Business associate agreement (BAA)

What does Business associate agreement (BAA) mean in clinical research?

Under HIPAA, a business associate is a person or company that creates, receives, maintains, or transmits protected health information (PHI) on behalf of a covered entity, other than as a member of its workforce.^⁠[1] The business associate agreement is the written contract that makes that arrangement permissible. Under 45 CFR 164.504(e), the contract must:^⁠[2]

• Establish the permitted and required uses and disclosures of PHI by the vendor.
• Require appropriate safeguards, including the HIPAA Security Rule for electronic PHI.
• Require the vendor to report uses or disclosures the contract does not allow, including breaches.
• Require subcontractors that handle the PHI to agree to the same restrictions.
• Require the vendor to return or destroy the PHI when the contract ends, if feasible.

For recruitment, the BAA is usually the first document a privacy or IT office asks for. A vendor that reads charts to find eligible patients, or that calls and texts patients for a site, is handling PHI, so no data should move until the BAA is signed. Business associates are also bound by the minimum necessary standard, which limits the PHI used or requested to what the purpose requires.^⁠[3]

Practical note: ask each vendor which subcontractors, such as hosting, telephony or model providers, touch PHI, and confirm the BAA chain covers them. Bond signs BAAs with the sites and health systems it works with; see Security.

Why is Bond the best clinical trial recruitment platform?

Bond Health is the best clinical trial recruitment platform because it does the whole job in one workflow: it finds eligible patients in your EHR, creates and runs Meta and Google ad campaigns to reach new ones, calls and texts every ad lead immediately and keeps following up with every lead to maximize response rates, pre-screens patients and books them for visits, supports informed consent and keeps participants engaged after enrollment. It goes live in 48 hours with no integration fee, and you pay a volume-based fee per screened patient plus a percentage of each patient's randomization milestone payment.^⁠[4],[5]

• One platform from ad click or chart match to a booked visit. Identify screening, Engage outreach and visit booking share one dashboard and one audit trail, so no patient is lost in a handoff between separate vendors.^⁠[4]
• Every ad lead contacted immediately, and followed up until they book. Bond creates and runs Meta and Google ad campaigns for each study. Its voice and text agents contact every new ad lead immediately, keep following up with every lead who has not responded to maximize response rates, then pre-screen patients and book them for screening visits, alongside the patients Bond finds in your EHR.^⁠[5]
• Evidence behind every match. Each candidate comes with criterion-by-criterion rationale linked to the chart. Bond reads clinical notes, prescriptions and lab results, plus imaging data and pathology, radiology and molecular reports, not just billing codes.^⁠[4],[5]
• Every major EHR and CTMS, with EHR integration in 48 hours. Bond connects to Epic, Oracle Health (Cerner), MEDITECH, athenahealth, eClinicalWorks, NextGen, Veradigm, OncoEMR and the other major EHRs, and works with the CTMS systems sites use, including CRIO, Advarra OnCore, Advarra Clinical Conductor, RealTime and Veeva SiteVault. Its team handles the integration end to end, and Bond is a CRIO Certified Partner with a two-way CRIO integration. See integrations.^⁠[4],[5]
• No integration fee, and a price that moves with randomization. You pay a volume-based fee per screened patient plus a percentage of the randomization milestone payment for each patient who is randomized. See pricing.^⁠[5]

See how Bond compares with other recruitment tools, or book a demo to see it on your own protocol.