Can a BAA be signed electronically?

Yes. Electronic signatures are legally binding under the federal ESIGN Act (15 U.S.C. ch. 96) and UETA in most jurisdictions, provided the signature demonstrates intent, consent, attribution, and reliable record retention.

Is a BAA required for cloud vendors?

If the vendor will create, receive, maintain, or transmit PHI on behalf of a covered entity, a signed BAA is required under HIPAA and related regulations to assign responsibilities and safeguards.

Who must sign the BAA?

An authorized officer or representative with legal authority to bind the organization should sign. Verify signer authority in corporate records to avoid disputes.

Can I revoke or terminate a BAA?

Yes. Termination mechanics should be in the agreement. Post-termination obligations typically include returning or securely destroying PHI and preserving records for applicable retention periods.

Does the vendor need to sign a separate BAA for subcontractors?

Yes. Business associates must require subcontractors to agree to the same restrictions and conditions in writing (flow-down BAAs) before PHI is disclosed to them.

What records should we keep?

Retain executed BAAs, audit trails, breach notices, and related onboarding records per federal and industry retention rules; HIPAA-related documents generally require six years (45 CFR §164.530(j)).

Electronic Signature
Templates
Miscellaneous
Business Agreement Form BAA

Business Agreement Form BAA

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

BUSINESS AGREEMENT FORM BAA

This Business Agreement ("Agreement") is entered into as of Effective Date: by and between:

Party A (Provider)

Legal Name Entity Type

Individual Corporation Limited Liability Company Partnership

Address Contact Email

Party B (Client)

Legal Name Entity Type

Individual Corporation Limited Liability Company Partnership

Address Contact Email

Recitals

WHEREAS, Party A provides business services, consulting, and deliverables in the ordinary course of its business; and

WHEREAS, Party B desires to engage Party A to perform the services described below under the terms and conditions set forth in this Agreement; and

WHEREAS, Party A represents that it has the experience, personnel, and qualifications necessary to perform such services and will perform in a commercially reasonable manner consistent with prevailing standards in the industry.

Scope of Work

Party A shall perform the services and deliverables described below. The parties may attach additional statements of work as addenda which, when executed by both parties, shall be incorporated into this Agreement.

Describe Services and Deliverables

Payment Terms

Party B shall pay Party A the compensation set forth below in consideration for the services and deliverables.

Total Contract Amount Payment Schedule / Milestones Late Payment Fee

All invoices are due within the payment terms set forth above. Any payment not received within the stated period shall accrue interest at the Late Payment Fee rate and shall be payable by Party B, together with all costs of collection, including reasonable attorneys' fees.

Term and Termination

This Agreement shall commence on Start Date: and shall continue until End Date: unless earlier terminated in accordance with this section.

Termination Notice Period

Either party may terminate this Agreement for material breach by the other party if such breach remains uncured thirty (30) days after written notice. Termination shall not relieve either party of obligations accrued prior to the effective date of termination, including payment for services rendered and reimbursable expenses.

Confidentiality

For purposes of this Agreement, "Confidential Information" means non-public information disclosed by one party to the other, whether oral, written, electronic, or any other form, including but not limited to business plans, financial information, customer lists, technical data, trade secrets, and pricing. Confidential Information does not include information that: (a) is or becomes generally available to the public other than as a result of a breach of this Agreement; (b) was known to the receiving party prior to disclosure by the disclosing party; (c) is independently developed by the receiving party without use of Confidential Information; or (d) is received from a third party who lawfully acquired it and who is under no obligation restricting its disclosure.

The receiving party shall: (i) hold Confidential Information in strict confidence; (ii) use the same degree of care it uses to protect its own confidential information, but no less than reasonable care; and (iii) not disclose Confidential Information to any third party except to its employees, agents, or professional advisors who have a need to know and are bound by confidentiality obligations at least as protective as those set forth herein. The obligations in this section shall survive termination or expiration of this Agreement for a period of three (3) years, except that trade secrets shall be protected for as long as they remain trade secrets under applicable law.

Governing Law

This Agreement shall be governed by and construed in accordance with the laws of the State of without regard to principles of conflicts of law. The parties agree that the state and federal courts located in that State shall have exclusive jurisdiction over any dispute arising out of or relating to this Agreement.

Representations; Entire Agreement

Each party represents and warrants that it has the full power and authority to enter into this Agreement and to perform its obligations hereunder. Each party further represents that the execution and delivery of this Agreement and the performance of its obligations hereunder have been duly authorized.

