Hipaa Business Associate Agreement: What It Covers and a Template (2026)

What is a HIPAA business associate agreement? A HIPAA business associate agreement (BAA) is a written contract that US law requires between a covered entity and any vendor that creates, receives, maintains, or transmits protected health information (PHI) on its behalf. The same contract is required between a business associate and any subcontractor it uses to handle PHI. The BAA sets out what the vendor may do with PHI, the safeguards it must apply, how it reports problems, and what happens to the PHI when the relationship ends. The requirement comes from the HIPAA Privacy and Security Rules, and the specific terms a BAA must contain are listed at 45 CFR 164.504(e). Without a signed BAA in place, a covered entity generally may not share PHI with the vendor at all, and both sides can face enforcement if PHI is handled without one. This article is general guidance, not legal advice. HIPAA is a United States law and its details change, so have a qualified professional review any BAA before you rely on it. Last verified October 2026. ## Who needs a BAA, and who does not You need a BAA when: - A covered entity (a health plan, a healthcare clearinghouse, or a healthcare provider that bills electronically) hands PHI to a vendor that performs a function on its behalf. Common examples are cloud hosting, billing, claims processing, data analytics, transcription, e-prescribing, and document storage.

• A business associate passes PHI to its own subcontractor. The subcontractor must sign a BAA on the same terms that bind the business associate. You usually do not need a BAA for a vendor that never touches PHI, for a conduit that only transports data without routinely accessing it, or for disclosures to the patient themselves. A "mere conduit" is read narrowly, so check carefully before relying on it. ## HIPAA business associate agreement template Copy the block below and fill the bracketed fields. ``` BUSINESS ASSOCIATE AGREEMENT This Business Associate Agreement ("BAA") is entered into on [DATE] BETWEEN: [COVERED ENTITY / BUSINESS ASSOCIATE NAME] ("Covered Entity") AND [VENDOR NAME] ("Business Associate") 1. DEFINITIONS Terms used here have the meaning given in the HIPAA Rules at 45 CFR Parts 160 and 164. "PHI" means protected health information the Business Associate creates or receives for the Covered Entity. 2. PERMITTED USES AND DISCLOSURES The Business Associate may use or disclose PHI only (a) to perform the services described in [underlying services agreement]; (b) as required by law; and (c) for its own proper management or legal duties, provided any further disclosure is required by law or made under a written confidentiality assurance. The Business Associate may not use or disclose PHI in a way the Covered Entity could not. 3. SAFEGUARDS The Business Associate will use appropriate administrative, physical and technical safeguards and, for electronic PHI, will comply with the Security Rule (45 CFR Part 164, Subpart C). 4. REPORTING AND BREACH NOTICE The Business Associate will report to the Covered Entity any use or disclosure not permitted by this BAA, any security incident, and any breach of unsecured PHI, without unreasonable delay and no later than [N] days after discovery. 5. SUBCONTRACTORS The Business Associate will ensure any subcontractor that handles PHI agrees in writing to the same restrictions and conditions that apply to the Business Associate. 6. INDIVIDUAL RIGHTS The Business Associate will make PHI available so the Covered Entity can meet its duties to give individuals access (45 CFR 164.524), to amend records (45 CFR 164.526), and to provide an accounting of disclosures (45 CFR 164.528). 7. ACCESS BY THE SECRETARY The Business Associate will make its internal practices, books and records relating to PHI available to the Secretary of HHS for determining the Covered Entity's compliance. 8. TERM AND TERMINATION This BAA takes effect on the date above and ends when all PHI is returned or destroyed. The Covered Entity may terminate if the Business Associate materially breaches a term and does not cure it within [N] days. 9. RETURN OR DESTRUCTION OF PHI On termination, the Business Associate will, if feasible, return or destroy all PHI and keep no copies. If return or destruction is not feasible, it will extend these protections to the PHI and limit further use to what makes destruction infeasible. Signed for the Covered Entity: __________ Signed for the Business Associate: __________ Name / title / date

- **Safeguards (clause 3).** For electronic PHI, the business associate must comply with the Security Rule directly, not just promise to be careful. Name the main technical controls if you want certainty.
- **Reporting and breach notice (clause 4).** Set a clear deadline. Many organisations use a short fixed window so they can meet their own breach-notification duties under 45 CFR 164.410.
- **Subcontractors (clause 5).** This flows the same duties down the chain. A gap here is a common source of exposure.
- **Individual rights (clause 6).** The vendor must help the covered entity meet access, amendment, and accounting duties, because the individual's rights do not disappear just because a vendor holds the data.
- **Return or destruction (clause 9).** Decide in advance what "not feasible" means for your systems, such as data held in encrypted backups, and say what protection continues. ## Common mistakes to avoid - Sharing PHI before the BAA is signed, which is itself a violation.
- Relying on the vendor's standard BAA without checking it actually tracks 45 CFR 164.504(e).
- Forgetting subcontractor flow-down, so the chain breaks one level down.
- No cure period or termination right for material breach.
- Treating a BAA as enough on its own. It sits alongside, and does not replace, the services agreement and your own Security Rule risk analysis. ## A note on jurisdiction HIPAA and the BAA are United States concepts. They do not apply outside the US, and a BAA is not the right instrument for data that falls under other regimes. If you process health or personal data of people in the EU or UK, you will usually need a data processing agreement under the GDPR or UK GDPR instead. In India, processing of personal data is governed by the Digital Personal Data Protection Act, 2023 and its rules as they come into force, which call for their own data-processing terms. Where you operate across borders, you may need more than one of these instruments, so treat "a BAA covers us everywhere" as false and map each data flow to the law that governs it. Varies by jurisdiction. ## Where a contract workspace helps A template gets you a compliant BAA. The ongoing work is everything after signing: keeping the same safeguard, breach-notice, and subcontractor terms consistent across dozens of vendor BAAs, checking each incoming vendor draft for terms weaker than 45 CFR 164.504(e), tracking which agreements are signed and which renew, and knowing your return-or-destroy obligations when a vendor leaves. One AI workspace tuned to how your organisation handles PHI can hold the rest: drafting a BAA from your own terms, reviewing an incoming vendor draft for safeguards weaker than 45 CFR 164.504(e) or a missing breach-notice window, and tracking which agreements are signed, which renew, and your return-or-destroy duties when a vendor leaves. [Adira](https://adiralaw.com) is one AI workspace built for teams handling PHI under agreements like this. The template here is enough to put a sound BAA in place; a workspace just makes drafting, review and tracking one connected job.