Yes when a vendor is a business associate under HIPAA and creates, receives, maintains, or transmits PHI on behalf of a covered entity. See 45 CFR §164.502(e) and §164.504(e) for scope definitions.

Can a BAA be electronically signed?

Yes. Electronic signatures are legally enforceable under the ESIGN Act (15 U.S.C. §7001) and UETA where adopted, provided intent, consent, attribution, and retention requirements are met.

Who should sign the agreement?

An authorized officer or signatory with authority to bind the organization should sign. Document the signer's name, title, and authority to avoid enforceability disputes.

How long must I keep executed BAAs?

Retain BAAs and related PHI records for six years from creation or last effective date to meet HIPAA retention (45 CFR §164.530(j)); longer retention may apply under state law.

What happens if a breach occurs?

Follow the BAA breach-notification process, notify the covered entity promptly, and comply with breach reporting under HIPAA and applicable state breach laws; remediate per the contract.

How do I amend or revoke a BAA?

Amend per the contract's amendment clause with mutual written consent. To terminate, follow contractual termination notice periods and complete PHI return or destruction obligations in the agreement.

Electronic Signature
Templates
Healthcare
Healthcare MSA BAA Form

Healthcare MSA BAA Form

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

HEALTHCARE MSA & BUSINESS ASSOCIATE AGREEMENT (BAA)

PARTIES

This Master Services Agreement and Business Associate Agreement (MSA BAA) is entered into between:

Covered Entity: Name Covered Entity: Address

Covered Entity: Contact Name

Phone

Privacy Officer Email

Business Associate: Name Business Associate: Address

BA: Contact Name

Phone

Security Officer Email

RECITALS & TERM

WHEREAS, Covered Entity engages Business Associate to provide services that require access to Protected Health Information (PHI) as defined below; and WHEREAS, the parties intend to comply with the Health Insurance Portability and Accountability Act of 1996 and regulations promulgated thereunder (HIPAA);

Effective Date: Term (months):

DEFINITIONS

Protected Health Information (PHI) has the meaning set forth in HIPAA and includes individually identifiable health information transmitted or maintained in any form or medium that relates to an individual's past, present or future physical or mental health condition, provision of health care, or payment for health care.

Security Incident means an attempted or successful unauthorized access, use, disclosure, modification, or destruction of information or interference with system operations in an information system.

SERVICES & FEES

Description of Services Payment & Fees

PERMITTED USES & RESTRICTIONS

Business Associate may use or disclose PHI only as necessary to perform the services described above and as otherwise permitted herein and required by law. Business Associate shall not use or disclose PHI in a manner that would violate Covered Entity's policies or HIPAA.

Permitted purposes (check all that apply):

Treatment Payment Healthcare Operations Other (specify below)

If Other, specify

BUSINESS ASSOCIATE OBLIGATIONS

Business Associate shall implement administrative, physical and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of PHI. BA shall comply with the Security Rule and shall limit access to PHI to the minimum necessary to perform services.

Summary of Safeguards

Subcontractors: Business Associate shall require all subcontractors that create, receive, maintain or transmit PHI to enter into a written agreement that imposes substantially the same obligations as set forth in this Agreement.

Subcontractors (list names)

BREACH NOTIFICATION & INCIDENT RESPONSE

Business Associate shall notify Covered Entity of any Security Incident or Breach of Unsecured PHI without unreasonable delay and no later than after discovery. Notice shall include details sufficient for Covered Entity to meet its regulatory obligations.

Incident Reporting Contact

ACCESS, AMENDMENT & ACCOUNTING

Business Associate shall make PHI available to Covered Entity to satisfy Covered Entity's obligations under HIPAA to provide access, amendment, or accounting of disclosures. BA will cooperate and provide records within a reasonable time frame.

Access Response Timeframe

RETURN OR DESTRUCTION OF PHI

Upon termination or expiration of this Agreement, Business Associate shall, at Covered Entity's direction, return or securely destroy all PHI received from, or created on behalf of, Covered Entity and retain no copies except as required by law.

Return PHI to Covered Entity Destroy PHI in accordance with industry standards

If destruction selected, describe method and timeline

AUDIT, COMPLIANCE & INSURANCE

Covered Entity may audit Business Associate's policies, procedures and systems related to PHI, subject to reasonable prior notice and protection of confidential business information. Business Associate shall maintain insurance appropriate to its obligations under this Agreement.

Insurance Coverage Summary

INDEMNIFICATION, LIMITATION OF LIABILITY & GOVERNING LAW

Each party shall indemnify the other for third-party claims arising from its breach of this Agreement or its negligence. The parties agree that the liability and damages provisions set forth in the Master Services Agreement shall apply, except as modified herein to comply with applicable law. This Agreement shall be governed by the laws of the state identified by the Covered Entity below.

