What Is a HIPAA Business Associate Agreement?
A HIPAA Business Associate Agreement (BAA) is a federally required written contract between a HIPAA-covered entity and a business associate — any vendor or contractor that creates, receives, maintains, or transmits protected health information (PHI) on behalf of the covered entity. The BAA is mandated by 45 C.F.R. §§ 164.502(e) and 164.504(e) of the HIPAA Privacy Rule, and by corresponding provisions of the Security Rule for electronic PHI. Without a signed BAA in place, any disclosure of PHI to a vendor is itself a HIPAA violation — even if the vendor treats the information carefully.
Covered entities under HIPAA include healthcare providers that transmit health information electronically in connection with certain transactions (doctors, hospitals, clinics, pharmacies, dentists), health plans (insurers, HMOs, Medicare and Medicaid programs), and healthcare clearinghouses. Business associates are the third parties these entities hire to perform services involving PHI — billing companies, cloud hosting providers, EHR vendors, medical transcription services, IT consultants, attorneys, accountants, shredding companies, and many others. The HITECH Act of 2009 and the 2013 Omnibus Rule extended business-associate obligations directly to subcontractors, so a business associate must enter into its own BAA with any vendor it hires to handle PHI on its behalf.
The BAA must contain specific provisions mandated by federal regulation. These include: the permitted and required uses of PHI; a prohibition on uses or disclosures beyond what the contract or law allows; an obligation to implement appropriate administrative, physical, and technical safeguards; a duty to report any impermissible use or disclosure, including breaches of unsecured PHI; a flow-down requirement for subcontractors; obligations to support individual rights (access, amendment, accounting of disclosures); a duty to make records available to HHS for compliance reviews; and an obligation to return or destroy PHI upon termination. A BAA that omits any of these required elements does not satisfy HIPAA and leaves both parties exposed.
Our HIPAA BAA templates are drafted to include every federally required provision, match the structure HHS Office for Civil Rights expects, and incorporate breach-notification timing that gives the covered entity enough runway to meet its own 60-day reporting deadline. They work for cloud vendors, billing services, EHR providers, transcription services, IT consultants, and the full range of business-associate relationships.
Federally Required
Mandatory under HIPAA Privacy and Security Rules.
Protects PHI
Establishes safeguards for electronic and paper patient data.
Avoids Penalties
Protects against HHS OCR enforcement and civil penalties.
HIPAA BAA Form Preview
Business Associate Agreement
HIPAA Privacy & Security Rule Compliance
Parties
Required Provisions
When a HIPAA BAA Is Required
A BAA is required whenever a covered entity or existing business associate engages a third party that will create, receive, maintain, or transmit PHI.
Cloud & IT Vendors
Cloud hosting, backup, and IT service providers that store, process, or transmit PHI on behalf of covered entities.
Billing & Claims
Medical billing companies, clearinghouses, and revenue-cycle vendors handling claims and payment information containing PHI.
EHR & Practice Management
Electronic health record vendors and practice management software providers processing patient records.
Transcription Services
Medical transcription and scribing services that receive patient encounter information.
Legal & Accounting
Outside counsel and accounting firms receiving PHI in the course of providing professional services to a healthcare client.
Shredding & Records
Document destruction, storage, and records-management vendors handling physical or digital PHI.
HIPAA BAA vs Standard NDA
| Factor | HIPAA BAA | Standard NDA |
|---|---|---|
| Required By | Federal law (HIPAA) | Voluntary contract |
| Covers | Protected health information | General confidential information |
| Required Provisions | Mandated by 45 CFR 164.504(e) | Flexible |
| Breach Notification | Required within 60 days | Contract-based |
| Penalties | Up to $2M+/year per violation | Contract damages |
| Enforcement | HHS OCR, state AGs | Private litigation |
How to Create a HIPAA BAA
Identify covered entity and business associate
Use exact legal names. Confirm whether each party is a covered entity, business associate, or subcontractor.
Describe the services and PHI involved
Specify what PHI the business associate will handle and for what purpose.
Include all required provisions under 45 CFR 164.504(e)
Permitted uses, safeguards, reporting, subcontractors, individual rights, HHS access, return/destruction, termination.
Set breach notification timing
Specify when the BA must notify the covered entity — often 10–30 days to allow the covered entity to meet its own 60-day HHS deadline.
Address subcontractor flow-down
Require the business associate to execute BAAs with any subcontractors handling PHI.
Include termination and cure rights
Allow the covered entity to terminate if the business associate materially breaches.
Sign with authorized representatives
Execute before any actual disclosure of PHI. Electronic signatures are enforceable.
Required Provisions Under 45 C.F.R. § 164.504(e)
Permitted Uses and Disclosures
What the BA may do with PHI and for what purpose.
Safeguards
Administrative, physical, and technical protections for PHI, including ePHI under the Security Rule.
Impermissible Use Reporting
Report any use or disclosure not allowed by the contract, including security incidents.
Subcontractor Flow-Down
Ensure subcontractors agree to same terms through their own BAAs.
Individual Rights Support
Access, amendment, and accounting of disclosures.
