Can a BAA be signed electronically?

Yes. Electronic signatures are valid under the ESIGN Act (15 U.S.C. ch. 96) and UETA where adopted; ensure the method captures intent, attribution, consent, and retention. For New York, follow ESRA requirements when applicable.

Is notarization required for a BAA?

Generally no. A BAA is a contract and typically does not require notarization. Check state-specific formalities only if a state statute or procurement rule imposes additional execution requirements.

Do you need a separate BAA for each subcontractor?

Yes. BAAs should require the business associate to flow down equivalent HIPAA obligations to subcontractors and provide proof of those agreements on request.

What happens if the BAA is missing or incomplete?

Operating without a signed BAA when PHI is handled increases risk of HIPAA enforcement, potential fines, and contractual liability; remedy by executing a compliant BAA promptly and documenting corrective actions.

How should breach notifications be handled?

BAAs should define notification timelines and formats; HIPAA requires covered entities to follow OCR breach rules. Include escalation contacts and evidence retention for investigations.

Which retention period applies to executed BAAs?

Retain BAAs for at least six years per HIPAA (45 CFR §164.530(j)); longer periods may apply depending on state law or other regulators.

Electronic Signature
Templates
Healthcare
Healthcare HIPAA BAA Template

Healthcare HIPAA BAA Template

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

HEALTHCARE BUSINESS ASSOCIATE AGREEMENT (BAA)

This Business Associate Agreement (the Agreement) is entered into as of (Effective Date) by and between Covered Entity: and Business Associate: .

RECITALS

WHEREAS, Covered Entity possesses individually identifiable health information protected under the Privacy and Security Rules and regulations (Protected Health Information or PHI); and

WHEREAS, Business Associate performs certain services for Covered Entity that require Business Associate to create, receive, maintain, or transmit PHI; and

WHEREAS, the parties desire to comply with applicable law governing the use and disclosure of PHI and to set forth their respective rights and obligations with respect thereto.

DEFINITIONS

Terms used but not defined in this Agreement shall have the same meaning as those terms in the Privacy and Security Rules. For the purposes of this Agreement, "Protected Health Information" or "PHI" includes any information, whether oral or recorded in any form or medium, that relates to the past, present, or future physical or mental health condition of an individual and that identifies the individual.

PERMITTED USES AND DISCLOSURES

Business Associate may use and disclose PHI only as necessary to perform the services described in the underlying services agreement and only as permitted by this Agreement. Business Associate shall not use or disclose PHI in any manner that would violate the Privacy Rule if done by Covered Entity, except as permitted below.

Permitted specific uses and disclosures (check all that apply):
Treatment Payment Healthcare Operations

RESPONSIBILITIES OF BUSINESS ASSOCIATE

Business Associate shall implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of PHI, in accordance with the Security Rule. Business Associate shall:

a) Use appropriate safeguards to prevent unauthorized use or disclosure of PHI; b) Report to Covered Entity any use or disclosure of PHI not permitted by this Agreement; c) Ensure that any subcontractors agree to the same restrictions and conditions; d) Provide access, amendment, and accounting at Covered Entity's request to the extent required by law.

SUBCONTRACTORS

Business Associate may disclose PHI to subcontractors or agents only after obtaining reasonable written assurances that such agents will implement appropriate safeguards and agree in writing to be bound by the same restrictions and conditions that apply to Business Associate under this Agreement.

BREACH NOTIFICATION

Business Associate shall report to Covered Entity any Security Incident or Breach of Unsecured PHI no later than calendar days after discovery. The report shall include, to the extent known, a description of the breach, the PHI affected, corrective actions taken, and contact information for Business Associate.

ACCESS, AMENDMENT, AND ACCOUNTING

To enable Covered Entity to comply with patient rights, Business Associate shall, within a reasonable time, make PHI available to Covered Entity for inspection, amendment, or accounting of disclosures, and shall cooperate with Covered Entity to satisfy Covered Entity's obligations under law.

