Are electronic signatures acceptable under federal law?

Yes. Electronic signatures are legally enforceable in interstate commerce under the ESIGN Act (15 U.S.C. §7001) and under UETA in most states; ensure intent, consent, signer attribution, and reliable record retention to meet legal validity tests.

Does HIPAA require a BAA for vendors?

Yes. When a vendor handles protected health information on behalf of a covered entity, HIPAA requires a written Business Associate Agreement that specifies permitted uses, safeguards, breach reporting, and subcontractor obligations, consistent with 45 CFR §164.502(e) and §164.504(e).

Who must sign the document to bind the organization?

An authorized representative with authority to bind the organization must sign. For institutions, this is often a CEO, COO, general counsel, or designated privacy/security officer; document the signer's title and authority.

Is a BAA required for subcontractors?

Yes. Any subcontractor that creates, receives, maintains, or transmits PHI on behalf of a business associate must sign a contract imposing the same HIPAA obligations; the primary business associate remains responsible for oversight.

Are notarization or witnesses required for BAAs?

Generally no. BAAs are contracts and rarely require notarization or witnesses. However, state law or organizational policy may require additional authentication for certain agreements. When parties use remote online notarization, retain records consistent with state RON rules.

How can I correct errors after signing?

Errors typically require an amendment or replacement agreement signed by all parties. Minor clerical corrections may be handled by mutual written confirmation; preserve audit trails and consent for any post-signing changes.

Electronic Signature
Templates
Miscellaneous
Business Associates Document

Business Associates Document

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

BUSINESS ASSOCIATES AGREEMENT

This Business Associates Agreement (the Agreement) is made effective as of by and between:

Party One Name Party One Address Party One Entity Type (select any that apply)

Corporation LLC Partnership Other

Party Two Name Party Two Address Party Two Entity Type (select any that apply)

Corporation LLC Partnership Other

WHEREAS

WHEREAS, Party One possesses certain business capabilities, expertise, or services described herein and desires to engage Party Two to perform such services under the terms set forth in this Agreement; and

WHEREAS, Party Two agrees to perform such services for Party One and to receive compensation subject to the obligations of confidentiality, data protection, and mutual indemnification provided in this Agreement.

NOW, THEREFORE, in consideration of the mutual covenants and agreements contained herein, the parties agree as follows.

SCOPE OF WORK

Party Two shall provide services, deliverables, and any agreed materials as described in the Scope of Work. Party Two shall perform services in a professional manner consistent with industry standards and in accordance with any milestones or schedules set forth below.

Detailed Scope of Work

PAYMENT TERMS

In exchange for the Scope of Work, Party One shall pay Party Two the fees and expenses described below. Payment terms are final and binding unless modified by written agreement signed by authorized representatives of both parties.

Total Contract Amount Payment Schedule Late Payment Fee

If any undisputed amount owed is not paid within days of the invoice due date, a late fee of will be applied to the outstanding balance and interest shall accrue at the lesser of the stated late fee or the maximum rate permitted by law.

TERM AND TERMINATION

This Agreement shall commence on and shall continue in full force until unless earlier terminated in accordance with this Section.

Either party may terminate this Agreement for convenience upon written notice to the other party delivered at least days prior to the effective date of termination. Either party may terminate immediately for cause upon written notice if the other party materially breaches this Agreement and fails to cure such breach within thirty (30) days after receipt of written notice specifying the breach, or if insolvency or bankruptcy proceedings are commenced by or against the other party.

Obligations on Termination

CONFIDENTIALITY

Each party (Receiving Party) shall treat as confidential and shall not disclose, use, or permit the use of any Confidential Information of the other party (Disclosing Party) except as necessary to perform its obligations under this Agreement. Confidential Information includes trade secrets, business plans, customer lists, pricing, technical data, and any other information that is identified as confidential or that should reasonably be understood to be confidential given the nature of the information and the circumstances of disclosure.

Confidential obligations shall survive termination of this Agreement for a period of years, except that trade secrets shall remain protected for so long as they meet the legal definition of a trade secret.

INDEMNIFICATION

Each party shall indemnify, defend, and hold harmless the other party and its officers, directors, employees and agents from and against any third-party claims, liabilities, losses, damages, costs and expenses (including reasonable attorneys' fees) arising out of or in connection with the indemnifying party's negligence, willful misconduct, or breach of its representations, warranties or obligations under this Agreement.