HHS Access
Make internal practices, books, and records available to HHS for compliance review.
Return or Destruction
Return or destroy PHI at termination if feasible; if not, extend protections.
Termination for Breach
Covered entity may terminate for material breach.
Breach Notification
Timing and content of breach notices under the Breach Notification Rule.
Minimum Necessary Rule
Use, disclose, and request only the minimum PHI needed.
What Is Protected Health Information
PHI is individually identifiable health information in any form — electronic, paper, or oral — that relates to a person's past, present, or future physical or mental health, the provision of healthcare, or payment for healthcare. It includes the 18 identifiers under the HIPAA Safe Harbor de-identification method: name, address, dates (except year), phone, fax, email, SSN, medical record number, health plan number, account number, certificate/license number, vehicle ID, device ID, URL, IP address, biometric identifiers, photographs, and any other unique identifier. When stored or transmitted electronically, PHI is called ePHI and is subject to the HIPAA Security Rule.
Breach Notification Rules
Under 45 C.F.R. Part 164 Subpart D, a business associate must notify the covered entity of a breach of unsecured PHI without unreasonable delay and no later than 60 days after discovery. The covered entity then has 60 days from discovery to notify affected individuals, HHS, and (for breaches affecting 500+ individuals) prominent media. Well-drafted BAAs impose a tighter internal deadline — often 10 to 30 days — so the covered entity has adequate time to comply with its own notification obligations.
Penalties for Non-Compliance
HIPAA civil penalties are tiered from approximately $137 per violation for unknowing breaches up to more than $2 million per identical-provision-per-year for willful neglect not corrected (2024 inflation-adjusted amounts). Criminal penalties reach $250,000 and 10 years in prison for wrongful disclosure for commercial advantage. HHS Office for Civil Rights and state attorneys general actively enforce HIPAA; multi-million-dollar settlements with business associates have become routine.
Sample HIPAA Business Associate Agreement
BUSINESS ASSOCIATE AGREEMENT
This Business Associate Agreement ("Agreement") is entered into as of [Effective Date] between [Covered Entity] ("Covered Entity") and [Business Associate] ("Business Associate"), pursuant to 45 C.F.R. § 164.504(e).
1. DEFINITIONS
Capitalized terms used but not defined in this Agreement shall have the meanings given in the HIPAA Rules (45 C.F.R. Parts 160 and 164), including "Breach," "Protected Health Information" (PHI), "Electronic Protected Health Information" (ePHI), and "Unsecured Protected Health Information."
2. PERMITTED USES AND DISCLOSURES
Business Associate may use and disclose PHI only as necessary to perform the services set forth in the underlying services agreement and as required by law. Business Associate shall not use or disclose PHI in any manner that would violate Subpart E of 45 C.F.R. Part 164 if done by Covered Entity.
3. SAFEGUARDS
Business Associate shall implement and maintain appropriate administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of ePHI in accordance with the HIPAA Security Rule (45 C.F.R. Part 164 Subpart C).
4. REPORTING OF BREACHES
Business Associate shall report to Covered Entity any Breach of Unsecured PHI without unreasonable delay and in no event later than [10] days after discovery. The report shall include the information required by 45 C.F.R. § 164.410(c).
5. SUBCONTRACTORS
Business Associate shall ensure that any subcontractor that creates, receives, maintains, or transmits PHI on behalf of Business Associate agrees in writing to the same restrictions, conditions, and requirements that apply to Business Associate under this Agreement.
6. INDIVIDUAL RIGHTS
Business Associate shall make PHI available to Covered Entity as needed to fulfill Covered Entity's obligations to provide individuals with access under § 164.524, amendment under § 164.526, and an accounting of disclosures under § 164.528.
7. TERMINATION
Upon termination, Business Associate shall return to Covered Entity or destroy all PHI received from or created on behalf of Covered Entity and retain no copies. If return or destruction is infeasible, Business Associate shall extend the protections of this Agreement to such PHI and limit further uses and disclosures.
8. HHS ACCESS
Business Associate shall make its internal practices, books, and records relating to the use and disclosure of PHI available to the Secretary of HHS for purposes of determining compliance with the HIPAA Rules.
Frequently Asked Questions
Official Resources
HHS - Business Associates Guidance
Official HHS Office for Civil Rights guidance on business associates.
HHS - Sample BAA Provisions
Sample business associate agreement provisions from HHS OCR.
HHS - Breach Notification Rule
Federal breach notification requirements.
45 C.F.R. Part 164
Full text of HIPAA Privacy, Security, and Breach Notification Rules.
HHS - HIPAA Security Rule
Administrative, physical, and technical safeguards for ePHI.
CMS - Centers for Medicare & Medicaid
Additional healthcare compliance resources.
NIST - Healthcare Cybersecurity
NIST guidance on safeguarding electronic health information.
HHS OCR Breach Portal
Official portal for reporting HIPAA breaches.
Create your Business Associate Non Disclosure Agreement in under 10 minutes.
Answer a few questions and download a compliant, attorney-drafted document ready for your state.