Can the document be signed electronically?

Yes. Electronic signatures are generally enforceable under the ESIGN Act (15 U.S.C. ch. 96) and UETA where adopted, provided the parties demonstrate intent, consent, attribution, and reliable record retention.

Is a BAA required to share PHI?

Yes. If a vendor will create, receive, maintain, or transmit PHI on behalf of a covered entity, a Business Associate Agreement is required under HIPAA; parties should document obligations and safeguards clearly.

Do I need notarization or witnesses?

Not typically for a BAA itself, but state rules or specific transaction types may require notarization or witnesses. Confirm with state law for deeds, POAs, or other notarized instruments.

How should breaches be reported in the document?

Specify timelines (for example within 24–72 hours of discovery), required contents of the notice, remediation steps, and cooperation obligations so the parties can meet regulatory response duties.

Who should sign on behalf of an organization?

A person with delegated signature authority per the organization’s corporate governance or procurement policy should sign; the document should record the signer’s name, title, and date.

What happens to subcontractors and downstream processors?

The agreement must require flow-down of relevant obligations to subcontractors and maintain oversight; include audit rights and require written assurances before permitting subcontractor access.

Electronic Signature
Templates
Miscellaneous
Business Associate Document

Business Associate Document

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

BUSINESS ASSOCIATE AGREEMENT

This Business Associate Agreement (the "Agreement") is entered into as of by and between Client Name: and Business Associate Name: .

RECITALS

WHEREAS, Client Name is engaged in the provision of business operations and requires certain services to be performed by Business Associate Name that involve access to confidential information; and

WHEREAS, Business Associate Name possesses the expertise and resources necessary to provide the services described herein and acknowledges the confidential nature of Client Name's information and the need to protect such information from unauthorized disclosure; and

NOW, THEREFORE, in consideration of the mutual promises contained herein and other good and valuable consideration, the parties agree as follows.

SCOPE OF WORK

Services to be provided

Business Associate Name shall perform the services set forth above in a timely, professional manner in accordance with industry standards and the specifications provided by Client Name. Any material changes to the scope shall be documented in writing and signed by authorized representatives of both parties.

PAYMENT TERMS

Total payment / Fee Payment schedule and invoicing

Unless otherwise agreed in writing, invoices shall be submitted by Business Associate Name to Client Name in accordance with the payment schedule. Invoices are due and payable within days of receipt. Overdue amounts shall accrue interest at a rate of % per month, or the maximum rate permitted by law, whichever is less.

TERM AND TERMINATION

This Agreement shall commence on and shall continue in effect until unless earlier terminated as provided herein.

Either party may terminate this Agreement for convenience upon written notice delivered no fewer than days to the other party. In addition, either party may terminate immediately for material breach by the other party if such breach remains uncured thirty (30) days after written notice specifying the breach.

CONFIDENTIALITY

For purposes of this Agreement, "Confidential Information" means any non-public information disclosed by Client Name to Business Associate Name that is designated as confidential or which, by its nature, ought reasonably to be treated as confidential.

Business Associate Name shall: (a) use Confidential Information solely to perform its obligations under this Agreement; (b) limit disclosure of Confidential Information to employees, contractors or agents who have a need to know and who are bound by confidentiality obligations at least as protective as those herein; and (c) employ reasonable administrative, physical and technical safeguards to protect Confidential Information from unauthorized use or disclosure.

Confidential Information does not include information that: (i) is or becomes generally available to the public without breach of this Agreement; (ii) was lawfully in Business Associate Name's possession without restriction prior to disclosure by Client Name; or (iii) is rightfully obtained by Business Associate Name from a third party without restriction and without breach of this Agreement.

Return or destruction of materials on termination

The obligations of confidentiality set forth herein shall survive termination or expiration of this Agreement for a period of five (5) years, or longer if required by applicable law, and shall continue with respect to trade secrets for so long as such information remains a trade secret under applicable law.

INDEMNIFICATION AND LIMITATION OF LIABILITY

Each party shall indemnify, defend and hold harmless the other party from and against any third-party claims, liabilities, damages and expenses arising out of the indemnifying party's gross negligence or willful misconduct in performing its obligations under this Agreement.

Except for liability arising from a party's gross negligence, willful misconduct, or breach of confidentiality obligations, neither party's aggregate liability arising under or related to this Agreement shall exceed the total amount paid or payable by Client Name to Business Associate Name under this Agreement in the twelve (12) months preceding the claim.

