A Business Associate Agreement without an underlying contract for services must be reviewed by the VUMC Privacy Office. OSP-CM will review a BAA when it is part of a services agreement. OSP-CM will then require a detailed scope defining the work covered by the relationship.