What is a BAA and when is it required?

A Business BAA Document is a contract required when a vendor will create, receive, maintain, or transmit PHI on behalf of a HIPAA-covered entity. It documents permitted uses, safeguards, and breach responsibilities under HIPAA privacy and security rules.

Who must sign the Business BAA Document?

An authorized representative of the covered entity and an authorized representative of the business associate must sign. Signatures should come from persons with authority to bind each organization to contractual and compliance obligations.

Are subcontractors required to have BAAs?

Yes. Subcontractors that handle PHI must be contractually bound through a flow-down clause or a separate Business BAA Document so that the covered entity’s protections extend to downstream processors.

Does the BAA need to be notarized or witnessed?

Notarization is not generally required for BAAs and has no effect on HIPAA enforceability. Verify state or contract-specific requirements, but a signed, dated contract with intent and attribution is usually sufficient.

How do I revoke or amend a signed BAA?

Follow the amendment and termination provisions in the Business BAA Document. Typically amendments must be in writing and signed; termination clauses specify notice periods and post-termination obligations for PHI.

How long should I keep signed BAAs?

Retain BAAs to meet HIPAA retention guidance: generally six years from creation or last effective date (45 CFR §164.530(j)), and follow any longer state-specific retention rules.

Business BAA Document

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

BUSINESS ASSOCIATE AGREEMENT

This Business Associate Agreement (the Agreement) is entered into as of Effective Date: by and between Covered Entity Name: and Business Associate Name: .

WHEREAS

WHEREAS, Covered Entity maintains certain individually identifiable health information that is protected under applicable law and requires services from Business Associate that may involve access to such information; and

WHEREAS, Business Associate provides professional services to Covered Entity and, in the course of those services, will create, receive, maintain, or transmit Protected Health Information (PHI) as defined below; and

WHEREAS, the parties intend to establish the permitted uses and disclosures of PHI, the safeguards required to protect PHI, and the respective obligations of the parties with respect to PHI.

DEFINITIONS

For purposes of this Agreement, the following terms have the meanings set forth in this section. "Protected Health Information" or "PHI" means individually identifiable health information transmitted or maintained in any form that is created or received by Business Associate from or on behalf of Covered Entity and that is protected under applicable law.

SCOPE OF WORK

Describe Services and Handling of PHI

PERMITTED USES, DISCLOSURES, AND OBLIGATIONS

Business Associate may use and disclose PHI only as required to perform the services set forth in the Scope of Work and as permitted by this Agreement. Business Associate shall not use or disclose PHI in a manner that would violate applicable law if done by Covered Entity.

Business Associate agrees to implement administrative, physical and technical safeguards appropriate to the size and complexity of the entity and the nature of the PHI to prevent use or disclosure of PHI other than as provided for by this Agreement.

Use of Subcontractors

Business Associate may engage subcontractors to perform services that involve PHI only with Covered Entity's prior written authorization and only if Business Associate obtains satisfactory assurances from the subcontractor that it will appropriately safeguard PHI.
Authorized to subcontract:

BREACH NOTIFICATION AND MITIGATION

Business Associate shall report to Covered Entity any use or disclosure of PHI not permitted by this Agreement, or any security incident or suspected breach affecting PHI, without unreasonable delay and in no event later than days after discovery. Business Associate's notice shall include the nature of the breach, the PHI involved, actions taken to mitigate harm, and measures to prevent recurrence.

ACCESS, AMENDMENT, AND ACCOUNTING

To the extent Business Associate maintains PHI in a designated record set, Business Associate will provide access, amendments, and an accounting of disclosures to Covered Entity, or directly to individuals as required by applicable law, in a timely manner and in accordance with Covered Entity's policies.

RETURN OR DESTRUCTION OF PHI

Upon termination of this Agreement for any reason, Business Associate shall return or securely destroy all PHI received from Covered Entity that Business Associate still maintains in any form. If return or destruction is infeasible, Business Associate shall extend protections of this Agreement to such PHI and limit further uses and disclosures.

PAYMENT TERMS

Contracted Fee Amount Payment Schedule / Invoicing Late Payment Fee Invoices Sent To

TERM AND TERMINATION

This Agreement shall commence on Start Date: and shall terminate on End Date: unless earlier terminated in accordance with this section.

Termination Notice Period (days)

Covered Entity may terminate this Agreement immediately if Business Associate materially breaches any provision and fails to cure within the notice period specified above. Either party may terminate for convenience upon the notice period.

