Is an electronic signature valid for a BAA?

Yes. Electronic signatures are legally valid under the ESIGN Act (15 U.S.C. §7001) and state UETA statutes where adopted. Ensure the signing method captures intent, consent, attribution, and retention to meet the legal validity test.

When is a BAA required under HIPAA?

A written BAA is required whenever a vendor creates, receives, maintains, or transmits PHI on behalf of a covered entity, per HIPAA standards and the HHS OCR guidance; include explicit permitted uses and safeguards.

Can a business associate use subcontractors?

Yes, but the BAA must require the business associate to flow down equivalent obligations to subcontractors and to ensure appropriate safeguards and oversight of downstream PHI handlers.

What happens after a breach involving a business associate?

The BAA should define breach-notification timelines and cooperation obligations. Covered entities may have reporting duties under HIPAA and state breach laws; prompt investigation and remediation are essential.

Do BAAs require notarization or witnesses?

Generally no. BAAs are contractual and do not typically require notarization or witnesses, though organizational policy or state-specific formalities may create exceptions; verify locally.

How long should I retain the executed BAA?

Retain the executed agreement and related audit logs for at least six years when PHI is involved to align with HIPAA recordkeeping (45 CFR §164.530(j)); consider longer retention for tax or litigation hold purposes.

Electronic Signature
Templates
Miscellaneous
Customer Business Associate Agreement

Customer Business Associate Agreement

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

Customer Business Associate Agreement

This Customer Business Associate Agreement ("Agreement") is entered into as of by and between Client Name: ("Client") and Business Associate Name: ("Business Associate").

WHEREAS

WHEREAS, Client engages Business Associate to perform services involving access to Client data and confidential business information as described in this Agreement; and

WHEREAS, the parties desire to set forth the terms and conditions under which Business Associate will process, protect, and, where applicable, return or destroy such information and to allocate responsibilities for compliance, security, and indemnity.

NOW, THEREFORE, in consideration of the mutual covenants contained herein and other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the parties agree as follows:

Scope of Work

Services to be provided

Payment Terms

Client shall pay Business Associate for services performed under this Agreement in accordance with the following terms:

Payment Amount (per applicable billing period) Payment Schedule / Milestones

Invoices are due and payable within days of receipt. Past due amounts shall accrue interest at a rate of per month (or the maximum lawful rate, if lower), plus all costs of collection, including reasonable attorneys' fees.

Term and Termination

This Agreement shall commence on the Start Date: and shall continue until the End Date: unless earlier terminated as provided herein.

Either party may terminate this Agreement for convenience upon written notice delivered at least days prior to the intended termination date. Either party may terminate immediately upon written notice if the other party materially breaches any obligation hereunder and fails to cure such breach within thirty (30) days after receipt of written notice specifying the breach.

Upon termination, Business Associate shall, at Client's direction, either return to Client or securely destroy all Confidential Information and any copies thereof in Business Associate's possession, except to the extent retention is required by applicable law, regulation, or professional obligations.

Confidentiality

"Confidential Information" means all non-public information disclosed by Client to Business Associate, whether oral, written, electronic, or other form, including but not limited to business plans, customer lists, pricing, technical data, and personnel information. Business Associate shall:

a) Use Confidential Information solely for the performance of its obligations under this Agreement; b) restrict disclosure of Confidential Information to those of its employees, contractors, or agents who have a need to know and who are bound by confidentiality obligations at least as protective as those herein; c) implement and maintain administrative, physical, and technical safeguards designed to protect Confidential Information from unauthorized access, use, or disclosure; and d) promptly notify Client of any unauthorized use or disclosure of Confidential Information and cooperate with Client in investigating and remediating any such incident.

The obligations in this Confidentiality section shall survive termination or expiration of this Agreement for a period of three (3) years, or longer if required by applicable law.

Liability and Indemnification

Business Associate shall indemnify, defend and hold harmless Client from and against any third-party claims, liabilities, losses, damages, and expenses (including reasonable attorneys' fees) arising out of Business Associate's breach of this Agreement, negligence, willful misconduct, or unauthorized disclosure of Confidential Information. Neither party shall be liable for indirect, incidental, consequential, or punitive damages except to the extent resulting from willful misconduct or gross negligence.

Notices

Client Notice Address Business Associate Notice Address

Governing Law

This Agreement shall be governed by and construed in accordance with the laws of the State of without regard to its conflicts of law principles. Any action arising under this Agreement shall be brought exclusively in the state or federal courts located within that state.

