Business associate agreement template
A free, editable HIPAA business associate agreement (BAA) for a practice to sign with its vendors, with every provision 45 CFR 164.504(e) and 164.314(a) require.
This agreement
Free
Word .docx · 2 pages · 76 KB · no sign-up
Download the free templateFull therapy practice kit
$299 one time
$249 launch price for the first 30 days after sales open · 12 months of updates
- This agreement, plus a guide to checking a vendor's BAA
- Vendor policy and the Vendor & BAA Register
- Risk analysis and incident procedure
Version 1.0 · Checked against 45 CFR on · Made by hipaa.systems — how we check · Not legal advice
At a glance
This free business associate agreement template is an editable two-page Word BAA written from the practice's side. It contains the provisions 45 CFR 164.504(e) and 164.314(a) require: permitted uses, safeguards, reporting of incidents and breaches, subcontractors, patients' rights, HHS access, and return or destruction of PHI at the end. Sign it — or check the vendor's own BAA against it — before the vendor creates, receives, maintains or transmits PHI for you.
| Format | Word (.docx), 2 pages; opens in Google Docs |
|---|---|
| Built on | 45 CFR 164.504(e) and 164.314(a) |
| Written for | The practice (covered entity), not the vendor |
| Covers | The provisions HIPAA requires — not prices, liability or other commercial terms |
Do you need a BAA with this vendor?
- Yes, if the vendor creates, receives, maintains or transmits PHI for you — for example an EHR, cloud storage, email, billing service or IT support with access to patient data
- No, if the vendor does not create, receive, maintain or transmit PHI for you. A vendor that stores encrypted PHI is still a business associate, even if it can't view the data or doesn't hold the key
- No, if the vendor is only a conduit that carries PHI on a transient basis, such as the postal service or an internet service provider
- No for sharing information with another provider to treat the patient
Preview
Tap a page to open the full PDF in a new tab.
Download the free template Word .docx · 2 pages · 76 KB
How to use this BAA
Your agreement or the vendor's?
- Check the vendor's own BAA first. Large vendors — cloud, email, EHR — usually insist on it. That's fine if it contains every provision listed below
- If you need a separate agreement, this template is a starting point for both sides to adapt and sign. It doesn't make a vendor safe for patient information, and the vendor still has to agree to it
- Check that it covers the product and plan you actually use, and turn on the settings the vendor requires
- This template covers the terms HIPAA requires. State contract law and your services agreement may need more terms or formalities — make sure the BAA and the services agreement don't conflict
See which vendors offer a BAA, and on which plans →
Before PHI is shared
- Sign before the vendor creates, receives, maintains or transmits PHI for you
- Describe the services and set the reporting deadline. HIPAA requires a business associate to report a breach without unreasonable delay and no later than 60 calendar days after discovery; the template sets a shorter contractual deadline of 10 business days
- Decide whether to allow the optional uses: the vendor's own management and administration, and data aggregation
After signing
- Record the vendor, the plan and the date in your vendor register
- Keep the signed BAA for six years from signing or from when it was last in effect, whichever is later
- Review it when the service or plan changes; when it ends, get the PHI returned or destroyed
See the legal requirements this agreement covers
| Requirement | Where | Source |
|---|---|---|
| Permitted and required uses and disclosures | Section 2 | 45 CFR 164.504(e)(2)(i) |
| No other use, safeguards and the Security Rule, subcontractors | Section 3 | 45 CFR 164.504(e)(2)(ii)(A), (B), (D); 164.314(a)(2)(i)(A)–(B) |
| Reporting improper uses, security incidents and breaches | Section 4 | 45 CFR 164.504(e)(2)(ii)(C); 164.314(a)(2)(i)(C); 164.410 |
| Access, amendment, accounting, Privacy Rule duties, HHS access | Section 5 | 45 CFR 164.504(e)(2)(ii)(E)–(I) |
| Return or destruction of PHI, termination for a material violation | Section 6 | 45 CFR 164.504(e)(2)(ii)(J), (e)(2)(iii) |
| A reporting deadline shorter than HIPAA's 60-day limit | Section 4 | Recommended |
Frequently asked questions
Does every vendor need a BAA?
No — only business associates: vendors that create, receive, maintain or transmit PHI for you. A vendor that handles no PHI, or a conduit that only carries it on a transient basis, doesn't need one.
Can we sign the vendor's own BAA?
Yes, if it contains every provision HIPAA requires — check it against the list on this page — and covers the product and plan you use.
What if the vendor says it never sees the data?
A vendor that stores PHI for you is a business associate even if the data is encrypted and it has no key, according to HHS guidance on cloud services.
Are the vendor's subcontractors covered?
The vendor must get the same restrictions in writing from any subcontractor that handles your PHI. You don't sign with the subcontractors yourself.
Does signing a BAA make the vendor compliant?
No. It makes the vendor commit to the required safeguards and duties. You still check the plan and settings, and your own HIPAA duties stay with you.
What breach-reporting deadline should a BAA use?
HIPAA requires a business associate to report a breach without unreasonable delay and no later than 60 days after discovery. A shorter contractual deadline, such as 10 business days, leaves you time to meet your own.