GOVERNING LAW

This Agreement shall be governed by and construed in accordance with the laws of the State of without regard to its conflict of law principles. The parties consent to the exclusive jurisdiction of the state and federal courts located in that State for any dispute arising under this Agreement.

ENTIRE AGREEMENT

This Agreement, including any exhibits or attachments expressly incorporated herein, constitutes the entire agreement between the parties with respect to the subject matter hereof and supersedes all prior and contemporaneous agreements, proposals and communications, whether oral or written. No amendment or modification of this Agreement shall be effective unless in writing and signed by authorized representatives of both parties.

NOTICES

All notices, requests, consents, claims, demands and other communications hereunder shall be in writing and addressed to the parties at the addresses set forth below or at such other address that may be designated by a party in writing.

Notice Address for Party One Contact Email for Party One Notice Address for Party Two Contact Email for Party Two

MISCELLANEOUS

If any provision of this Agreement is held to be invalid, illegal or unenforceable in any respect, the validity, legality and enforceability of the remaining provisions shall not in any way be affected or impaired. The parties are independent contractors, and nothing in this Agreement shall create an agency, partnership, joint venture or employment relationship between them.

Additional Provisions or Special Terms

Party One:

By:

Date:

Party Two:

By:

Date:

What the Business Associates Document is and when it applies

The Business Associates Document, commonly called a Business Associate Agreement (BAA), is a written contract used when a HIPAA-covered entity discloses protected health information (PHI) to a vendor or partner that performs services on its behalf. The document defines permitted uses and disclosures of PHI, requires safeguards, mandates breach reporting, and assigns responsibility for subcontractor oversight. It also clarifies recordkeeping and termination obligations. A BAA is distinct from general commercial contracts because it incorporates HIPAA-specific duties and compliance measures required by federal law for handling electronic and paper health information.

Why a clear Business Associates Document matters

A properly drafted Business Associates Document clarifies legal responsibilities for PHI handling, reduces regulatory risk, and sets contractual remedies for breaches. It helps covered entities meet HIPAA requirements and provides business associates with defined operational expectations and data protection obligations.

Who prepares and signs Business Associates Documents

Covered entities, health plans, and vendors that access PHI prepare or request Business Associates Documents to formalize privacy and security obligations.

Hospitals and clinics that share PHI with billing, IT, or analytics vendors.
Health plans contracting data processors for member services and claims adjudication.
Third-party administrators, cloud providers, and business process outsourcers handling PHI.

Smaller vendors should review BAA templates with counsel; organizations often standardize BAAs across vendor onboarding to reduce legal overhead.

Who can sign and who manages compliance

Authorized Officer

An individual legally empowered to bind the organization, such as a CEO, COO, or general counsel. Their signature indicates contractual acceptance of BAA obligations and authorizes operational changes necessary to meet security and reporting duties.

Privacy Officer

Designated privacy or security officer oversees compliance and coordinates breach response. While they may sign for technical aspects, contracting authority may still rest with corporate officers; document signatory authority in BAA.

Essential sections to include in a Business Associates Document

Essential sections of a Business Associates Document ensure compliance, define responsibilities, and provide operational clarity for handling protected health information between contracting parties.

Scope of Services

Describe in detail the services the business associate will perform that involve PHI, including specific data types, processing tasks, permitted uses, and any limitations or excluded activities.

Permitted Uses

List explicit purposes for PHI use and disclosure, prohibiting secondary uses unless expressly permitted and ensuring alignment with HIPAA minimum necessary standards and documented justification for each permitted use.

Security Obligations

Specify required physical, administrative, and technical safeguards, including encryption standards, access controls, logging, vulnerability management, incident response expectations with defined timelines, periodic testing, and third-party assessments.

Breach Notification

Detail breach definition, notification timelines, required content of notices, coordination steps, remediation obligations, HIPAA breach reporting thresholds applicable to covered entities, and requirements for forensic investigation and legal notification duties.

Subcontractors

Require business associates to flow down identical HIPAA obligations to subcontractors, maintain oversight, provide evidence of agreements and compliance upon request, and grant audit rights and corrective action plan access.

Termination Rights

Include termination for material breach, cure periods, steps for return or destruction of PHI, and duties to notify and assist with transition to new providers.

