When is a BA agreement required?

A BA agreement is required whenever an individual or entity creates, receives, maintains, or transmits PHI on behalf of a HIPAA-covered entity. If the party’s work involves PHI beyond incidental exposure, document the relationship with a BA agreement.

Can a BA agreement be signed electronically?

Yes. Electronic signatures are legally enforceable under the ESIGN Act (15 U.S.C. ch. 96) and UETA where adopted. Ensure intent, consent, attribution, and reliable record retention to satisfy legal tests.

Does HIPAA require notarization?

No. HIPAA does not mandate notarization for BA agreements. Notarization may be useful for authentication in some contexts but is not a HIPAA requirement.

What retention period applies?

Maintain BA agreements and related documentation for at least six years from creation or last effective date to align with HIPAA recordkeeping (45 CFR §164.530(j)).

Who should sign the agreement?

An authorized representative of each party who has authority to bind the organization should sign. Record the signer’s name and title in the signature block.

What if a subcontractor needs PHI access?

Require the business associate to enter a written agreement with the subcontractor that imposes the same HIPAA obligations and obtain evidence of that agreement.

Electronic Signature
Templates
HR
Employee BA Agreement

Employee BA Agreement

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

Employee BA Agreement

Parties and Identification

This Employee BA Agreement (the Agreement) is entered into between Employer Name: and Employee Name: effective as of the date of signature below.

Personal Information

Full Legal Name Current Address Phone Email

Position Information

Proposed Job Title Department Reporting Manager Proposed Start Date Compensation (Annual or Hourly)

Authorization and Background Check Consent

I, the undersigned Employee, hereby authorize Employer and its agents to procure background information about me for employment purposes. This authorization includes, but is not limited to, consumer reports, criminal history records, motor vehicle records, credit reports where job-related, verification of education and professional credentials, drug and alcohol testing results, and verification of prior employment and references. I consent to the release of such information to Employer.

Scope of checks requested (check all that apply):

Criminal history search

Motor vehicle / driving record

Credit report (where job-related)

Drug and alcohol screening

Education and credential verification

Prior employment verification and reference checks

I understand that adverse information discovered during background screening may affect my eligibility for hire or continued employment. If adverse action is contemplated based in whole or in part on a consumer report, Employer will provide me with notice and an opportunity to respond in accordance with applicable law.

Employment History (Most Recent)

Employer 1 — Company Name Employer 1 — Job Title

Dates Employed: From to

Employer 1 — Responsibilities Employer 1 — Reason for Leaving

Employment History (Previous)

Employer 2 — Company Name Employer 2 — Job Title

Dates Employed: From to

Employer 2 — Responsibilities Employer 2 — Reason for Leaving

Education

Highest Degree or Certification Institution Graduation Date

References

Reference 1 — Name Reference 1 — Phone Reference 1 — Email Reference 1 — Relationship Reference 2 — Name Reference 2 — Phone Reference 2 — Email Reference 2 — Relationship Reference 3 — Name Reference 3 — Phone Reference 3 — Email Reference 3 — Relationship

Legal Disclosures

At-Will Employment: Nothing in this Agreement alters the at-will employment relationship between Employee and Employer. Either Employee or Employer may terminate the employment relationship at any time, with or without cause or prior notice, unless a separate written agreement signed by both parties expressly provides otherwise.

Equal Employment Opportunity: Employer is an equal opportunity employer. Employment decisions are based on business needs, job requirements, and individual qualifications, without regard to protected characteristics.

Use, Retention and Confidentiality of Information

All information obtained under this Agreement will be used solely for employment-related purposes. Employer will maintain confidentiality of background information to the extent required by law and will make reasonable efforts to store and dispose of such records securely.

Applicant Certification and Acknowledgment

I certify that all information I have provided on or with this Agreement is true, complete, and correct to the best of my knowledge. I understand that any material misrepresentation, omission, or false statement may be grounds for denial of employment or immediate termination if employed. I expressly authorize Employer to contact previous employers, educational institutions, references, and other third parties to verify any information I have provided.

Employee initials acknowledging certification:

Background Check Acknowledgement

I acknowledge that I have received the disclosure that the Employer may obtain consumer reports and investigatory consumer reports. I expressly authorize the obtaining and use of such reports and waive any claim against those furnishing such information to Employer.

If you have resided outside of the state of current employment within the past seven years, list other states of residence

Additional Authorizations

Employee authorizes Employer to:

Contact prior employers listed for verification and reference information

Require drug and alcohol testing consistent with Employer policy

Obtain fingerprint-based records if required for position

If applicable, list professional license numbers or credential identifiers

Revocation, Governing Law and Severability

This authorization remains effective during the hiring process and, if employed, for the duration of employment unless revoked in writing. Any revocation will not affect actions taken prior to receipt of the revocation. This Agreement will be governed by the laws of the state in which the primary work location is situated. If any provision is held invalid, the remaining provisions will remain in full force and effect.

