Data processing agreement
Also called DPA, Business associate agreement, BAA
A data processing agreement is the contract under which a vendor processes personal data for your organization. In US healthcare the equivalent is a BAA.
Why it matters in a workup
The agreement sets out what the vendor may do with the data, where it is stored, who can access it and what happens in a breach.
It covers the accounts your organization manages. A personal account with the same vendor sits outside it.
Put it into practice
- Confirm it is signed before identifiable data goes in
- Check it covers the specific product
- Keep a copy with the tool's approval
Frequently asked questions
Who signs it?
Your organization and the vendor. An individual doctor signing up does not create one for the organization.
General guidance on clinical documentation, not advice about any individual patient and not legal advice.
Glossary
Look up related terms
- De-identificationDe-identification removes or alters details that identify a patient, such as name, date of birth and record numbers. It lowers risk but rarely removes it.
- Audit trailAn audit trail records who viewed, added, changed, shared or exported a record and when, so access can be reviewed and incidents investigated.