Short answer: The business associate agreement is between the group health plan and the vendor (the employer usually signs on the plan’s behalf). The employer does not sign a BAA with its own plan; the plan document amendment and sponsor certification do that job.
A business associate is a business associate of the covered entity, which is the group health plan. So the TPA, PBM, COBRA administrator, FSA or HRA administrator, and any broker or consultant who handles the plan’s PHI each sign an agreement with the plan, typically executed by an officer of the employer acting for the plan.
The employer itself is not the plan’s business associate. The route for the employer to receive PHI is different: the plan document must be amended and the employer must certify it will follow the restrictions.
Business associates must in turn sign agreements with their own subcontractors that handle the PHI, such as a TPA’s claims repricer or cloud vendor. Keep an inventory of every vendor that touches plan data, and check it at renewal.