Optional — Additional Notes from Applicant

Acknowledgment

By signing below, Employee certifies the truthfulness of the information provided and provides the authorizations and consents described in this Agreement. Employer representative certifies that the background checks requested are job-related and consistent with business necessity.

Employee Print Name:

By:

Date:

Employer Representative Print Name:

By:

Date:

What the Employee BA Agreement Is and When It Applies

An Employee Business Associate (BA) Agreement documents the relationship and responsibilities when an employee or affiliated party will create, receive, maintain, or transmit protected health information (PHI) on behalf of a HIPAA-covered entity. Although commonly called a Business Associate Agreement, the term Employee BA Agreement emphasizes situations where an individual employee or contractor functions as the business associate. The agreement clarifies permitted uses and disclosures of PHI, security requirements, reporting obligations for breaches, and the duration and termination conditions tied to HIPAA obligations.

Why an Employee BA Agreement Matters for HIPAA Compliance

A properly executed Employee BA Agreement limits legal exposure by documenting obligations under HIPAA and defining permitted uses of PHI, breach notification steps, and security controls.

Who Typically Prepares and Signs an Employee BA Agreement

Covered entities and their delegates need to identify when an employee, contractor, or vendor qualifies as a business associate and therefore requires a BA agreement.

HIPAA-covered entities: healthcare providers, health plans, and clearinghouses that assign employees or contractors to handle PHI.
Third-party contractors: individuals or consultants who access PHI to perform services such as billing, IT, or data analysis.
Compliance and legal teams: draft, review, and approve BA agreements before any PHI access begins.

The document should be completed by authorized contract personnel and signed by an individual with contractual authority on behalf of the covered entity and the business associate.

Essential Elements to Include in a Professional Employee BA Agreement

A compliant Employee BA Agreement should be specific about permitted uses of PHI, safeguards, breach response, subcontractor rules, term and termination, and liability allocations to meet HIPAA and related obligations.

Permitted Uses

Define exactly which functions, activities, or services permit PHI access and explicitly prohibit unrelated uses or disclosures; include minimum necessary limits.

Safeguards

Specify administrative, physical, and technical safeguards required of the employee or contractor, matching HIPAA Security Rule expectations and any additional organizational standards.

Breach Notification

Describe timing and process for reporting unauthorized uses or breaches to the covered entity, including required contents of reports and contact points.

Subcontractors

Require written agreements with any subcontractors that will access PHI and ensure the subcontractor inherits the same obligations as the primary business associate.

Term and Termination

State the effective date, conditions for termination, and procedures for return or destruction of PHI upon contract end or breach.

Liability and Indemnity

Allocate responsibility for damages, remediation costs, and regulatory fines consistent with applicable law and organizational risk tolerance.

Step-by-Step: How to complete an Employee BA Agreement

Follow these sequential steps to prepare, review, and execute the agreement while preserving auditability and legal compliance.

01

Identify Need: Confirm PHI access triggers a BA relationship.
02

Assemble Parties: Gather legal names and contact details for both parties.
03

Draft Terms: Insert scope, safeguards, breach procedures, and termination language.
04

Execute and Retain: Obtain authorized signatures, save a copy, and record retention metadata.

How Electronic Completion and eSubmission Typically Works

Digital workflows streamline execution while preserving the evidence required for HIPAA and ESIGN compliance.

Upload Document: Sender uploads the BA agreement PDF or DOCX to the e-sign platform.
Place Fields: Add signature, date, and initial fields plus any conditional checkboxes.
Send to Signer: Deliver via email invite or secure link for the signer to access.
Audit Trail: Platform records timestamps, IPs, and actions for compliance evidence.

Configuring a Secure Online Signing Workflow for the Agreement

Set up these controls to reduce signer friction while maintaining evidence and security required for regulatory review.

Field	Configuration
Signature Field	Required; record timestamp and signer attribution
Authentication	Email + optional SMS or KBA for higher assurance
Document Retention	Enable PDF certificate and secure storage
Access Controls	Limit administrator permissions and enable audit logging

Technical and Integration Considerations for eSigning

Ensure the selected vendor provides audit trails, HIPAA BAA availability, and the ability to export standard signed PDFs for long-term retention.

