Establishing secure connection…Loading editor…Preparing document…

Business Associates Agreement

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

BUSINESS ASSOCIATES AGREEMENT

This Business Associates Agreement ("Agreement") is entered into as of (Effective Date), by and between Company Name: , a business organized at (Company), and Business Associate Name: , with principal place of business at (Business Associate).

WHEREAS

WHEREAS, Company engages Business Associate to perform certain services that may require Business Associate to access, process, or otherwise receive Confidential Information of Company; and

WHEREAS, the parties wish to set forth their respective rights and obligations with respect to Confidential Information, the scope of services to be performed, compensation and the terms of the relationship.

SCOPE OF WORK

Business Associate shall perform the services described below for Company in accordance with the standards and timelines set forth. Business Associate will perform those duties as an independent contractor and not as an employee, partner, or agent of Company.

PAYMENT TERMS

Company shall pay Business Associate for services performed as follows:

Any undisputed invoice not paid within days of receipt shall accrue interest at a rate of % per month, compounded monthly, or the maximum permitted by law, whichever is less.

TERM AND TERMINATION

This Agreement shall commence on and shall continue until , unless earlier terminated in accordance with this Section.

Either party may terminate this Agreement for cause upon written notice if the other party materially breaches any obligation hereunder and fails to cure such breach within days after receipt of written notice. Either party may terminate for convenience upon days' prior written notice.

Upon termination, Business Associate shall deliver to Company all work in progress and all Confidential Information belonging to Company, and Company shall pay Business Associate for all undisputed services performed through the effective date of termination.

CONFIDENTIALITY

For purposes of this Agreement, "Confidential Information" means all non-public information disclosed by Company to Business Associate, whether disclosed orally, in writing, electronically, or by inspection, that is designated as confidential or that reasonably should be understood to be confidential given the nature of the information and the circumstances of disclosure.

Business Associate shall: (a) use Confidential Information solely for the purpose of performing its obligations under this Agreement; (b) restrict disclosure of Confidential Information to those of its employees, contractors or agents who have a need to know and who are bound by confidentiality obligations at least as protective as those herein; and (c) implement and maintain appropriate administrative, technical and physical safeguards to protect Confidential Information from unauthorized access, use or disclosure.

Business Associate shall not disclose Confidential Information to any third party without Company's prior written consent, except as required by law, in which case Business Associate shall provide Company prompt written notice to the extent permitted and cooperate, at Company's expense, in any reasonable effort to obtain a protective order or other appropriate remedy.

Upon termination or expiration of this Agreement, Business Associate shall, at Company's election, return or securely destroy all Confidential Information and certify in writing that such return or destruction has been completed, except for one archival copy kept solely to ensure compliance with recordkeeping obligations; such archival copy shall remain subject to the confidentiality obligations of this Agreement.

LIMITATION OF LIABILITY; INDEMNIFICATION

Each party shall indemnify, defend and hold harmless the other party from and against any third-party claims arising out of the indemnifying party's gross negligence or willful misconduct in the performance of this Agreement. EXCEPT FOR LIABILITY ARISING FROM A PARTY'S GROSS NEGLIGENCE, WILLFUL MISCONDUCT, OR BREACH OF CONFIDENTIALITY, NEITHER PARTY SHALL BE LIABLE TO THE OTHER FOR EXEMPLARY, PUNITIVE, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES.

GOVERNING LAW

This Agreement shall be governed by and construed in accordance with the laws of the State of , without regard to its conflict of laws rules.

ENTIRE AGREEMENT; AMENDMENT

This Agreement (including all exhibits and schedules, if any) constitutes the entire agreement between the parties with respect to the subject matter hereof and supersedes all prior and contemporaneous agreements, proposals and understandings, whether written or oral. No amendment or waiver of any provision of this Agreement shall be effective unless in a written instrument signed by both parties.

NOTICES

All notices required or permitted under this Agreement shall be in writing and delivered to the addresses below by certified mail, overnight carrier, or hand delivery, and shall be effective upon receipt.

MISCELLANEOUS

If any provision of this Agreement is held to be invalid or unenforceable, the remaining provisions shall continue in full force and effect. The parties are independent contractors. Neither party may assign this Agreement without the prior written consent of the other, except that Company may assign to an affiliate or successor by merger or acquisition provided that the assignee assumes the assigning party's obligations hereunder.