RETURN OR DESTRUCTION OF PHI

Upon termination of the underlying services agreement or this Agreement, Business Associate shall, at Covered Entity's direction, return or securely destroy all PHI received from Covered Entity. If return or destruction is not feasible, Business Associate shall extend protections of this Agreement to such PHI and limit further uses and disclosures.

AUDITS AND INSPECTION

Business Associate shall make internal practices, books and records relating to the use and disclosure of PHI available to the Secretary of the applicable regulatory authority for purposes of determining compliance. Business Associate shall permit Covered Entity to, upon reasonable notice, inspect facilities and security measures that pertain to PHI.

INDEMNIFICATION AND LIMITATION OF LIABILITY

Each party shall indemnify, defend and hold harmless the other party from and against claims, liabilities, damages, and expenses resulting from the indemnifying party's breach of its obligations under this Agreement. Neither party shall be liable for indirect, incidental, consequential, or punitive damages except for breaches involving willful misconduct or gross negligence.

TERM, TERMINATION, AND SURVIVAL

This Agreement shall commence on the Effective Date and remain in effect for the term of the parties' underlying services agreement unless earlier terminated. Upon termination, the provisions of return/destruction, indemnification, and any other obligations that by their nature should survive shall survive.

AMENDMENT

The parties agree to negotiate in good faith any amendment necessary to comply with changes in law or regulation governing PHI. Any amendment must be in writing and executed by authorized representatives of both parties.

GOVERNING LAW

This Agreement shall be governed by and construed in accordance with the laws of the State of , without regard to its choice-of-law rules.

CONTACTS FOR NOTICES

Covered Entity Address Covered Entity Contact Business Associate Address Business Associate Contact

DESCRIPTION OF PHI

Describe the categories of PHI to be created, received, maintained or transmitted by Business Associate and the purposes for which such PHI will be used:

SECURITY SAFEGUARDS

Business Associate represents that it has implemented administrative, technical, and physical safeguards reasonably designed to protect PHI. Describe specific security measures, encryption, access control, and monitoring obligations:

INSURANCE AND LIABILITY

Business Associate shall maintain insurance adequate to cover liabilities arising from breaches of this Agreement. Describe limits or minimum coverage amounts if required:

AUTHORIZATION EXPIRATION

This Agreement shall expire on unless earlier terminated in accordance with its terms.

CERTIFICATION

By executing this Agreement, the undersigned representatives warrant that they are authorized to bind their respective entities. Each party certifies that it will comply with all applicable requirements relating to PHI and will cooperate to carry out the intent of this Agreement.

Covered Entity:

By:

Date:

Business Associate:

By:

Date:

What the Healthcare HIPAA BAA Template Is

A Healthcare HIPAA BAA Template is a standardized business associate agreement designed to document responsibilities, permitted uses, and safeguards for protected health information (PHI) exchanged between a covered entity and a business associate. The template sets out required HIPAA protections (privacy, security, breach notification), assigns liability for improper access or use, and creates an auditable record of obligations for both parties. It is used when services involve storage, transmission, processing, or access to PHI and should be tailored to the relationship, services, and applicable state privacy laws.

Why a Clear BAA Matters for Healthcare Contracts

A well-drafted HIPAA BAA clarifies who controls PHI, defines permitted operations, and allocates breach responsibilities; it reduces compliance risk and provides documentation regulators expect during audits or investigations.

Primary Parties and Typical Signers

Covered entities and their vendors use BAAs whenever a vendor creates, receives, maintains, or transmits PHI on behalf of the covered entity.

Covered entities such as hospitals, clinics, and health plans that control PHI and must ensure business associates meet HIPAA obligations.
Business associates including IT hosts, billing providers, cloud storage vendors, and consultants who access or process PHI for a covered entity.
Compliance officers, general counsel, and senior vendor representatives who have authority to accept contractual terms and security obligations.

Signatories should have delegated authority and the capacity to meet technical, administrative, and breach-notification commitments in the agreement.

Essential Components to Include in the BAA

A professional HIPAA BAA balances legal specificity with operational clarity so each obligation is enforceable and actionable by technical teams and executives.