Authentication: Email, SMS, or KBA options
Storage: Encrypted at rest (AES-256)
Integrations: Connectors for EMR and document management

Security and Compliance Features to Verify

Encryption: TLS 1.2/1.3 in transit; AES-256 at rest

HIPAA BAA: BAA available for covered entities

Audit Trail: Immutable timestamps and action logs

Certifications: SOC 2 Type II and ISO 27001

21 CFR Part 11: Support for FDA-regulated electronic records

ESIGN / UETA: Compliant with U.S. e-signature laws

Key Risks and Potential Consequences of an Improper Agreement

HIPAA Penalties: Civil and criminal fines

Breach Costs: Notification and remediation expenses

Contract Invalidity: Enforcement challenges

Regulatory Scrutiny: OCR investigations

Reputational Harm: Loss of patient trust

Liability Exposure: Indemnity and legal fees

Common Mistakes to Avoid When Preparing the Agreement

Using informal or shorthand party names instead of exact legal entity names, creating ambiguity about who is bound by the contract.
Failing to specify the exact categories of PHI or systems the employee may access, which undermines minimum-necessary compliance.
Omitting breach notification timelines or the required content of incident reports, delaying regulatory reporting and remediation.
Allowing an unauthorized signer to execute the agreement, which can render the contract unenforceable and complicate liability allocation.

Timing and Recordkeeping Deadlines to Consider

Although BA agreements themselves are not tax filings, several regulatory retention and reporting deadlines apply to PHI and related records.

Effective Date Entry:

Enter MM/DD/YYYY to define when obligations begin

HIPAA Retention:

Retain related documentation for 6 years (45 CFR §164.530(j))

Breach Notification:

Report breaches per HIPAA timelines and OCR guidance

I-9 and Employment Records:

Separate employment records follow I-9 and tax retention rules (8 CFR §274a.2; IRC rules)

Contract Review:

Reassess BA terms upon material changes to services or law

Key Milestones in the BA Agreement Lifecycle

Track these stages from need identification through post-termination obligations to ensure continuous compliance and documentation.

01

Need Identification

Determine when an employee or contractor will access PHI.

02

Agreement Drafting

Draft terms tailored to the scope of access and required safeguards.

03

Execution

Obtain authorized signatures and confirm signer identity.

04

Post-Termination Actions

Return or destroy PHI and retain records per retention policy.

Sample eSignature Vendor Pricing and Feature Comparison

Compare basic pricing and common compliance features for teams that need secure execution and audit trails; signNow is listed first per vendor-comparison conventions.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	7-day free trial	Varies by vendor	Varies by vendor	Varies by vendor	Varies by vendor
Bulk Send	Yes	Yes	Yes	Yes	No
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes	Yes	Yes	No	No
Envelope Cap	No envelope cap	100 envelopes/user/year	Varies by plan	Varies by plan	Varies by plan

Real-World Examples of Secure Electronic Agreement Use

These brief examples show how organizations use secure electronic workflows and platform compliance features to manage sensitive agreements.

Fertility Centers of Illinois

They needed HIPAA-compliant signatures for patient-facing documents and backend agreements

Chose a platform with a BAA and audit trails
The organization reported responsive vendor support and reliable signed records that met compliance and operational needs.

Optica Ventures LLC

A small services firm required simple, clear signing for vendor and employee agreements

Implemented electronic workflows to reduce turnaround time
The team found the interface easy to use, helping them get agreements signed without in-person meetings.

Practical Tips for Accurate and Efficient Completion

Adopt these practices to reduce errors and strengthen enforceability of Employee BA Agreements.

Use Legal Names

Always use the full legal name of each party and the exact business entity designation to ensure enforceability and avoid identity disputes.

Be Specific About PHI

Define categories of PHI and the permitted purposes precisely; overly broad permissions weaken minimum-necessary protections and increase regulatory risk.

Enable Strong Authentication

Require at least email-plus another factor for remote signatures when PHI access is significant to strengthen attribution and reduce repudiation risk.

Document Post-Termination Steps

Specify return or secure destruction procedures for PHI, and require certificates of destruction where practical to support auditability and compliance.

Frequently Asked Questions About Employee BA Agreements

Answers to common questions about when a BA agreement is required, what it must contain, and how to sign and retain it electronically.

Need help? Contact support

When is a BA agreement required?
A BA agreement is required whenever an individual or entity creates, receives, maintains, or transmits PHI on behalf of a HIPAA-covered entity. If the party’s work involves PHI beyond incidental exposure, document the relationship with a BA agreement.
Can a BA agreement be signed electronically?
Yes. Electronic signatures are legally enforceable under the ESIGN Act (15 U.S.C. ch. 96) and UETA where adopted. Ensure intent, consent, attribution, and reliable record retention to satisfy legal tests.
Does HIPAA require notarization?
No. HIPAA does not mandate notarization for BA agreements. Notarization may be useful for authentication in some contexts but is not a HIPAA requirement.
What retention period applies?
Maintain BA agreements and related documentation for at least six years from creation or last effective date to align with HIPAA recordkeeping (45 CFR §164.530(j)).
Who should sign the agreement?
An authorized representative of each party who has authority to bind the organization should sign. Record the signer’s name and title in the signature block.
What if a subcontractor needs PHI access?
Require the business associate to enter a written agreement with the subcontractor that imposes the same HIPAA obligations and obtain evidence of that agreement.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now