When negotiating services agreements with a covered entity who holds or controls protected health information, such as a healthcare provider or businesses that service healthcare providers, IT services companies are often asked to execute a Business Associate Agreement or BAA. A BAA is an agreement that governs the use of protected health information by a…