What security does a BAA actually require of us?

Documented safeguards, encryption, training, and audit capability, implemented through our cybersecurity and HIPAA compliance services.