Permitted Uses

Define exactly which PHI uses and disclosures the business associate may perform, limiting activity to what the covered entity needs.

Security Safeguards

Describe administrative, physical, and technical safeguards the business associate must implement, mapped to HIPAA Security Rule expectations.

Breach Notification

Set timelines and procedures for notifying the covered entity of breaches or suspected unauthorized disclosures.

Subcontractors

Require written agreements with subcontractors that impose the same HIPAA obligations and permit audits.

Term and Termination

Specify effective date, termination rights, and how PHI will be returned, destroyed, or retained after termination.

Liability and Indemnity

Allocate responsibility for violations, costs of remediation, and any indemnification for unauthorized disclosures.

Step-by-Step: How to Complete and Execute the BAA

Follow these sequential steps to fill, review, and finalize a BAA to ensure both compliance and operational readiness.

01

Prepare draft: Populate entity names, effective date, and scope of services for initial review.
02

Security review: Have IT/security confirm technical controls meet agreed safeguards and document evidence.
03

Legal review: Counsel reviews liability, indemnity, and termination clauses and suggests edits.
04

Sign and retain: Execute by authorized signers and store the fully executed agreement with audit trail evidence.

How to Customize and Complete the BAA Online

Configure a digital workflow so the BAA routes to stakeholders, captures audit data, and stores executed copies securely.

Document	Upload the BAA as a PDF or DOCX and lock non-editable terms before sending.
Fields	Add signature, date, and initial fields; mark required fields and use conditional logic for optional clauses.
Signers	List signers in order: business associate rep, covered entity rep; add cc recipients for compliance teams.
Authentication	Select authentication level (email verification, SMS code, or two-factor) appropriate to risk.
Retention	Configure automatic archiving and export of certificate of completion and audit trail to secure storage.

Where to Send or File the Executed BAA

An executed BAA should be distributed to legal, compliance, IT, and retained with contract records according to retention policy.

Primary Repository: Store executed originals in the enterprise contract repository accessible to compliance and legal teams.
Security Team: Deliver the data handling and control clauses to IT/security for operational implementation.
Business Units: Share the signed BAA with product owners and account teams that interact with the vendor.
Audit Folder: Place the signed PDF, execution certificate, and any attestations in the audit-ready folder.

Digital Signing and eSubmission Considerations

Select eSignature and storage tools that support audit trails, secure storage, and the ability to attach a BAA to vendor records.

Authentication: Use signer authentication proportional to risk—email + SMS or higher for vendors handling large PHI volumes.
Audit Trail: Capture IP addresses, timestamps, and user actions to establish a defensible record of consent and execution.
Storage Format: Keep final signed PDF/A copies and the associated certificate of completion in encrypted storage.

Ensure the chosen platform supports HIPAA-required business associate agreements, secure key management, and the ability to export records for audits.

Key Timelines and Response Expectations

Track effective dates, renewal windows, and breach-notification deadlines to meet regulatory and contractual timing obligations.

Effective Date Entry:

Set the start date clearly; controls and monitoring should be in place by this date.

Renewal Review:

Review BAAs annually or when material service changes occur to confirm continued compliance.

Breach Notification:

Specify internal notification timing consistent with HIPAA breach rules and contractual expectations.

Audit Readiness:

Maintain signed BAAs and evidence of safeguards for at least the retention period required by policy.

Termination Actions:

Define deadlines for PHI return or destruction and for validating completion of those tasks.

Common Mistakes to Avoid When Preparing a BAA

Using vague scope language that allows broader PHI use than intended, increasing exposure.
Failing to require subcontractor flow-down obligations, leaving gaps in the PHI protection chain.
Not aligning technical safeguards in the BAA with the vendor's actual security controls and evidence.
Neglecting to capture a robust audit trail during execution, complicating later compliance reviews.

Penalties and Risks of an Incomplete or Incorrect BAA

HIPAA Enforcement: Civil monetary penalties and corrective action plans may apply for noncompliance under HIPAA enforcement.

Data Breach Costs: Direct remediation, notification, and potential class-action exposure can be financially significant.