Step-by-step: completing and executing the Business Associates Document

Follow these sequential steps to complete a Business Associates Document accurately and ensure HIPAA obligations and signature validity are documented.

01

Identify Parties: List covered entity and business associate with legal names and contact details.
02

Describe Services: Specify services involving PHI and limits on permitted uses.
03

Security Measures: Describe administrative, physical, and technical safeguards required.
04

Signatures and Dates: Include authorized signer names, titles, and effective date.

How digital execution typically works for BAAs

Typical workflow for executing a Business Associates Document digitally, from drafting to signed archive, including secure delivery and audit trail capture.

Draft and Review: Prepare BAA terms; consult legal counsel.
Attach PHI scope: List data categories and permitted purposes.
eSign and Authenticate: Signer verifies identity; ESIGN compliance captured.
Archive and Audit: Store final agreement with audit trail and retention settings.

Recommended digital workflow settings for BAAs

Configure a digital workflow for BAAs to ensure secure field placement, authentication, and automatic archiving with retention controls.

Field	Configuration
Notification	Email and SMS reminders to sign
Authentication	Use email link with optional SMS code
Document Retention	Archive signed PDF with metadata
Access Controls	Role-based permissions for viewers and editors

Platform capabilities to support compliant BAAs

Use eSignature platforms that support HIPAA controls, detailed audit trails, signer authentication, and the ability to execute and store Business Associates Documents securely.

Supported Formats: PDF, Word (DOCX), and HTML
Integrations: Salesforce, NetSuite, and Google Workspace
Authentication: Email, SMS, or advanced methods

Comparing common eSignature pricing and capabilities for BAAs

Pricing and feature availability vary across vendors; the table summarizes starting price, trial availability, bulk send, audit trail, and HIPAA support for common providers with signNow listed first.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	7-day free trial	No	No	Yes, limited	Yes, limited
Bulk Send	Yes	Yes	Yes	Yes	No
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes	Yes	Yes	No	No

Key timing considerations and deadlines for BAAs

Key deadlines and timing considerations for issuing or updating a Business Associates Document to maintain compliance and limit exposure.

When to Provide BAA:

Provide a signed BAA before any PHI disclosure or onboarding of the vendor.

Signing Deadline:

BAA must be executed prior to service start and PHI access.

Breach Notification Timing:

Notify covered entity without unreasonable delay; report to OCR per HIPAA rules for large breaches.

Review Cycle:

Review BAAs annually or after material changes to services or data processing activities.

Record Requests:

Produce signed BAAs on request for audits and due diligence.

Milestone sequence for drafting, executing, and managing a BAA

Sequential milestones from negotiation to post-execution management for Business Associates Documents, useful in vendor onboarding workflows.

01

Negotiation and Drafting

Negotiate terms, scope, and security obligations with legal review.

02

Execution and Authentication

Obtain authorized signatures and record audit trail details.

03

Operational Onboarding

Configure access controls, encryption, and staff training before PHI exchange.

04

Ongoing Oversight

Conduct audits, review subcontractors, and manage incident responses.

Security and compliance controls to specify in the BAA

Encryption in Transit: TLS 1.2 and TLS 1.3 required

Encryption at Rest: AES-256 encryption at rest

Certifications and Compliance: SOC 2 Type II, ISO 27001, PCI DSS

HIPAA BAA Availability: Business Associate Agreement available

Audit Trail: Comprehensive timestamps, IP addresses, actions

Accessibility Support: WCAG 2.0 Level AA compliance

Contractual and regulatory risks of an incomplete or incorrect BAA

HIPAA Fines: Civil and criminal fines

Contractual Liability: Indemnity for breaches

Operational Disruption: Service suspension risk

Regulatory Investigation: OCR inquiries and audits

Reputational Harm: Loss of trust

Termination: Contract termination rights

Common pitfalls when preparing a Business Associates Document

Vague purpose clauses cause excessive PHI access leading to compliance failures; specify narrow permitted uses tied to services to meet HIPAA minimum necessary standards.
Failing to require subcontractor flow-down obligations leaves covered entities exposed; include audit rights and proof of subcontractor compliance in the BAA.
Using unsigned or improperly executed electronic signatures can undermine enforceability; verify signer identity, record retention, and consent consistent with ESIGN and UETA.
Omitting breach-notification timelines or unclear thresholds delays response and harms mitigation; define timeline, content, and coordination steps for incident handling.