Company

Printed Name:

By:

Date:

Business Associate

Printed Name:

By:

Date:

Enter text✕

What a Business Associates Agreement Is and when it applies

A Business Associates Agreement (BAA) is a written contract between a covered entity and a business associate that creates permitted uses and disclosures of protected health information (PHI) and requires the associate to implement safeguards. Under HIPAA, the BAA defines responsibilities for handling PHI, breach notification, and subcontractor flow-down obligations. BAAs are commonly used by healthcare providers, payers, and vendors that create, receive, maintain, or transmit PHI on behalf of a covered entity and are a prerequisite for lawful PHI exchange.

Why a clear BAA matters for compliance and risk control

A precise Business Associates Agreement reduces regulatory risk, documents mutual responsibilities for PHI protection, and supports enforcement recordkeeping under HIPAA (45 CFR §164.504(e)). Electronic execution is generally permitted under the ESIGN Act (15 U.S.C. ch. 96) and state UETA laws when intent, consent, attribution, and retention are satisfied.

Why a clear BAA matters for compliance and risk control

Typical parties and teams involved with a BAA

Final execution typically requires coordination between legal counsel, privacy officers, and an authorized corporate signer to ensure enforceability.

  • Covered entities (hospitals, clinics, health plans) — set PHI sharing rules and require BAAs before transfers.
  • Business associates (IT vendors, billing companies, cloud providers) — must accept obligations and implement safeguards.
  • Legal, privacy, and procurement teams — negotiate scope, liability, and technical controls to reduce exposure.

Who typically signs a Business Associates Agreement

Privacy Officer

Chief Privacy Officers or Data Protection Officers often review and approve BAAs; they verify that the agreement aligns with organizational HIPAA policies and that required safeguards and reporting processes are included.

Authorized Signer

An officer or other person with corporate signing authority must execute the BAA on behalf of each organization; signed titles and delegated authority should be documented to support enforceability.

Essential fields to include in the agreement

Parties: Full legal names
Effective Date: MM/DD/YYYY
Scope: Permitted uses
Safeguards: Administrative, technical
Breach Reporting: Timeline obligations
Subcontractors: Flow-down clause

Core penalties and liabilities to watch for

HIPAA Civil Fines: Administrative penalties
Contract Damages: Indemnity & liability
Breach Notification Costs: Notification expenses
State Penalties: Additional fines
Criminal Liability: Willful misconduct risk
Reputational Harm: Loss of trust

Frequent drafting and implementation mistakes

  • Too-broad or vague scope language that permits unspecified PHI uses and leaves enforcement uncertain.
  • Missing explicit breach-notification timing and procedures, causing delayed regulatory disclosures and penalties.
  • Failure to require subcontractor flow-down obligations and proof of compliance from downstream vendors.
  • Neglecting to document technical safeguards or audit procedures, which complicates incident investigations.

How organizations put BAAs to work in practice

Real-world examples illustrate common outcomes when BAAs are used to manage PHI handling and vendor risk.

Optica Ventures LLC — Operational efficiency

Optica standardized vendor BAAs across locations to reduce turnaround time for vendor onboarding.

  • This reduced legal review cycles and clarified responsibilities for PHI handling.
  • As a result, legal and procurement teams reported fewer exceptions, faster vendor activation, and traceable documentation for audits and investigations.

Fertility Centers of Illinois — Compliance clarity

Fertility Centers formalized BAAs with clinical software vendors before data exchange.

  • The BAA required specific technical safeguards and reporting commitments.
  • That change improved audit readiness and ensured consistent breach-notification procedures when third parties accessed patient records.

Step-by-step: preparing and executing a Business Associates Agreement

Follow these core steps to draft, review, and sign a BAA so PHI can be shared in a compliant manner.

  • 01
    Draft: Specify scope and safeguards
  • 02
    Review: Legal and privacy review
  • 03
    Authorize: Obtain corporate signature
  • 04
    Record: Distribute and store signed copy

Amending or updating an existing BAA

Use a documented amendment process when changing scope, adding subcontractors, or updating technical controls.

