A BAA is a legal contract between a healthcare provider and a contractor or vendor.  A provider enters into a BAA when that vendor might receive access to protected health information.  You’ll notice that we emphasized the term “might” for a reason. Even if you don’t think the vendor will contact any PHI, it’s a good idea for them to sign a BAA because it protects you as the provider.  In short, there’s no downside for you as the vendor to signing the BAA - it protects you even if you don’t think you need it and puts in writing the obligations of the vendor.