To conduct do business with a new vendor that will have access to Protected Health Information ( PHI), you will need to complete the BAAthe Business Associates Agreements request and send a copy of the underlying contract between the vendor and the University to the Compliance and Privacy ourOoffice via email Privacyagreements@med.cornell.edu. We will then determine if a BAA business associate agreement is required and begin the process, if necessary.