Is an electronic signature valid on a BASA?

Yes. Electronic signatures are enforceable under the ESIGN Act (15 U.S.C. §7001) and UETA where adopted. Ensure intent, consent, signer attribution, and reliable record retention to satisfy legal tests.

Do I need a Business Associate Agreement for healthcare data?

If one party handles protected health information, include a HIPAA-compliant BAA. HIPAA rules require documented obligations and a BAA to allocate responsibilities for PHI safeguarding.

When is notarization or witnesses required?

Most commercial BASAs do not require notarization or witnesses, but certain states or specific document types may. Check state rules if the contract affects property or power-of-attorney rights.

How do I prove who signed after execution?

Use an audit trail capturing timestamps, IP addresses, authentication method, and a certificate of completion. Stronger authentication reduces dispute risk and supports admissibility.

Can I revoke or amend a signed BASA?

Revocation or amendment requires agreement per the contract's amendment clause or mutual written consent. Unilateral revocation is typically ineffective unless the agreement provides that right.

How long should I retain executed BASAs?

Retain executed agreements for the full term plus at least 3 years; HIPAA-related records require 6 years (45 CFR §164.530(j)). Consult counsel for longer state-specific retention requirements.

Electronic Signature
Templates
Miscellaneous
Business BASA Agreement

Business BASA Agreement

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

BUSINESS BASA AGREEMENT

This Business BASA Agreement ("Agreement") is entered into as of Effective Date: by and between Client Name: and Service Provider Name: .

WHEREAS

WHEREAS, Client Name: seeks to engage Service Provider Name: to perform certain business associate services described herein; and

WHEREAS, Service Provider represents that it has the professional capability, personnel, and resources necessary to perform such services in accordance with the terms and conditions set forth in this Agreement.

SCOPE OF WORK

Description of Services

Service Provider shall provide the services described above in a professional and workmanlike manner consistent with industry standards. Any material changes to the scope shall be documented and must be approved in writing by both parties through an amendment to this Agreement.

PAYMENT TERMS

Total Contract Amount Payment Schedule Late Payment Fee

All fees are exclusive of taxes unless otherwise stated. Service Provider shall submit invoices in accordance with the payment schedule. Client shall pay undisputed invoices within thirty (30) days of receipt. Late payments shall accrue interest at the rate specified in the Late Payment Fee field above and may, at Service Provider's option, suspend performance until outstanding invoices are paid.

TERM AND TERMINATION

This Agreement shall commence on Start Date: and shall continue until End Date: unless earlier terminated in accordance with this section.

Termination Notice Period

Either party may terminate this Agreement for cause if the other party materially breaches any obligation hereunder and fails to cure such breach within the notice period specified above. Upon termination, Client shall pay for all work performed and reasonable costs incurred through the effective date of termination.

CONFIDENTIALITY

Each party (the "Receiving Party") shall maintain in confidence all confidential or proprietary information disclosed by the other party (the "Disclosing Party") in connection with this Agreement and shall not use or disclose such information except as necessary to perform its obligations. Confidential information does not include information that is (i) publicly known through no breach of this Agreement; (ii) rightfully received from a third party without restriction; or (iii) independently developed without reference to the Disclosing Party's confidential information.

The Receiving Party shall implement reasonable administrative, technical, and physical safeguards to protect confidential information and shall ensure that its employees and subcontractors with access to such information are bound by confidentiality obligations no less restrictive than those set forth in this Agreement.

INDEMNIFICATION AND LIMITATION OF LIABILITY

Each party shall indemnify and hold harmless the other party from third-party claims arising from the indemnifying party's negligent acts, willful misconduct, or breach of this Agreement. Except for liability arising from breach of confidentiality or indemnification obligations, neither party's aggregate liability shall exceed the total fees paid under this Agreement during the twelve (12) months preceding the claim.