Governing Law: State

AMENDMENT; SURVIVAL

The parties agree to amend this Agreement as necessary to comply with changes in state or federal law. Obligations of confidentiality, indemnification and return/destruction of PHI shall survive termination or expiration of this Agreement.

ATTESTATIONS

By signing below, Business Associate attests that it will implement the required safeguards, comply with applicable HIPAA requirements, timely report breaches and Security Incidents, and enter into written agreements with any subcontractors that receive PHI.

BA Attestation (initials)

NOTICES

All notices required by this Agreement shall be in writing and delivered to the contact information set forth above or to such other address as a party designates in writing.

Alternate Notice Contact (Covered Entity) Alternate Notice Contact (Business Associate)

MISCELLANEOUS

This Agreement, together with any Statement of Work or exhibits identified herein, constitutes the entire agreement between the parties with respect to its subject matter. If any provision is held unenforceable, the remainder shall remain in effect.

Acceptance: The undersigned representatives each certify that they are authorized to execute this Agreement on behalf of their respective parties.

Covered Entity:

By:

Date:

Business Associate:

By:

Date:

What the Healthcare MSA BAA Form Is and when it applies

The Healthcare MSA BAA Form combines a Master Services Agreement (MSA) that governs commercial terms with a Business Associate Agreement (BAA) that addresses protection of protected health information (PHI). It documents roles, permitted uses, security controls, breach notification obligations, and liability allocation between a covered entity and a business associate. For U.S. healthcare relationships the BAA component ensures HIPAA-covered PHI handling requirements are contractually enforced while the MSA covers pricing, deliverables, warranties, and termination mechanics.

Why a combined MSA plus BAA matters for healthcare vendors

A combined Healthcare MSA BAA Form reduces contract fragmentation, ensures HIPAA obligations are tied to commercial responsibilities, and clarifies incident response and liability allocation for PHI handling.

Who typically prepares and signs a Healthcare MSA BAA Form

Healthcare providers, health IT vendors, managed services firms, and legal or procurement teams commonly use this combined agreement to govern commercial and PHI-handling relationships.

Hospitals and clinics that outsource services and need explicit HIPAA controls and indemnities.
Health technology vendors (EHR, analytics, telehealth) that process PHI on behalf of covered entities.
Service providers (billing, transcription, cloud hosting) that require clear security and breach notification terms.

Step-by-step: completing a Healthcare MSA BAA Form

Follow this sequence to prepare, review, and finalize the combined MSA and BAA efficiently and in compliance with HIPAA rules.

01

Draft: Populate party names, scope, and PHI categories precisely.
02

Security Review: Confirm required security controls, encryption, and breach procedures.
03

Legal Review: Ensure indemnity, liability caps, and termination rights align with policy.
04

Execute: Obtain authorized signatures and retain signed copies for records.

Core provisions every Healthcare MSA BAA Form should contain

A professional combined form clearly separates commercial terms from privacy and security obligations while linking them where appropriate so each party's responsibilities are unambiguous.

Scope of Work

Precise description of services and deliverables, including which activities will involve PHI and any excluded duties to prevent scope creep and liability disputes.

PHI Use and Disclosure

Permitted purposes and restrictions for PHI use, including downstream subcontractor rules, minimum necessary principles, and permitted disclosures under HIPAA.

Security Controls

Specific technical and administrative safeguards required (encryption, access controls, logging) and obligations to maintain those safeguards throughout the term.

Breach Response

Timelines and responsibilities for breach notifications, investigation cooperation, mitigation steps, and public communications tied to regulatory obligations.

Audit and Reporting

Right to audit or request security evidence, reporting cadence for compliance attestations, and consequences for failing audits or remediation.

Termination and Transition

Procedures for return or destruction of PHI upon termination, transition assistance, and survival of confidentiality obligations.

Essential security and compliance elements to include

Encryption: TLS 1.2/1.3

Data at Rest: AES-256

Compliance: HIPAA (BAA required)

Audit Trail: Immutable logs

Certifications: SOC 2 Type II

FDA/21CFR: 21 CFR Part 11

Key penalties and legal risks of a faulty MSA BAA

HIPAA Fines: Civil penalties possible

Breach Liability: Third-party claims risk

Regulatory Action: OCR enforcement risk

Contract Voidance: Unenforceable provisions

Tax Form Penalties: See IRC §6721

Operational Disruption: Service interruption costs

Common preparation mistakes to avoid

Using vague PHI descriptions that permit broader access than intended, creating unnecessary compliance and breach risk due to scope ambiguity.
Failing to specify security controls and relying on general statements like ‘industry standard’ rather than explicit encryption, access control, and logging requirements.
Not linking subcontractor obligations or failing to require subcontractor flow-down of BAA terms, leaving gaps in PHI protection across vendors.
Delaying legal and security review until after commercial terms are final, which often forces tradeoffs that weaken privacy protections.

