Purchasing Services

Supply Chain Management is here to provide assistance to WashU departments with procurement and purchasing needs that fulfill the university’s teaching, research and patient care missions. Get started on your purchasing journey with the following services and tools. 

HIPAA & Business Associate Agreements

WashU requires a Business Associate Agreement (BAA) whenever Protected Health Information (PHI) is shared with a vendor to ensure compliance with the Health Insurance Portability and Accountability Act (HIPAA).  

Step One: Check for an Existing BAA

Review the HIPAA Business Associate Suppliers list in the WashU Contract Management Tool.

• Executed BAAs generally apply University-wide
• Multiple BAAs with the same vendor are typically not required
• Exceptions will be noted on the list

Have questions about whether a BAA is required? Email supplychain@wustl.edu for guidance.

---

Step Two: Submit a Contract Intake Form (If No BAA Exists)

• If a BAA is not already in place, complete the Supply Chain Contract Intake Form.
• Your submission will be assigned to a Contract Manager on the Supply Chain Management Team. Requestors can track the progress of their BAA request using the Contract Management Tool.

---

Step Three: The Contract Manager Will…

• Coordinate with the requestor, vendor, and HIPAA Privacy Office
• Draft and negotiate the BAA
• Manage revisions and approvals
• Obtain signatures from the vendor and an authorized University signatory

Once executed:

• A copy of the finalized BAA will be shared with the vendor and requester
• The original agreement will be retained in the Supply Chain Management repository

Helpful Links