GOVERNING LAW

Governing State Law

This Agreement shall be governed by and construed in accordance with the laws of the state specified above, without regard to its conflicts of law principles. The parties consent to the exclusive jurisdiction of the state and federal courts located in that state for any action arising out of or relating to this Agreement.

ENTIRE AGREEMENT

This Agreement, together with any exhibits or amendments signed by the parties, constitutes the entire agreement between the parties with respect to the subject matter hereof and supersedes all prior and contemporaneous agreements, proposals, negotiations, and communications, whether written or oral. No amendment or modification shall be effective unless in writing and signed by authorized representatives of both parties.

NOTICES

Client Address for Notices Service Provider Address for Notices

Notices shall be in writing and delivered by hand, nationally recognized overnight courier, or certified mail to the addresses specified above, or such other address as either party may designate in writing.

MISCELLANEOUS

Neither party may assign this Agreement without the prior written consent of the other party, except to a successor in interest in connection with a merger or sale of substantially all assets. If any provision of this Agreement is held invalid or unenforceable, the remaining provisions shall remain in full force and effect.

Client — Printed Name:

By:

Date:

Service Provider — Printed Name:

By:

Date:

What the Business BASA Agreement Is and when it's used

A Business BASA Agreement is a formal written contract that defines the relationship, responsibilities, and permitted uses of data and services between two business entities. It typically clarifies scope of services, data handling and security obligations, breach notification procedures, indemnity, and termination rights. Organizations use a BASA to document operational expectations, regulatory controls, and liability allocation when one party processes or accesses sensitive information on behalf of another. Although template elements overlap with other commercial contracts, a BASA focuses on data access, privacy safeguards, and compliance obligations relevant to the parties' industry and applicable law.

Why a clear Business BASA Agreement matters

A precise BASA reduces legal ambiguity, assigns security responsibilities, and documents compliance steps required by laws such as HIPAA and industry standards. It supports regulatory readiness, makes incident response roles explicit, and limits dispute risk by defining remedies, notice periods, and termination mechanics.

Who typically prepares and signs a Business BASA Agreement

Parties who handle or host another organization's sensitive data commonly draft or request a BASA before data exchange or onboarding.

Covered entities and providers in healthcare, where a BASA helps satisfy HIPAA business associate expectations.
SaaS and cloud vendors that store or process customer data and must document security and access limits.
Financial services, legal firms, and enterprises that outsource data processing or analytics functions.

Identify the responsible contracting and security owners early to speed negotiation and ensure operational teams can meet contractual controls.

Who signs and who manages the agreement

Signatory

An authorized corporate officer or general counsel usually signs on behalf of each party. Signatories must have authority under company bylaws or a corporate resolution to bind the organization.

Operational Owner

A designated information security or vendor management lead typically manages implementation, audits, and any technical onboarding required to meet the BASA's security and reporting obligations.

Essential security and compliance items to record

PHI / PII Scope: Specify categories of personal data

Permitted Uses: Limitations on processing purposes

Security Controls: Encryption, access controls, MFA

Breach Notification: Timing and reporting channels

Audit Rights: Frequency and scope of audits

Data Retention: Storage and deletion requirements

Common legal and operational risks to address

Regulatory Fines: Civil penalties for compliance failures

Contract Damages: Liability for breaches or losses

Termination Risk: Service disruption on early termination

Reputational Harm: Customer trust and market impact

Data Loss: Costs for recovery and notifications

Criminal Exposure: Willful misconduct may carry criminal risk

Frequent drafting and negotiation pitfalls

Vague scope language that leaves permitted processing undefined, leading to disagreements and potential unauthorized uses.
Missing or inadequate breach notification terms that delay response and increase regulatory exposure and remediation costs.
Failing to confirm the signatory's actual authority, which can lead to unenforceable commitments and contract rescission.
Omitting data deletion or return obligations, resulting in retained copies and extended liability after termination.

Core sections to include in a professional BASA

A comprehensive BASA groups obligations into clear, actionable sections that align legal, security, and operational responsibilities between parties.