01

Identify Change:

Describe the specific amendment needed
02

Draft Amendment:

Prepare clear modification language
03

Internal Approval:

Obtain legal and privacy sign-off
04

Execute Amendment:

Obtain signatures from both parties
05

Distribute:

Send updated agreement copies
06

Archive:

Keep versioned records

Where to send and store completed BAAs

After execution, route the signed BAA to legal, privacy, vendor management, and records systems to ensure enforceability and auditability.

  • Legal Department: Maintain executed originals
  • Privacy or Compliance: Track obligations and audit dates
  • Vendor Management: Link agreement to vendor profile
  • Document Storage: Store signed PDF in DMS

Digital signing and technical delivery considerations

Ensure the chosen platform can meet HIPAA BAA requirements and retains records in a format suitable for audits and legal discovery.

  • Authentication: Support email, SMS code, or stronger MFA
  • Audit Trail: Capture timestamps, IPs, and signer events
  • File Formats: Export signed PDF/A and store metadata

Configuring an online BAA workflow

Set up an eSigning workflow that enforces signer order, collects identity evidence, and preserves an auditable trail.

Field Configuration
Authentication Email + optional SMS code
Audit Trail Enabled with timestamps
Templates Save reusable BAA template
Subcontractor Clause Require signature and flow-down

eSignature vendor comparison for executing BAAs

Pricing and core capabilities vary between providers; the table compares starting price, trial options, bulk send, audit trail, HIPAA support, and envelope limits.

signNow DocuSign Adobe Sign PandaDoc HelloSign
Starting Price $8/user/mo $15/user/mo $14/user/mo $19/user/mo $15/user/mo
Free Trial 7-day free trial Varies Varies Varies Varies
Bulk Send Yes Yes Yes Yes No
Audit Trail Yes Yes Yes Yes Yes
HIPAA Compliant Yes Yes Yes No No
Envelope Cap No cap 100 envelopes/user/year No cap No cap No cap

Key sections that make a BAA enforceable and practical

A professional BAA is structured around clear obligations, incident handling, data controls, and termination rights to make compliance demonstrable.

Definitions

Define PHI, Covered Entity, Business Associate, and Subcontractor; clarity avoids interpretive disputes during audits and incidents.

Permitted Uses

List permitted uses and disclosures of PHI—avoid open-ended language and tie uses to specific services or operations.

Safeguards

Specify administrative, physical, and technical safeguards, including encryption, access controls, and logging expectations for PHI.

Breach Notification

Require prompt reporting, investigation cooperation, and timelines for notifying the covered entity and regulatory authorities when required.

Subcontractor Flow-down

Require business associates to impose equivalent obligations on subcontractors and to provide lists of subcontractors on request.

Termination and Remedies

Include termination rights for material breaches and obligations for return or destruction of PHI upon termination.

Document formats and export options for executed BAAs

Use standard, long-term formats for storing executed BAAs and supporting metadata to simplify future audits and e-discovery.

Signed PDF

Create a tamper-evident PDF with an embedded audit trail and signer certificate for evidentiary support.

PDF/A Archive

Store in PDF/A format for long-term preservation and consistent rendering across systems.

Export Metadata

Include signer names, timestamps, IP addresses, and signing method in exportable metadata.

Native Document

Keep the editable master (DOCX) as part of the contract record for amendment history.

Authentication, signature authority, and evidence steps

While BAAs do not generally require notarization, follow a clear signer authentication and authority verification workflow to strengthen enforceability.

01

Verify Signer

Confirm identity via corporate email and records

02

Check Authority

Confirm signer's title and delegation

03

Use MFA

Apply multi-factor authentication if available

04

Record Audit

Capture timestamps, IPs, and actions

05

Maintain Logs

Preserve audit logs for retention period

06

Subcontractor Signatures

Require signed flow-downs where applicable

07

Corporate Resolution

Attach resolution if signer authority is unclear

08

Evidence Package

Bundle signed PDF and metadata for audits

Frequently asked questions about Business Associates Agreements

Answers to common points of confusion when drafting, signing, and storing BAAs, with references to legal requirements and practical steps.


Need help? Contact support

be ready to get more
Join over 28 million airSlate SignNow users