Regulatory Scrutiny: Incomplete BAAs invite additional oversight during OCR investigations and audits.

Contractual Liability: Indemnity and liability clauses may create large financial obligations for uncovered breaches.

Operational Disruption: Loss of access to vendor services or emergency termination can disrupt patient care processes.

Reputational Harm: Public disclosures of PHI incidents can cause lasting trust and referral losses.

Required Technical and Administrative Data Elements

Encryption: AES-256 at rest; TLS 1.2/1.3 in transit

Access Controls: Role-based access with least privilege

Breach Notification: Timelines and escalation path defined

Audit Trail: Timestamps, IP, signer identity

Subcontractor Flow-down: Mandatory written agreements

BAA Availability: BAA must be executed prior to PHI exchange

Industry Examples: How BAAs Are Used in Practice

Real-world scenarios show practical BAA content and operational handoffs between covered entities and vendors.

Fertility Center

A clinic engaged a cloud imaging vendor to store patient scans

Vendor required encryption and breach reporting
The clinic added specific deletion duties and scheduled annual security attestations to maintain compliance and evidence for audits.

Managed Billing

A revenue-cycle vendor processed PHI for claims submission

Contracted subprocessors required equivalent safeguards
The covered entity retained audit rights and quarterly security reports to monitor compliance and remediate issues quickly.

Typical Authorized Signers

Chief Compliance Officer

Often signs on behalf of the covered entity and certifies that organizational safeguards and monitoring processes are in place to support the BAA's commitments.

Vendor Executive

A senior officer or authorized contracting representative signs for the business associate, confirming the vendor accepts liability, flow-downs, and technical obligations.

Practical Tips for Accurate and Efficient Completion

Adopt consistent processes to reduce negotiation time and ensure enforceable obligations across vendors.

Use a Standard Template

Maintain a vetted master BAA template to avoid repetitive legal reviews; update it annually to reflect regulatory changes and lessons from incidents.

Map Technical Controls

Require vendors to supply evidence (SOCs, penetration tests) and map those controls to BAA clauses to align contractual promises with practice.

Automate Routing

Use electronic workflows to route BAAs to legal, security, and procurement sequentially to capture approvals and reduce execution time.

Document Exceptions

Log any negotiated deviations from standard language and the business justification to preserve an audit trail for compliance reviews.

eSignature Vendor Pricing and HIPAA Support Snapshot

Comparing basic pricing and HIPAA support helps organizations choose an eSignature provider for executing BAAs and signing PHI-related contracts. signNow is listed first per comparison format.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	7-day free trial, no credit card required	Varies	Varies	Varies	Varies
Bulk Send	Yes	Yes	Yes	Yes	Varies
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes	Yes	Yes	No	No

FAQs and Troubleshooting for the Healthcare HIPAA BAA Template

Answers to common questions about execution, eSigning, and compliance with HIPAA and state rules for BAAs.

Need help? Contact support

Can a BAA be signed electronically?
Yes. Electronic signatures are valid under the ESIGN Act (15 U.S.C. ch. 96) and UETA where adopted; ensure the method captures intent, attribution, consent, and retention. For New York, follow ESRA requirements when applicable.
Is notarization required for a BAA?
Generally no. A BAA is a contract and typically does not require notarization. Check state-specific formalities only if a state statute or procurement rule imposes additional execution requirements.
Do you need a separate BAA for each subcontractor?
Yes. BAAs should require the business associate to flow down equivalent HIPAA obligations to subcontractors and provide proof of those agreements on request.
What happens if the BAA is missing or incomplete?
Operating without a signed BAA when PHI is handled increases risk of HIPAA enforcement, potential fines, and contractual liability; remedy by executing a compliant BAA promptly and documenting corrective actions.
How should breach notifications be handled?
BAAs should define notification timelines and formats; HIPAA requires covered entities to follow OCR breach rules. Include escalation contacts and evidence retention for investigations.
Which retention period applies to executed BAAs?
Retain BAAs for at least six years per HIPAA (45 CFR §164.530(j)); longer periods may apply depending on state law or other regulators.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now