A contract required under HIPAA whenever a covered entity (such as a hospital or health insurer) shares Protected Health Information with a third-party vendor. The BAA legally binds the vendor to handle PHI according to HIPAA's privacy and security rules — including breach notification timelines, employee training, encryption requirements, and limits on subcontractor access. For meeting copilots used in healthcare, signing a BAA is typically the gating requirement before any clinical conversation can be recorded or transcribed. Vendors who can't or won't sign one are effectively unusable in healthcare settings. Note that a BAA is not the same as being "HIPAA compliant" — there is no formal HIPAA certification, only attestation of controls — but the BAA is the contractual mechanism that makes a vendor accountable.