Entire Agreement; Amendments

This Agreement, together with any exhibits, attachments, or task orders expressly incorporated by reference, constitutes the entire agreement between the parties with respect to the subject matter hereof and supersedes all prior and contemporaneous agreements and understandings, whether written or oral. No amendment, modification, or waiver shall be effective unless made in writing and signed by authorized representatives of both parties.

Severability

If any provision of this Agreement is held to be invalid or unenforceable by a court of competent jurisdiction, such provision shall be reformed only to the extent necessary to make it enforceable, and the remaining provisions shall continue in full force and effect.

Client:

By:

Date:

Business Associate:

By:

Date:

What the Customer Business Associate Agreement Is

A Customer Business Associate Agreement (commonly called a BAA) is a written contract between a HIPAA-covered entity and a vendor or partner that creates, receives, maintains, or transmits protected health information (PHI) on the covered entity's behalf. The BAA defines permitted uses and disclosures of PHI, requires safeguards to protect that data, assigns breach-notification responsibilities, and sets terms for return or destruction of PHI at contract end. The agreement complements underlying commercial terms by focusing specifically on HIPAA obligations and risk allocation between parties.

Why a Proper BAA Matters for Compliance and Risk Management

A correctly executed Customer Business Associate Agreement documents PHI handling expectations, assigns responsibility for security incidents, and reduces legal and regulatory exposure under HIPAA. It is a core compliance control for any vendor relationship involving patient data.

Who Typically Signs a Customer Business Associate Agreement

Many organizations encounter BAAs when third parties process or store PHI; the agreement clarifies roles and obligations before data exchange begins.

Hospitals and health systems — vendors handling billing, analytics, cloud storage, or patient communication services.
Healthcare vendors and SaaS providers — any company that creates, receives, or stores PHI on behalf of a covered entity.
Business offices and legal teams — procurement and compliance reviewers who approve contract language and risk allocations.

Ensure the individuals who approve and sign have authority to bind their organization and understand HIPAA obligations and breach reporting timelines.

Essential Elements to Include in a Professional BAA

A comprehensive Customer Business Associate Agreement should set permitted PHI uses, required administrative and technical safeguards, breach-notification procedures, subcontractor rules, rights to audit, and termination or return-of-data terms.

Permitted Uses

Specify exactly which activities the business associate may perform with PHI (e.g., claims processing, analytics). Avoid open-ended language that could be construed to permit unrelated uses.

Safeguards

Require administrative, physical, and technical protections aligned with HIPAA Security Rule objectives, including access controls, encryption where appropriate, and regular risk assessments.

Breach Response

Define notification timelines, investigative responsibilities, and cooperation obligations for security incidents and HIPAA breach reporting to the covered entity.

Subcontractors

Obligate business associates to flow down equivalent contractual protections to subcontractors who will access PHI and to provide evidence of compliance when requested.

Audit Rights

Allow the covered entity to request documentation, conduct audits, or receive third-party audit reports that demonstrate compliance with the BAA terms.

Data Return or Destruction

Specify whether PHI will be returned or securely destroyed at termination, including acceptable destruction methods and timing.

Step-by-Step: How to Complete and Execute a BAA

Follow these sequential steps to prepare, review, and finalize a Customer Business Associate Agreement with minimal risk.

01

Identify Parties: Confirm legal names and roles of covered entity and business associate.
02

Define Scope: Document specific services and PHI types to be processed.
03

Negotiate Terms: Agree on safeguards, breach protocols, and subcontractor obligations.
04

Sign and Retain: Obtain authorized signatures and store the executed agreement securely.

How to Configure an Online BAA Workflow

Set up a digital workflow that routs the agreement for review, signature, and secure storage while capturing an audit trail for compliance.

Field	Configuration
Effective Date Field	Set as required field with MM/DD/YYYY validation
Signature Blocks	Add signer name, title, and signature fields for each party
Witness / Notary Fields	Include conditional fields if local law or organization requires notarization
Audit Trail	Enable automatic timestamps, IP capture, and signed PDF export

Digital Signing and Platform Requirements for a BAA

Choose a solution that supports secure e‑signatures, chained audit trails, and HIPAA-compliant controls if PHI is involved.

Authentication: Email, SMS, or stronger methods
Audit Trail: Timestamps, IP, and action log
Compliance: BAA available; encryption at rest

Ensure the platform can export an immutable signed PDF, provide access logs for audits, and support a written BAA that explicitly names the service provider and PHI handling activities.

