HIPAA & BAA

Last updated: October 24, 2026

What a BAA is

Under HIPAA, a Business Associate Agreement (a BAA) is the written agreement between an organization that holds patients' health information, such as a home care agency, a practice or a hospital, and a company that handles that information for it. It says how the information is protected, used and reported.

How ExpressAgain handles it for organizations

• A home care or home health agency: ExpressAgain signs a BAA with the agency before any client's information goes in. Until it is signed, the agency sets up its business (verification, locations, services and prices, its team), and adding, enrolling, importing or connecting clients waits.
• Until it is signed, the helpers that would send a client's health details to an outside service stay off for the agency's people, and they use written replies and typing instead.
• When it is signed, ExpressAgain marks it on the agency's account and everything opens at once. The steps are in the Help Center: Client information opens after the BAA is signed.
• A practice, a hospital, a hospice or another organization that needs a BAA: talk with us before patient information goes in, and we will go through the agreement with you.

What we do with health details today

• Access is by role: each person sees only what their role on the patient's team allows, and organizations keep an access log.
• Sensitive values, such as door codes and member IDs, are sealed and shown masked.
• Texts carry no health values.
• The vendors we use and what each one does are listed in the Privacy Policy. Where our own vendor agreements stand is on the Security page.

Families

A family using ExpressAgain for a loved one does not sign a BAA. Who sees what, and how to share with an organization, are in the Privacy Policy and Your Privacy Choices.

Ask us

To start a BAA for your organization, or with a question, contact us or email privacy@expressagain.com.