CONFIDENTIALITY

All PHI and other confidential information received from Covered Entity shall be used solely for the purposes set forth in this Agreement. Business Associate shall restrict access to such information to employees, agents, and subcontractors who need access to perform the services and who are subject to confidentiality obligations at least as protective as those in this Agreement.

Business Associate shall not disclose PHI to any third party except as permitted herein or as required by law, and shall limit disclosures to the minimum necessary to accomplish the intended purpose.

INDEMNIFICATION

Each party shall indemnify, defend and hold harmless the other party from and against any claims, liabilities, losses or damages (including reasonable attorneys' fees) arising from the indemnifying party's breach of this Agreement, applicable law, or negligent acts or omissions.

GOVERNING LAW

State Governing Law

This Agreement will be governed by and construed in accordance with the laws of the State specified above, without regard to conflict of law principles.

ENTIRE AGREEMENT

This Agreement constitutes the entire understanding between the parties with respect to the subject matter hereof and supersedes all prior or contemporaneous agreements, representations, and understandings, whether written or oral, regarding the subject matter. No amendment or waiver of any provision of this Agreement shall be effective unless in writing and signed by both parties.

MISCELLANEOUS

If any provision of this Agreement is found to be invalid or unenforceable, the remaining provisions will remain in full force and effect. Neither party may assign this Agreement without the prior written consent of the other, except to a successor in interest in connection with a merger or sale of substantially all assets.

Covered Entity

Party Label:

By:

Date:

Business Associate

Party Label:

By:

Date:

What a Business BAA Document Is and Why It Matters

The Business BAA Document is a Business Associate Agreement that sets contractual duties between a HIPAA-covered entity and any vendor or partner that creates, receives, maintains, or transmits protected health information (PHI). It defines permitted uses and disclosures of PHI, required administrative, physical, and technical safeguards, breach notification timelines, and subcontractor flow-down requirements, and it allocates liability and remediation responsibilities so each party’s obligations under HIPAA are documented and enforceable.

Why a Clear, Usable BAA Reduces Compliance Risk

A properly drafted Business BAA Document clarifies HIPAA responsibilities, documents permitted PHI uses, and reduces legal uncertainty. It is a foundational contractual control for HIPAA compliance when third parties handle protected health information.

Who Prepares and Signs This Document

Covered entities, business associates, vendors, and compliance officers commonly prepare or request this Business BAA Document during vendor onboarding.

Covered entities (providers, health plans) initiate BAAs when vendors will access PHI.
Business associates (cloud, billing, analytics vendors) execute BAAs before processing PHI.
Contract and procurement teams manage signatures, terms, and compliance mappings for BAAs.

Keep a signed copy in vendor files and in the entity’s compliance repository for audit readiness and regulatory response.

Quick Steps to Complete the Business BAA Document

Follow a short, repeatable sequence to populate, approve, sign, and archive the Business BAA Document so responsibilities and timelines are clear.

01

Identify Parties: Enter full legal names and entity types.
02

Define Scope: List PHI types and permitted uses precisely.
03

Security Obligations: Specify safeguards, encryption, and access controls.
04

Sign & Record: Obtain authorized signatures and retain originals.

Typical eSignature Workflow Settings for a BAA

Common configuration options ensure the Business BAA Document is sent, authenticated, and retained in a compliant workflow.

Field	Configuration
Signer Authentication	Email link, SMS code, or two-factor authentication.
Template Fields	Preplace signature, date, and checklist fields.
Conditional Clauses	Show clauses only when specific options selected.
Retention Policy	Set automatic storage and access retention tags.

Digital Signing Requirements and Integrations

Digital signing requirements and integrations that support Business BAA Document workflows, audit trails, and lawful authentication.

Integrations: Salesforce, NetSuite, Google Workspace integrations
Formats: PDF, DOCX, HTML supported
Authentication: SMS codes, SSO, multifactor options

Where to Send, Sign, and Store the BAA

Outline routing and storage of the Business BAA Document from negotiation, approval, signature, to long-term retention for audits.

Draft Review: Legal and compliance review proposed terms.
Signatures: Authorized signatories execute the BAA document.
Repository: Store signed copy in compliance repository.
Audit Access: Maintain searchable records for audits and requests.