Typical Online Execution Flow for a Customer Business Associate Agreement

A concise online flow reduces delays and preserves an evidentiary record of consent and execution for compliance.

Upload Document: Sender uploads the BAA to the signing platform.
Place Fields: Define signature, date, and contact fields.
Send to Signers: Generate secure signing links or email invites.
Capture Audit Trail: System logs timestamps, IPs, and actions.

Security and Compliance Controls to Verify in a Vendor Platform

Encryption: TLS 1.2/1.3 in transit; AES-256 at rest

Certifications: SOC 2 Type II and ISO 27001 available

HIPAA Support: BAA offered on request

Audit Trail: Immutable logs and signed PDF

Access Controls: Role-based permissions and SSO

Accessibility: WCAG 2.0 Level AA compliance

Key Penalties and Legal Risks From an Incomplete or Missing BAA

HIPAA Civil Penalties: Monetary fines and corrective action

HIPAA Criminal Risk: Criminal penalties for intentional misuse

Breach Notification: Mandatory notifications and remediation

Contractual Liability: Indemnity and damages exposure

Regulatory Scrutiny: OCR investigations and audits

Reputational Harm: Loss of trust and business disruption

Common Preparation Mistakes to Avoid

Using generic or boilerplate language that doesn't reflect actual data flows and processing activities.
Failing to specify subcontractor flow‑down obligations and oversight for downstream PHI handlers.
Neglecting to document retention, return, or destruction procedures, leading to ambiguity at contract end.
Allowing an unauthorized individual to sign without evidence of organizational signing authority.

Practical Examples of BAAs and Platform Use

Real-world examples illustrate how organizations structure BAAs and rely on compliant signing platforms to execute and retain agreements.

Fertility Centers of Illinois

A hospital-affiliated clinic standardized its BAA process to reduce administrative friction and centralize audit logs.

They implemented a single signed-template workflow for all vendors.
By capturing signed PDFs and detailed audit trails, the clinic simplified compliance reporting and vendor oversight while preserving evidentiary records for inspections.

Martin Properties

A property services firm used digital BAAs where tenant care data was involved to avoid paper delays.

The team required explicit PHI‑use clauses in each agreement.
Electronic execution with preserved audit trails allowed faster vendor onboarding and a clear paper trail for audits and incident response.

Comparing eSignature Vendors for BAAs and Secure Execution

Vendor pricing and compliance features vary. signNow appears first below to show starting price and key capabilities relevant to BAAs and HIPAA workflows.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	7-day free trial, no credit card required	Varies by vendor	Varies by vendor	Varies by vendor	Varies by vendor
Bulk Send	Yes (Business Premium includes bulk send)	Varies by plan	Varies by plan	Varies by plan	Varies by plan
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes (BAA required)	Yes (BAA available)	Yes (BAA available)	No	No
Envelope Cap	No cap	100 envelopes/user/year limit	Varies by plan	Varies by plan	Varies by plan

Frequently Asked Questions About the Customer Business Associate Agreement

Answers to common questions on enforceability, signing, and platform requirements for BAAs and related PHI-handling contracts.

Need help? Contact support

Is an electronic signature valid for a BAA?
Yes. Electronic signatures are legally valid under the ESIGN Act (15 U.S.C. §7001) and state UETA statutes where adopted. Ensure the signing method captures intent, consent, attribution, and retention to meet the legal validity test.
When is a BAA required under HIPAA?
A written BAA is required whenever a vendor creates, receives, maintains, or transmits PHI on behalf of a covered entity, per HIPAA standards and the HHS OCR guidance; include explicit permitted uses and safeguards.
Can a business associate use subcontractors?
Yes, but the BAA must require the business associate to flow down equivalent obligations to subcontractors and to ensure appropriate safeguards and oversight of downstream PHI handlers.
What happens after a breach involving a business associate?
The BAA should define breach-notification timelines and cooperation obligations. Covered entities may have reporting duties under HIPAA and state breach laws; prompt investigation and remediation are essential.
Do BAAs require notarization or witnesses?
Generally no. BAAs are contractual and do not typically require notarization or witnesses, though organizational policy or state-specific formalities may create exceptions; verify locally.
How long should I retain the executed BAA?
Retain the executed agreement and related audit logs for at least six years when PHI is involved to align with HIPAA recordkeeping (45 CFR §164.530(j)); consider longer retention for tax or litigation hold purposes.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now