A BAA is required anytime a vendor creates, receives, maintains, or transmits PHI.
Agreements must outline safeguards, reporting timelines, and permitted uses of PHI.
Many training platforms provide templates and guidance for compliance teams managing vendor relationships.