GOVERNING LAW

This Agreement shall be governed by and construed in accordance with the laws of the State of , without regard to its conflict of law principles.

ENTIRE AGREEMENT

This Agreement, together with any exhibits or amendments executed in writing by both parties, constitutes the entire agreement between the parties with respect to the subject matter hereof and supersedes all prior and contemporaneous agreements, proposals and communications, whether oral or written.

NOTICES

Client notice address Associate notice address

REPRESENTATIONS

Each party represents and warrants that it has the full right, power and authority to enter into this Agreement and to perform its obligations hereunder.

MISCELLANEOUS

If any provision of this Agreement is held to be invalid or unenforceable, the remaining provisions shall remain in full force and effect. No waiver of any breach shall be effective unless in writing and signed by the party waiving the breach.

Client Name:

By:

Date:

Business Associate Name:

By:

Date:

What the Business Associate Document Is and when it matters

A Business Associate Document is a formal written agreement that defines how a party that creates, receives, maintains, or transmits protected information will handle that data on behalf of a covered entity. In U.S. healthcare contexts this commonly takes the form of a Business Associate Agreement (BAA) required under HIPAA when a vendor handles protected health information (PHI). Outside healthcare the term can describe similar contracts allocating data safeguards, permitted uses, liability, reporting obligations, and termination rights between organizations that exchange regulated or sensitive information.

Why a clear Business Associate Document reduces legal and operational risk

A well-drafted Business Associate Document clarifies duties, data safeguards, incident response, and liability allocation so parties understand obligations before protected data is exchanged. It supports regulatory compliance (for example HIPAA) and sets expectations that limit disputes and mitigation costs.

Who prepares and who signs a Business Associate Document

Responsibility usually lands with contracting and compliance leads; final signature authority depends on internal delegation and the dollar or risk threshold.

Healthcare providers and health plans — execute BAAs with vendors that access PHI
IT and cloud service vendors — accept technical and administrative safeguard obligations
Legal and compliance teams — negotiate liability, indemnity, and breach notification terms

Representative roles who complete or approve the document

Jane Smith, Compliance Officer

Typically reviews terms related to data safeguarding, breach notification, and regulatory language. She confirms the document includes required HIPAA provisions, audit rights, and retention obligations before legal review and signature.

Robert Lee, VP of Procurement

Manages commercial terms, indemnity, and insurance requirements. He coordinates cross-functional review, negotiates vendor obligations, and approves execution when representations and insurance requirements meet organizational policy.

Step-by-step: Completing a Business Associate Document

Follow a sequential process to draft, review, and execute the document so obligations and technical safeguards are clearly assigned.

01

1. Draft: Populate parties, scope, and required HIPAA clauses.
02

2. Review: Legal and compliance validate regulatory and indemnity language.
03

3. Approve: Obtain internal approvals from procurement and security.
04

4. Execute: Sign, date, and circulate fully executed copies to all parties.

Where the Business Associate Document goes after completion

Understand routing and record destinations so executed documents are accessible and auditable.

Origin: Drafted by the requesting covered entity or vendor contracting team.
Review Chain: Reviewed by legal, compliance, security, and procurement as required.
Execution: Signed electronically or on paper, with signature metadata retained.
Storage: Stored in contract repository and attached to the vendor record.

Recommended online workflow settings for electronic completion

Configure your e-signature workflow to ensure authentication, auditability, and retention of the executed Business Associate Document.

Field	Configuration
Signer Authentication	Email link + SMS code or SSO for higher assurance
Signature Order	Sequential signing to ensure review before final execution
Audit Trail	Enable detailed logs: IP, timestamps, and signer actions
Document Retention	Save signed PDF/A with certificate of completion

Technical and platform considerations for e-submission

Verify platform-side BAAs, role-based access, and export options before relying on electronic execution for regulated exchanges.

Integrations: Salesforce, NetSuite, Google Workspace, Microsoft 365 compatibility
Formats: Accepts PDF, DOCX, and preserves audit trails
Security: TLS in transit and AES-256 at rest

Core components every Business Associate Document should include

A complete document addresses roles, permitted processing, safeguards, reporting obligations, and lifecycle controls so both parties know operational and legal expectations.

Parties

Identify the covered entity and business associate by full legal name, addresses, and a primary contact for notifications and compliance inquiries.

