A business associate agreement is a contract between your practice and any vendor that can access, store, or transmit patient data, including IT providers, hosting companies, and some software tools. It defines how that vendor protects the data. If a vendor touches patient data and will not sign one, that is a compliance gap. We sign these as a matter of course.