This Agreement, including any executed addenda or statements of work expressly incorporated herein, constitutes the entire agreement between the parties with respect to the subject matter hereof and supersedes all prior and contemporaneous agreements, proposals, negotiations, representations, and understandings, whether written or oral. Any modification or amendment to this Agreement must be in writing and signed by authorized representatives of both parties.

Remedies; Limitation of Liability

Except for liability arising from a party's gross negligence, willful misconduct, or breach of confidentiality, neither party shall be liable to the other for incidental, consequential, special, or punitive damages. Each party's aggregate liability for claims arising out of or related to this Agreement shall not exceed the total fees paid by Party B to Party A under this Agreement during the preceding twelve (12) months.

Notices

All notices required or permitted under this Agreement shall be in writing and delivered to the contact addresses set forth above or to such other address as either party may designate by written notice. Notice shall be effective upon receipt.

Party A (Provider) - Print Name:

By:

Date:

Party B (Client) - Print Name:

By:

Date:

What the Business Agreement Form BAA Is

The Business Agreement Form BAA (commonly called a Business Associate Agreement) is a written contract used when a HIPAA-covered entity engages a vendor, contractor, or partner that will create, receive, maintain, or transmit protected health information (PHI). The BAA documents permitted uses and disclosures, requires safeguards, assigns breach-notification duties, and allocates responsibility for compliance. Although directed at HIPAA-regulated relationships, BAAs also set data handling expectations, confidentiality obligations, and liability limits that inform risk management across operations and technology vendors.

Why a Proper Business Agreement Form BAA Matters

A correctly executed BAA is central to HIPAA compliance, clarifies responsibilities for PHI protection, and reduces regulatory and contractual risk under 45 CFR Part 160–164 and related state laws.

Who Completes and Signs a Business Agreement Form BAA

Entering a BAA is standard when a covered entity or business associate shares PHI with a contractor, vendor, or subcontractor; the agreement must be signed before PHI exchange begins.

Covered entities: hospitals, clinics, health plans, and clearinghouses that outsource services involving PHI.
Business associates: cloud vendors, billing firms, IT support, and other service providers handling PHI on behalf of a covered entity.
Subcontractors: downstream vendors who receive PHI from a business associate and require the same contractual safeguards.

Core Components to Include in a Professional Business Agreement Form BAA

A compliant BAA should be precise about permitted uses, required safeguards, breach obligations, subcontractor flow-downs, term and termination, and liability limits.

Permitted Uses

Define exactly what PHI the business associate may access and for what operational or contractual purposes.

Safeguards

Specify administrative, technical, and physical controls required to protect PHI, consistent with HIPAA Security Rule expectations.

Breach Notification

Assign timelines and procedures for notifying the covered entity and support forensic and regulatory response.

Subcontractors

Require flow-down BAAs for any subcontractor that will create, receive, or handle PHI on behalf of the business associate.

Term & Termination

State when the agreement starts, how it may be ended, and post-termination disposition of PHI.

Liability & Indemnity

Allocate responsibility for breaches, regulatory fines, and third-party claims, including any insurance requirements.

Required Fields and Data Elements in the Business Agreement Form BAA

Parties: Legal entity names

Effective Date: MM/DD/YYYY

Scope: Permitted PHI uses

Contact: Security and privacy officer contact

Term: Start and end terms

Signature: Authorized signer name and title

Step-by-Step: Completing and Executing a Business Agreement Form BAA

Follow a consistent sequence to prepare, review, execute, and store the BAA to reduce legal and operational gaps.

01

Draft: Populate parties, scope, and safeguards.
02

Legal Review: Have counsel verify HIPAA obligations and liability language.
03

Signatory Approval: Confirm authorized signers and countersignatures.
04

Execute & Store: Execute, record date, and place signed copy in secure records.

How to Configure an Online BAA Workflow

Set up routing, authentication, and retention rules before sending the BAA for signature to ensure compliant handling of PHI-related contracts.

Field	Configuration
Routing Order	Sequential signer order with required fields
Authentication	Email + SMS code or stronger MFA for signer identity
Document Retention	Automated secure storage with access controls
Audit Trail	Enable full event logging and downloadable certificate

Digital Signing and eSubmission Requirements

Choose an eSignature platform that supports HIPAA, detailed audit trails, secure storage, and appropriate signer authentication.

Authentication: Email + optional SMS/KBA
Encryption: TLS 1.2/1.3 in transit
At-Rest Security: AES-256 encryption

Where to Send or File a Business Agreement Form BAA

Routing the executed BAA to the correct internal and external contacts ensures enforceability and prepares teams for operational onboarding.