Recommended e-signature workflow settings for a Healthcare MSA BAA Form

Configure a signing workflow that balances convenience with authentication and auditability for HIPAA-covered transactions.

Field	Configuration
Authentication	Email + SMS code or stronger
Signature type	Audit-backed electronic signature
Routing order	Sequential signers with conditional steps
Retention policy	Secure storage, exportable audit trail

Digital signing and platform requirements for HIPAA compliance

Use an eSignature platform that supports secure authentication, audit trails, and a HIPAA Business Associate Agreement when handling PHI.

Authentication: Multi-factor options
Audit Trail: IP, timestamp, action log
BAA Availability: Vendor executes BAA

How digital execution of a Healthcare MSA BAA typically proceeds

A clear digital workflow reduces delays while preserving legal validity and a complete audit trail required under ESIGN and HIPAA.

Upload: Sender uploads the MSA BAA PDF or DOCX.
Place Fields: Add signature, date, and checkbox fields for each signer.
Authenticate: Signers verify identity (email/SMS or stronger).
Complete: System captures a certificate of completion.

Key execution and compliance timelines to track

Track effective dates, notification windows, and retention milestones to meet regulatory and contractual obligations.

Execution Date:

Date parties sign the agreement, use MM/DD/YYYY format.

Effective Date:

When obligations commence; may differ from execution.

Breach Notice:

Contractual deadline for notifying covered entities.

Retention Start:

Retention begins at record creation or last effective date.

Termination Notice:

Period required to terminate services or withdraw access.

Milestone timeline from negotiation to operational compliance

A sequential milestone view helps coordinate legal, security, and operational teams during onboarding and execution.

01

Drafting

Draft MSA terms and enumerate PHI categories to be exchanged.

02

Security Assessment

Complete security questionnaires and evidence review before final signature.

03

Signatures

Obtain authorized signatures and record the executed document.

04

Implementation

Enable production access only after compliance checkpoints are satisfied.

Comparing combined MSA+BAA to separate agreements

Choose whether to combine commercial and HIPAA obligations or keep them separate based on negotiation complexity and internal workflows.

Criteria	MSA + BAA	Separate MSA & BAA
Single Document
Signature Count	one execution	multiple coordinated signatures
Negotiation Complexity	higher	lower per document
Operational Clarity	single reference	requires cross-referencing

Sample eSignature vendor comparison for executing Healthcare MSA BAA Forms

Compare baseline pricing, bulk sending, audit capabilities, HIPAA support, and envelope limits when selecting an eSignature provider for healthcare contracts.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	7-day trial	Varies by plan	Varies by plan	Varies by plan	Varies by plan
Bulk Send	Yes	Yes	Yes	Yes	No
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes	Yes	Yes	No	No
Envelope Cap	No cap	100 envelopes/user/year	Varies	Varies	Varies

Frequently asked questions about the Healthcare MSA BAA Form

Answers to common questions about when a BAA is needed, whether it can be signed electronically, and how to handle breaches and revisions.

Need help? Contact support

Is a BAA required?
Yes when a vendor is a business associate under HIPAA and creates, receives, maintains, or transmits PHI on behalf of a covered entity. See 45 CFR §164.502(e) and §164.504(e) for scope definitions.
Can a BAA be electronically signed?
Yes. Electronic signatures are legally enforceable under the ESIGN Act (15 U.S.C. §7001) and UETA where adopted, provided intent, consent, attribution, and retention requirements are met.
Who should sign the agreement?
An authorized officer or signatory with authority to bind the organization should sign. Document the signer's name, title, and authority to avoid enforceability disputes.
How long must I keep executed BAAs?
Retain BAAs and related PHI records for six years from creation or last effective date to meet HIPAA retention (45 CFR §164.530(j)); longer retention may apply under state law.
What happens if a breach occurs?
Follow the BAA breach-notification process, notify the covered entity promptly, and comply with breach reporting under HIPAA and applicable state breach laws; remediate per the contract.
How do I amend or revoke a BAA?
Amend per the contract's amendment clause with mutual written consent. To terminate, follow contractual termination notice periods and complete PHI return or destruction obligations in the agreement.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now