Four practical contract features that improve enforceability

Primary contractual features that make a Business Associates Document enforceable and operationally useful for both covered entities and their vendors.

Permitted Uses

Clearly enumerate permitted uses and disclosures of PHI tied to the vendor's services, including any specific exclusions. Narrow, purpose-linked language prevents overbroad access and supports HIPAA minimum necessary compliance.

Security Controls

Specify encryption, access management, logging, vulnerability testing, and employee training obligations. Define measurable standards, testing frequency, and third-party assessment rights to validate controls.

Breach Procedures

Set notification timelines, content requirements, mitigation steps, forensic investigation expectations, and cooperation duties. Include deadlines for initial notice and detailed follow-up reporting.

Audit Rights

Allow covered entities to audit compliance, request evidence of subcontractor BAAs, and require corrective action plans. Include remediation timelines and access to relevant records for due diligence.

Practical tips to reduce negotiation time and maintain compliance

Practical recommendations to streamline drafting, signing, and managing Business Associates Documents while minimizing compliance risk and administrative burden.

Use Standardized Templates Reviewed by Counsel

Adopt a standard BAA template vetted by legal counsel and update it for state or industry-specific requirements. Standardization reduces negotiation time, ensures consistent security provisions, and helps accelerate vendor onboarding while maintaining legal clarity.

Define Minimum Necessary Access

Limit PHI access to the minimum necessary for each service. Specify data categories, access roles, and monitoring procedures. Regularly review role assignments and revoke access when no longer required to reduce breach exposure.

Document Vendor Due Diligence

Conduct security assessments, obtain SOC 2 reports, verify BAA signatures, and record remediation measures. Keep evidence of ongoing oversight to support audits and regulatory inquiries.

Include Termination and Transition Plans

Specify steps for returning or destroying PHI upon termination, timelines, and assistance for transferring records to successor vendors. Clarify costs and responsibilities to avoid disputes.

Examples: how organizations use digital execution to manage BAAs

Real-world examples show how electronic execution and compliant platforms assist organizations managing PHI and vendor agreements across healthcare and property management.

Fertility Centers of Illinois

Fertility Centers of Illinois moved consent and vendor agreements online to streamline patient paperwork and HIPAA compliance.

Security, audit trails, and API integration were priorities.
John Butler praised responsive support and reliable API capabilities that supported secure execution, documentation retention, and faster turnaround on signed agreements.

Martin Properties

Martin Properties adopted digital signing to close leases and vendor contracts without in-person meetings, improving speed and recordkeeping.

Mobile signing and offline access were important.
Tim Martin reported he could process and execute documents online with compliance and security, enabling remote closings and consistent retention of signed records for audit and operational use.

Frequently asked questions about Business Associates Documents and e-signatures

Answers to common questions about completing, signing, and enforcing a Business Associates Document with attention to HIPAA and e-signature rules.

Need help? Contact support

Are electronic signatures acceptable under federal law?
Yes. Electronic signatures are legally enforceable in interstate commerce under the ESIGN Act (15 U.S.C. §7001) and under UETA in most states; ensure intent, consent, signer attribution, and reliable record retention to meet legal validity tests.
Does HIPAA require a BAA for vendors?
Yes. When a vendor handles protected health information on behalf of a covered entity, HIPAA requires a written Business Associate Agreement that specifies permitted uses, safeguards, breach reporting, and subcontractor obligations, consistent with 45 CFR §164.502(e) and §164.504(e).
Who must sign the document to bind the organization?
An authorized representative with authority to bind the organization must sign. For institutions, this is often a CEO, COO, general counsel, or designated privacy/security officer; document the signer's title and authority.
Is a BAA required for subcontractors?
Yes. Any subcontractor that creates, receives, maintains, or transmits PHI on behalf of a business associate must sign a contract imposing the same HIPAA obligations; the primary business associate remains responsible for oversight.
Are notarization or witnesses required for BAAs?
Generally no. BAAs are contracts and rarely require notarization or witnesses. However, state law or organizational policy may require additional authentication for certain agreements. When parties use remote online notarization, retain records consistent with state RON rules.
How can I correct errors after signing?
Errors typically require an amendment or replacement agreement signed by all parties. Minor clerical corrections may be handled by mutual written confirmation; preserve audit trails and consent for any post-signing changes.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now