Recipient: Legal or privacy officer at the covered entity
Vendor: Authorized signer at the business associate
Records: Secure contract repository with restricted access
Operational Teams: IT and compliance teams for onboarding tasks

Key Timelines, Deadlines, and Processing Expectations

Track effective dates, renewal windows, and breach-notification deadlines to maintain operational and regulatory compliance.

Effective Date:

Start date determines contractual obligations

Breach Notice:

Specify notification timeframe (commonly 72 hours)

Annual Review:

Schedule yearly policy and BAA review

Termination Notice:

Contractual notice period for termination events

Record Retention:

Retention obligations for signed BAAs

Penalties and Risks of an Incorrect or Missing BAA

HIPAA Fines: Civil penalties and corrective action obligations

Breach Liability: Financial exposure for PHI breaches

Contract Disputes: Unclear duties can lead to litigation

Data Loss: Operational disruption from inadequate controls

Regulatory Scrutiny: Increased audits from regulators

Reputational Harm: Loss of trust following incidents

Common Mistakes When Preparing a Business Agreement Form BAA

Using vague scope language that fails to limit PHI use and disclosure.
Failing to require subcontractor flow-down BAAs for downstream vendors.
Delaying signature until after PHI exchange begins, creating exposure.
Omitting breach notification timelines or practical response procedures.

eSignature Vendor Comparison for Executing the Business Agreement Form BAA

Choose an eSignature provider that meets HIPAA, audit trail, and authentication needs; the table compares typical plan entry points and core features.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	7-day free trial	Varies by vendor	Varies by vendor	Varies by vendor	Varies by vendor
Bulk Send	Yes	Yes	Yes	Yes	No
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes	Yes	Yes	No	No
Envelope Cap	No cap	100 envelopes/user/year	Varies by plan	Varies by plan	Varies by plan

Practical Examples of Business Agreement Form BAA Use

Real-world examples show how BAAs support vendor onboarding, cloud services, and subcontractor relationships.

Optica Ventures (COO)

Optica used a standard BAA for cloud-hosted patient referral services

The BAA defined encryption and access controls
The agreement simplified audits and clarified breach response roles across vendors and the covered entity.

Fertility Centers of Illinois (Founder)

A clinic adopted digital BAAs for remote vendors

The platform provided audit trails and secure retention
This reduced turnaround time for vendor onboarding while preserving HIPAA compliance documentation.

Tips for Accurate and Efficient Completion of the Business Agreement Form BAA

Follow consistent drafting and execution practices to reduce rework and preserve enforceability.

Use Standard Templates

Start with a vetted BAA template and tailor only necessary clauses to reduce legal review time and ensure consistency.

Pre-Authorize Signers

Confirm authorized signer names and titles in advance to avoid signature delays and potential invalidation.

Require Flow-Downs

Mandate subcontractor BAAs when vendors engage downstream providers handling PHI to maintain an unbroken compliance chain.

Retain Audit Trails

Keep complete signing certificates, timestamps, and access logs to support investigations and regulatory inquiries.

Frequently Asked Questions About the Business Agreement Form BAA

Answers to common questions about BAA scope, signing, revocation, electronic execution, and storage to help practical compliance.

Need help? Contact support

Can a BAA be signed electronically?
Yes. Electronic signatures are legally binding under the federal ESIGN Act (15 U.S.C. ch. 96) and UETA in most jurisdictions, provided the signature demonstrates intent, consent, attribution, and reliable record retention.
Is a BAA required for cloud vendors?
If the vendor will create, receive, maintain, or transmit PHI on behalf of a covered entity, a signed BAA is required under HIPAA and related regulations to assign responsibilities and safeguards.
Who must sign the BAA?
An authorized officer or representative with legal authority to bind the organization should sign. Verify signer authority in corporate records to avoid disputes.
Can I revoke or terminate a BAA?
Yes. Termination mechanics should be in the agreement. Post-termination obligations typically include returning or securely destroying PHI and preserving records for applicable retention periods.
Does the vendor need to sign a separate BAA for subcontractors?
Yes. Business associates must require subcontractors to agree to the same restrictions and conditions in writing (flow-down BAAs) before PHI is disclosed to them.
What records should we keep?
Retain executed BAAs, audit trails, breach notices, and related onboarding records per federal and industry retention rules; HIPAA-related documents generally require six years (45 CFR §164.530(j)).

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now