:#fff;margin-bottom:6px\">Unlocks the data<\/div>\n <div style=\"font-size:12px;color:#c3c9ee;line-height:1.5\">A covered entity cannot legally share PHI with you until it is signed.<\/div>\n <\/div><div style=\"background:rgba(255,255,255,.06);border:1px solid rgba(174,182,238,.28);border-radius:16px;padding:20px\">\n <div style=\"width:38px;height:38px;border-radius:10px;background:linear-gradient(135deg,#3a46c0,#2b3596);display:grid;place-items:center;font-size:18px;margin-bottom:12px\"><svg width=\"20\" height=\"20\" viewBox=\"0 0 24 24\" fill=\"none\" stroke=\"#ffffff\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\"><path d=\"M12 4v16M7 20h10\"\/><path d=\"M12 6l-6 2 6-2 6 2-6-2z\"\/><path d=\"M6 8l-2.5 5a2.5 2.5 0 0 0 5 0L6 8z\"\/><path d=\"M18 8l-2.5 5a2.5 2.5 0 0 0 5 0L18 8z\"\/><\/svg><\/div>\n <div style=\"font-size:14.5px;font-weight:800;color:#fff;margin-bottom:6px\">Assigns liability<\/div>\n <div style=\"font-size:12px;color:#c3c9ee;line-height:1.5\">It commits you, the business associate, to protect that data by law.<\/div>\n <\/div><\/div>\n<\/div>\n\n <h2 class=\"sec\" id=\"when\">When you need a BAA<\/h2>\n <p>The rule is simple: if you create, receive, store, or transmit PHI on behalf of a covered entity, you need a signed BAA before any of that data changes hands. This catches many companies that do not think of themselves as healthcare businesses, a cloud host, an analytics tool, a billing platform. If PHI flows through your product for a healthcare customer, a BAA is required.<\/p>\n\n <div class=\"bbox teal\"><div class=\"bt\">The gate to the deal<\/div>For a covered entity, sharing PHI without a signed BAA is itself a HIPAA violation. That is why your ability to sign one, and actually meet it, often decides whether a healthcare deal can close at all.<\/div>\n\n <h2 class=\"sec\" id=\"chain\">How the BAA chain works<\/h2>\n <p>HIPAA obligations do not stop at the first vendor. They flow down every link where PHI is shared.<\/p>\n\n <div style=\"background:#f6f8ff;border:1px solid #e3e6f5;border-radius:20px;padding:32px 34px;margin:30px 0;box-shadow:0 12px 40px rgba(28,38,122,.08)\">\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#2b3596;margin-bottom:6px\">How the chain works<\/div>\n <div style=\"font-size:20px;font-weight:800;color:#0e1330;margin-bottom:6px\">Every party that touches PHI needs a BAA<\/div>\n <div style=\"font-size:13.5px;color:#5b6178;margin-bottom:26px\">The obligation flows down the chain. If you pass PHI to a subcontractor, you need a BAA with them too.<\/div>\n <svg viewBox=\"0 0 720 210\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto;display:block\" role=\"img\" aria-label=\"Covered entity to business associate to subcontractor BAA chain\">\n<defs><marker id=\"baArr\" markerWidth=\"10\" markerHeight=\"10\" refX=\"6\" refY=\"4\" orient=\"auto\"><path d=\"M0 0 L8 4 L0 8 Z\" fill=\"#5b64c8\"\/><\/marker><\/defs>\n<g font-family=\"Inter,Arial,sans-serif\" text-anchor=\"middle\">\n \n <rect x=\"30\" y=\"70\" width=\"180\" height=\"90\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#1c267a\" stroke-width=\"2\"\/>\n <text x=\"120\" y=\"105\" font-size=\"14.5\" font-weight=\"800\" fill=\"#1c267a\">Covered entity<\/text>\n <text x=\"120\" y=\"128\" font-size=\"11\" fill=\"#5b6178\">hospital, clinic,<\/text>\n <text x=\"120\" y=\"144\" font-size=\"11\" fill=\"#5b6178\">health plan<\/text>\n \n <rect x=\"270\" y=\"70\" width=\"180\" height=\"90\" rx=\"16\" fill=\"#e7ebfa\" stroke=\"#3a46c0\" stroke-width=\"2\"\/>\n <text x=\"360\" y=\"105\" font-size=\"14.5\" font-weight=\"800\" fill=\"#3a46c0\">Business associate<\/text>\n <text x=\"360\" y=\"128\" font-size=\"11\" fill=\"#5b6178\">your SaaS, cloud host,<\/text>\n <text