Scope

Define precisely which categories of data will be accessed, processed, or stored and for which operational purposes, limiting processing to what is necessary.

Permitted Uses

List explicit allowable activities, any resale or marketing prohibitions, and conditions under which the business associate may subcontract processing tasks.

Safeguards

Specify administrative, physical, and technical controls, encryption expectations, access controls, vulnerability management, and regular security assessments.

Breach Response

Define notification timelines, required incident details, remediation responsibilities, and cooperation during investigations to satisfy regulatory and contractual duties.

Termination & Return

Include termination triggers, return or destruction of data procedures, transition assistance, and survival of obligations such as indemnity or confidentiality.

Security and compliance items to verify before signing

Encryption: AES-256 at rest

Transport Security: TLS 1.2/1.3 in transit

Audit Trail: Detailed signer logs

BAA Availability: BAA required for HIPAA

Access Controls: Role-based permissions

Authentication: Multi-factor options

Principal penalties and risks from an incomplete or incorrect document

HIPAA Enforcement: Civil and criminal penalties possible

Contract Liability: Indemnity and damages exposure

Breach Costs: Notification and remediation expenses

Regulatory Fines: State and federal penalties

Operational Disruption: Suspension of data access

Reputational Harm: Loss of customer trust

Common mistakes to avoid when preparing the document

Signing without an executed BAA in place before handing over PHI, which creates immediate compliance exposure and uncertainty about responsibilities and required safeguards.
Using overly broad scope language that permits unlimited use or resale of data rather than narrowly defining processing activities tied to the service.
Omitting clear breach-notification timelines or failing to require specifics in incident reports, which hinders timely remediation and regulatory compliance.
Failing to require subcontractor flow-down obligations so downstream processors are not contractually bound to the same safeguards and reporting duties.

Key timing considerations and deadlines to watch

Capture critical dates to ensure the document is effective at the right time and meets regulatory and operational schedules.

Execution Deadline:

Execute before any exchange of PHI or sensitive data.

Breach Notification Timing:

Specify hours to notify after discovery (commonly 24–72 hours).

Renewal:

Review annually or on contract renewal for scope changes.

Record Retention Start:

Effective date triggers retention periods and audit windows.

Access Request Response:

Define response windows for data access or amendment requests.

Milestones from draft to long-term recordkeeping

Track these stages to ensure the document is properly negotiated, executed, and retained for compliance and audit purposes.

01

Drafting

Create an initial draft including scope, safeguards, and breach language.

02

Review & Approval

Legal and compliance confirm language and risk allocation.

03

Execution

Signatures are collected and fully executed copies distributed.

04

Archival

Store the executed document in a secure contract repository with retention metadata.

Representative vendor pricing and capability comparison for e-signing Business Associate Documents

Price and capability are key factors when choosing a platform for executing Business Associate Documents; below are common plan and feature comparisons across vendors.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	7-day free trial	No	No	No	No
Bulk Send	Yes	Yes	Yes	Yes	No
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes	Yes	Yes	No	No

Frequently asked questions about Business Associate Documents

Answers to common questions about e-signing, enforceability, and compliance when working with Business Associate Documents.

Need help? Contact support

Can the document be signed electronically?
Yes. Electronic signatures are generally enforceable under the ESIGN Act (15 U.S.C. ch. 96) and UETA where adopted, provided the parties demonstrate intent, consent, attribution, and reliable record retention.
Is a BAA required to share PHI?
Yes. If a vendor will create, receive, maintain, or transmit PHI on behalf of a covered entity, a Business Associate Agreement is required under HIPAA; parties should document obligations and safeguards clearly.
Do I need notarization or witnesses?
Not typically for a BAA itself, but state rules or specific transaction types may require notarization or witnesses. Confirm with state law for deeds, POAs, or other notarized instruments.
How should breaches be reported in the document?
Specify timelines (for example within 24–72 hours of discovery), required contents of the notice, remediation steps, and cooperation obligations so the parties can meet regulatory response duties.
Who should sign on behalf of an organization?
A person with delegated signature authority per the organization’s corporate governance or procurement policy should sign; the document should record the signer’s name, title, and date.
What happens to subcontractors and downstream processors?
The agreement must require flow-down of relevant obligations to subcontractors and maintain oversight; include audit rights and require written assurances before permitting subcontractor access.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now