Essentially, if an vendororganization is hired engaged to handle, use, distribute, or access protected health information (PHI), the vendory would likely qualify as a BA under the HIPAA regulation. The quick rule to remember with BABusiness Associates: before you share PHI, you mustmust have a signed BAA in place.