x=\"360\" y=\"144\" font-size=\"11\" fill=\"#5b6178\">billing or analytics<\/text>\n \n <rect x=\"510\" y=\"70\" width=\"180\" height=\"90\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#2b3596\" stroke-width=\"2\"\/>\n <text x=\"600\" y=\"105\" font-size=\"14.5\" font-weight=\"800\" fill=\"#2b3596\">Subcontractor<\/text>\n <text x=\"600\" y=\"128\" font-size=\"11\" fill=\"#5b6178\">any vendor you use<\/text>\n <text x=\"600\" y=\"144\" font-size=\"11\" fill=\"#5b6178\">that also touches PHI<\/text>\n \n <line x1=\"210\" y1=\"115\" x2=\"268\" y2=\"115\" stroke=\"#5b64c8\" stroke-width=\"2.5\" marker-end=\"url(#baArr)\"\/>\n <line x1=\"450\" y1=\"115\" x2=\"508\" y2=\"115\" stroke=\"#5b64c8\" stroke-width=\"2.5\" marker-end=\"url(#baArr)\"\/>\n <text x=\"239\" y=\"60\" font-size=\"10.5\" font-weight=\"700\" fill=\"#3a46c0\">BAA<\/text>\n <text x=\"479\" y=\"60\" font-size=\"10.5\" font-weight=\"700\" fill=\"#3a46c0\">BAA<\/text>\n <text x=\"360\" y=\"190\" font-size=\"11\" fill=\"#5b6178\">A signed BAA is required at every link where PHI is shared<\/text>\n<\/g><\/svg>\n \n<\/div>\n\n <p>If you are a business associate and you use a subcontractor that also touches PHI, your cloud provider, a support tool, a data processor, you are required to have a BAA with them as well. The chain of responsibility follows the data.<\/p>\n\n <h2 class=\"sec\" id=\"contains\">What a BAA must contain<\/h2>\n <p>A compliant BAA covers a defined set of commitments. At a minimum, it should address these.<\/p>\n\n <div class=\"otable\"><table class=\"regtable\">\n <tr><th>Element<\/th><th>What it commits the business associate to<\/th><\/tr>\n <tr><td><strong>Permitted uses<\/strong><\/td><td>How PHI may and may not be used and disclosed<\/td><\/tr>\n <tr><td><strong>Safeguards<\/strong><\/td><td>Implementing appropriate protections for the data<\/td><\/tr>\n <tr><td><strong>Breach reporting<\/strong><\/td><td>Notifying the covered entity of any breach of PHI<\/td><\/tr>\n <tr><td><strong>Subcontractors<\/strong><\/td><td>Ensuring any subcontractors agree to the same terms<\/td><\/tr>\n <tr><td><strong>Return or destruction<\/strong><\/td><td>Returning or destroying PHI when the contract ends<\/td><\/tr>\n <\/table><\/div>\n\n <h2 class=\"sec\" id=\"trap\">The signing trap to avoid<\/h2>\n <p>The most common and dangerous mistake is signing a BAA you cannot actually honour. A BAA commits you to real safeguards on PHI. Signing one when those controls are not genuinely in place does not create compliance, it creates documented, legally binding exposure. The signature must be backed by controls that operate.<\/p>\n\n <div class=\"bbox indigo\"><div class=\"bt\">Sign only what you can back<\/div>A BAA is a promise about your security. Before you sign, make sure the access control, encryption, logging, and breach process it commits you to are real and running, not aspirational.<\/div>\n\n <h2 class=\"sec\" id=\"osto\">The lean-team path to BAA-ready<\/h2>\n <p>Being able to sign a BAA with confidence comes down to one thing: having the safeguards it commits you to already in place and evidenced. For a lean team, assembling those across separate tools is slow, and it is what makes founders hesitate at the signature line.<\/p>\n\n <div class=\"bbox navy\"><div class=\"bt\">Why Osto is the startup default<\/div>Osto is the one-stop security and compliance platform purpose-built for fast-moving startups. The safeguards a BAA commits you to, access control, encryption, audit logging, monitoring, and a breach process, run on one platform and produce evidence automatically, then map to HIPAA alongside 200+ other frameworks. You can sign the BAA knowing the controls behind it are real, which is why lean teams treat Osto as the default foundation for handling PHI.