Parties & Definitions

Identify each legal entity, role (data controller/processor or covered entity/business associate), and define key terms used throughout the agreement so interpretation remains consistent.

Scope of Services

Describe precisely what services the vendor will perform, where processing occurs, and any subprocessors or third-party transfers the vendor may engage.

Data Handling Rules

Specify permitted uses, prohibited activities, segmentation, minimum data necessary principles, and any requirements for de-identification or aggregation.

Security & Controls

List technical and organizational measures such as encryption, access management, vulnerability scanning, logging, and personnel screening obligations.

Breach Response & Notification

Set timelines for notification, required content of incident reports, remediation responsibilities, and cooperation on regulatory inquiries.

Liability & Termination

Allocate risk through indemnities, liability caps, insurance requirements, and defined termination rights including data return or secure destruction.

Step-by-step process to complete and execute a BASA

Follow a structured workflow to draft, review, sign, and store the executed agreement.

01

Draft Agreement: Prepare a tailored draft with required clauses and scope.
02

Legal & Security Review: Have counsel and security review obligations and controls.
03

Authorized Signatures: Obtain signatures from authorized corporate representatives.
04

Record Retention: Store the signed agreement and related evidence securely.

Typical online workflow settings for BASA execution

Configure your e-signature workflow to enforce authentication, field completion, and audit capture before signing.

Field	Configuration
Signer Authentication	Email link, SMS code, or KBA as required
Required Fields	Make signature, date, and name fields mandatory
Sequential Signing Order	Enforce role-based signing sequence when needed
Audit Trail Capture	Enable timestamps, IP recording, and certificate generation

Technical considerations for digital signing and storage

Choose a signing platform that supports required authentication, preserves a tamper-evident audit trail, and stores executed copies securely.

File Formats: Accept PDF, DOCX, HTML and preserve formatting
Integrations: Integrate with systems like Salesforce, NetSuite, and Google Workspace
Compliance: Support HIPAA BAA, SOC 2, AES-256 storage

Verify the vendor provides reproducible certificates of completion and supports your retention and e-discovery workflows before finalizing execution.

Common eSignature vendor comparison for executing BASAs

Pricing and feature availability vary across providers; below is a concise feature and pricing snapshot to inform platform selection for executing a BASA.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	7-day free trial, no credit card	No	No	Yes, limited	Yes, limited
Bulk Send	Yes	Yes	Yes	Yes	No
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes	Yes	Yes	No	No
Envelope Cap	No envelope cap	100 envelopes/user/year	Varies by plan	Varies by plan	Varies by plan

Frequently asked questions about executing and managing a BASA

Answers to common questions about enforceability, signature methods, witnesses, and post-signature custody for Business BASA Agreements.

Need help? Contact support

Is an electronic signature valid on a BASA?
Yes. Electronic signatures are enforceable under the ESIGN Act (15 U.S.C. §7001) and UETA where adopted. Ensure intent, consent, signer attribution, and reliable record retention to satisfy legal tests.
Do I need a Business Associate Agreement for healthcare data?
If one party handles protected health information, include a HIPAA-compliant BAA. HIPAA rules require documented obligations and a BAA to allocate responsibilities for PHI safeguarding.
When is notarization or witnesses required?
Most commercial BASAs do not require notarization or witnesses, but certain states or specific document types may. Check state rules if the contract affects property or power-of-attorney rights.
How do I prove who signed after execution?
Use an audit trail capturing timestamps, IP addresses, authentication method, and a certificate of completion. Stronger authentication reduces dispute risk and supports admissibility.
Can I revoke or amend a signed BASA?
Revocation or amendment requires agreement per the contract's amendment clause or mutual written consent. Unilateral revocation is typically ineffective unless the agreement provides that right.
How long should I retain executed BASAs?
Retain executed agreements for the full term plus at least 3 years; HIPAA-related records require 6 years (45 CFR §164.530(j)). Consult counsel for longer state-specific retention requirements.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now