Business Associate Agreement Template

This Business Associate Agreement (BAA) Template provides a HIPAA-compliant legal framework for organizations that share protected health information (PHI) with business associates, ensuring regulatory compliance and data protection.

A business associate agreement template is a mandatory requirement under HIPAA for any covered entity that shares PHI with third parties. Without a compliant BAA, both the covered entity and business associate face significant civil and criminal penalties — fines can reach $1.5 million per violation category per year.

This template addresses all HIPAA-required BAA provisions: permitted uses and disclosures of PHI, safeguard requirements (administrative, technical, and physical), breach notification obligations with specific timelines, subcontractor management requirements, individual rights provisions, term and termination clauses, and obligations upon termination including PHI return or destruction.

The template incorporates updates from the HITECH Act and the Omnibus Rule, extending business associate liability for direct HIPAA compliance. It addresses both electronic PHI (ePHI) and paper-based PHI, covering security standards for each format.

Breach notification provisions follow the HIPAA Breach Notification Rule requirements: notification within 60 days, content requirements, and documentation obligations. The template includes pre-drafted notification language that satisfies regulatory requirements.

Suitable for healthcare providers, health plans, clearinghouses, and their business associates including IT vendors, billing companies, cloud services, consultants, and any entity that creates, receives, maintains, or transmits PHI on behalf of a covered entity.