Vendor Pricing and Feature Snapshot for eSignature Platforms

Compare starting prices and core feature availability for common eSignature vendors used to execute Business BAA Documents and related workflows.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	7-day free trial	Trial available	Trial available	Trial available	Trial available
Bulk Send	Yes	Yes	Yes	Yes	No
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes	Yes	Yes	No	No
Envelope Cap	No envelope cap	100 envelopes/user/year	Plan limits vary	Plan limits vary	Plan limits vary

Security and Compliance Elements to Include

Encryption In Transit: TLS 1.2/1.3 encryption required

Encryption At Rest: AES-256 encryption of stored PHI

Audit Trail: Detailed timestamps and signer metadata

Access Controls: Role-based access and MFA enforcement

Breach Notification: Contract specifies prompt breach notification timelines

BAA Requirement: Subcontractor flow-down obligations included

Representative Roles Who Sign or Manage BAAs

Compliance Officer

The Compliance Officer evaluates the Business BAA Document to confirm that contractual obligations meet HIPAA regulatory requirements, documents business associate risk, and coordinates reviews. They verify security controls, breach notification timelines, and that subcontractors are contractually bound to the same obligations.

IT Vendor

An IT Vendor storing or processing PHI signs the Business BAA Document to accept responsibility for safeguarding PHI, supporting audits, providing access logs, and notifying the covered entity of breaches; subcontractors must be bound by identical requirements.

Primary Risks If the BAA Is Missing or Incorrect

HIPAA Fines: Civil penalties and corrective actions possible

Contract Liability: Indemnity and damages exposure

Data Breach Costs: Notification, remediation, and breach costs

Regulatory Audits: OCR investigations and remediation orders

Criminal Exposure: Possible criminal liability for willful violations

Business Disruption: Operational downtime and reputational harm

Common Errors to Avoid When Preparing the BAA

Failing to specify permitted uses and disclosure scope often leads to overbroad access rights or disputes about authorized PHI processing and unexpected liabilities.
Using inconsistent effective dates or omitting termination clauses creates gaps in liability and uncertainty about responsibilities after contract end.
Not binding subcontractors to identical BAA obligations breaks the chain of trust and can make the covered entity liable for downstream breaches.
Relying on verbal assurances instead of a signed Business BAA Document exposes organizations to regulatory penalties and adverse audit findings.

Best Practices for a Compliant Business BAA Document

Adopt consistent operational habits that simplify review, signature, and audit of BAAs across your vendor base.

Define PHI Scope Clearly

Specify the exact categories of PHI and processing activities covered. Clear scope reduces ambiguity during audits and limits unnecessary data access by vendors.

Require Subcontractor Flow-Down

Include contractual language that obligates subcontractors to the same privacy and security duties, ensuring the covered entity’s protections extend through the service chain.

Document Security Controls

List specific administrative, technical, and physical safeguards rather than generic statements. Require encryption, logging, and access controls that can be audited.

Review and Renew Regularly

Schedule periodic reviews and reauthorization of BAAs, especially after service scope changes, mergers, or when new data categories are processed.

Frequently Asked Questions About the Business BAA Document

Answers to common questions about when a BAA is required, who signs it, and how to manage changes and records.

Need help? Contact support

What is a BAA and when is it required?
A Business BAA Document is a contract required when a vendor will create, receive, maintain, or transmit PHI on behalf of a HIPAA-covered entity. It documents permitted uses, safeguards, and breach responsibilities under HIPAA privacy and security rules.
Who must sign the Business BAA Document?
An authorized representative of the covered entity and an authorized representative of the business associate must sign. Signatures should come from persons with authority to bind each organization to contractual and compliance obligations.
Are subcontractors required to have BAAs?
Yes. Subcontractors that handle PHI must be contractually bound through a flow-down clause or a separate Business BAA Document so that the covered entity’s protections extend to downstream processors.
Does the BAA need to be notarized or witnessed?
Notarization is not generally required for BAAs and has no effect on HIPAA enforceability. Verify state or contract-specific requirements, but a signed, dated contract with intent and attribution is usually sufficient.
How do I revoke or amend a signed BAA?
Follow the amendment and termination provisions in the Business BAA Document. Typically amendments must be in writing and signed; termination clauses specify notice periods and post-termination obligations for PHI.
How long should I keep signed BAAs?
Retain BAAs to meet HIPAA retention guidance: generally six years from creation or last effective date (45 CFR §164.530(j)), and follow any longer state-specific retention rules.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now