Yes, if PHI is being shared with a BA, you must ensure that a proper BAA is in place. Please consult the Compliance and Privacy Office for review of all BAA documents. The BAA to execute will depend upon the circumstances of each situation.