A Business Associate Agreement without an underlying contract for services must be reviewed by the VUMC Privacy Office. OCM will review a BAA when it is part of a services agreement. OCM will then require a detailed scope defining the work covered by the relationship.