<\/div>\n\n <div class=\"callout\">\n <h3>Sign the BAA with confidence.<\/h3>\n <p>Osto is the one-stop cybersecurity and compliance platform built for fast-moving startups. Put the safeguards a BAA requires on one platform, evidenced automatically, so your signature is backed by controls that run. No security team required.<\/p>\n <p style=\"margin-top:16px;\"><a href=\"https:\/\/osto.one\/book-demo\/\" style=\"color:#ffffff;font-weight:700;text-decoration:underline;\" target=\"_blank\" rel=\"noopener\"><span style=\"color:#ffffff;\">Book a Demo →<\/span><\/a><\/p>\n <\/div>\n\n <h2 class=\"sec\" id=\"faq\">Frequently asked questions<\/h2>\n <details><summary>What is a business associate agreement?<\/summary><p>A BAA is a HIPAA-required contract between a covered entity and a vendor that handles protected health information on its behalf. It makes the vendor’s HIPAA obligations explicit and legally binding, covering how PHI is used, protected, and reported.<\/p><\/details>\n <details><summary>When do I need a BAA?<\/summary><p>Whenever you create, receive, store, or transmit PHI on behalf of a covered entity. A signed BAA is required before any PHI changes hands, even if you do not consider yourself a healthcare company.<\/p><\/details>\n <details><summary>Do I need a BAA with my subcontractors?<\/summary><p>Yes. If you are a business associate and use a subcontractor that also touches PHI, you must have a BAA with them too. HIPAA obligations flow down every link in the chain where PHI is shared.<\/p><\/details>\n <details><summary>What must a BAA include?<\/summary><p>At a minimum: permitted uses and disclosures of PHI, a commitment to appropriate safeguards, <a href=\"https:\/\/www.osto.one\/resources\/glossary\/hipaa-breach-notification-rule\">breach<\/a> reporting to the covered entity, terms binding subcontractors, and return or destruction of PHI when the contract ends.<\/p><\/details>\n <details><summary>What happens if I sign a BAA I cannot meet?<\/summary><p>You create legally binding exposure. A BAA commits you to real safeguards; signing without those controls in place does not create compliance, it documents a promise you are not keeping. Sign only what your controls can back.<\/p><\/details>\n <details><summary>Who provides the BAA?<\/summary><p>Usually the covered entity provides its standard BAA, though business associates often have their own. Either way, both parties must sign before PHI is shared, and the terms must reflect HIPAA’s required commitments.<\/p><\/details>\n<\/div>\n<\/body>\n<\/html>\n","protected":false},"excerpt":{"rendered":"<p>What Is a Business Associate Agreement (BAA)? | Osto The business associate agreement is the contract that lets health data\u2026<\/p>\n","protected":false},"author":8,"featured_media":862,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12],"tags":[117,347],"class_list":["post-861","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-business-associate-agreement","tag-do-i-need-a-business-associate-agreement"],"_links":{"self":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/861","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/comments?post=861"}],"version-history":[{"count":1,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/861\/revisions"}],"predecessor-version":[{"id":863,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/861\/revisions\/863"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media\/862"}],"wp:attachment":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media?parent=861"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/categories?post=861"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/tags?post=861"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}