Is a BAA always required?

Yes when a vendor creates, receives, maintains, or transmits PHI on behalf of a covered entity. The covered entity must obtain satisfactory assurances via a BAA under HIPAA (see 45 CFR §164.504(e)).

Can the BAA be signed electronically?

Yes. Electronic signatures are valid under the ESIGN Act (15 U.S.C. §7001) and UETA where adopted, provided intent, consent, attribution, and record retention are demonstrated.

Who should sign on behalf of the parties?

An authorized officer or designee with signature authority (e.g., privacy officer or general counsel). Document the signatory's title and authority in the signature block.

How long must I keep BAAs?

Retain BAAs and related audit logs at least six years to align with HIPAA practices (45 CFR §164.530(j)); longer retention may be required by state law.

How do I update or amend a BAA?

Execute an amendment signed by both parties describing the changes and effective date. Track amendments with the original agreement and audit trail for legal clarity.

What happens after a breach involving a vendor?

Follow the BAA breach notification provisions, notify affected individuals and regulators as required by HIPAA, and preserve evidence for OCR inquiries and any required mitigation.

Electronic Signature
Templates
Healthcare
Healthcare Vendor BAA Agreement

Healthcare Vendor BAA Agreement

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

HEALTHCARE VENDOR BUSINESS ASSOCIATE AGREEMENT

This Business Associate Agreement ("Agreement") is entered into as of Effective Date: by and between Covered Entity: , located at (hereinafter "Covered Entity") and Business Associate: , located at (hereinafter "Business Associate").

1. PURPOSE AND SCOPE

The parties enter into this Agreement to set forth the Business Associate's obligations with respect to Protected Health Information (PHI) created, received, maintained or transmitted on behalf of Covered Entity, and to ensure compliance with applicable privacy and security requirements under federal and state law. Business Associate will perform Services:

Description of Services

2. DEFINITIONS

For purposes of this Agreement: "Protected Health Information" or "PHI" means individually identifiable health information transmitted or maintained by electronic or other means that is created or received by Business Associate from or on behalf of Covered Entity. Terms used but not otherwise defined in this Agreement shall have the meanings set forth in the applicable privacy and security laws and regulations.

3. PERMITTED USES AND DISCLOSURES

Business Associate may use and disclose PHI only as necessary to perform Services described herein and only in accordance with this Agreement. Business Associate may also use PHI for the proper management and administration of the Business Associate or to carry out its legal responsibilities provided that such uses are permitted by law.

Permitted categories of use (select all that apply)

Treatment, Payment and Health Care Operations
Billing and claims processing
Quality assurance, population health and analytics
Administrative functions and compliance activities

4. OBLIGATIONS OF BUSINESS ASSOCIATE

Business Associate agrees to:

a. Implement administrative, physical, and technical safeguards to protect the confidentiality, integrity and availability of PHI, consistent with the Security Rule and applicable law; maintain written policies evidencing such safeguards; and use appropriate encryption where required by law.

b. Not use or disclose PHI other than as permitted by this Agreement or required by law. Any permitted use or disclosure will be limited to the minimum necessary to accomplish the intended purpose.

c. Report to Covered Entity any use or disclosure of PHI not permitted by this Agreement, and any Security Incident or Breach of Unsecured PHI, without unreasonable delay and in no event later than business days after discovery. The report shall include details sufficient for Covered Entity to meet its notification obligations.

Breach notification contact at Covered Entity

5. SUBCONTRACTORS AND AGENTS

Business Associate may disclose PHI to subcontractors or agents only after obtaining reasonable assurances, by written contract, that the subcontractor will protect PHI consistent with this Agreement. Business Associate remains fully liable for the subcontractor's compliance.

Listed subcontractors (if any)

6. ACCESS, AMENDMENT AND ACCOUNTING

To the extent Business Associate maintains PHI in a Designated Record Set, Business Associate will provide access or make amendments to PHI at the request of Covered Entity or the individual, and will provide an accounting of disclosures as required by law. Business Associate will cooperate with Covered Entity in responding to individual requests.

7. RETURN OR DESTRUCTION OF PHI

Upon termination of this Agreement for any reason, Business Associate shall, at Covered Entity's option, return or securely destroy all PHI received from Covered Entity that Business Associate still maintains in any form. If return or destruction is not feasible, Business Associate will extend protections of this Agreement to such PHI and limit further uses and disclosures. Business Associate will complete return or destruction within days of termination.

8. SECURITY AND AUDIT

Business Associate shall implement and maintain appropriate technical and organizational measures, including access controls, encryption where applicable, audit controls, and regular testing, to protect PHI. Business Associate shall allow Covered Entity or its designee to inspect and audit Business Associate's relevant records and facilities upon reasonable notice to verify compliance.

Insurance and security attestation

9. BREACH RESPONSE AND COOPERATION

Business Associate shall: (a) notify Covered Entity of any Breach of Unsecured PHI consistent with Section 4(c); (b) cooperate with Covered Entity's investigation and mitigation; (c) provide access to logs and records necessary to identify the scope of the Breach; and (d) bear reasonable costs of notification and remediation when the Breach results from Business Associate's failure to comply with this Agreement.

10. INDEMNIFICATION AND LIMITATION OF LIABILITY

Business Associate shall indemnify, defend and hold Covered Entity harmless from and against all losses, claims, damages, liabilities and costs (including reasonable attorneys' fees) arising from Business Associate's breach of this Agreement, negligent acts, or willful misconduct with respect to PHI. Except to the extent caused by a party's gross negligence or willful misconduct, neither party shall be liable for incidental or consequential damages.

11. TERM, TERMINATION AND SURVIVAL

This Agreement shall commence on the Effective Date specified above and continue until terminated in writing. Either party may terminate this Agreement for material breach if such breach is not cured within days after written notice. Provisions that by their nature should survive termination shall survive, including obligations to protect PHI and return/destruction obligations.

12. GOVERNING LAW; AMENDMENT

This Agreement shall be governed by the substantive laws of the State of without regard to conflict of laws principles. The parties agree that this Agreement may be amended from time to time to conform to changes in applicable law; any amendment must be in writing and signed by both parties.

13. NOTICES

All notices required under this Agreement shall be given in writing to the contact persons below and shall be effective upon receipt.

Covered Entity notice contact Business Associate notice contact

14. MISCELLANEOUS

This Agreement constitutes the entire agreement between the parties with respect to the subject matter hereof and supersedes all prior agreements, understandings and arrangements. Neither party may assign its obligations without the prior written consent of the other, except to a successor in interest by merger or acquisition provided the successor assumes all obligations hereunder.

Covered Entity:

By:

Date:

Business Associate:

By:

Date:

What a Healthcare Vendor BAA Agreement Is and when it applies

A Healthcare Vendor BAA Agreement (Business Associate Agreement) is a written contract between a HIPAA-covered entity and a vendor that creates, receives, maintains, or transmits protected health information (PHI) on the entity's behalf. The BAA specifies permitted uses and disclosures of PHI, required administrative, physical, and technical safeguards, subcontractor obligations, breach notification procedures, and term/termination conditions. A properly executed BAA documents responsibilities under HIPAA and forms the compliance basis for ongoing data-sharing and operational relationships involving PHI.

Why a Healthcare Vendor BAA Agreement matters for compliance

A BAA is required for HIPAA compliance whenever a vendor handles PHI (see 45 CFR §164.502(e) and §164.504(e)). It allocates liability, mandates safeguards, and establishes breach notification timelines, reducing regulatory risk and clarifying operational controls between parties.

Who typically completes a Healthcare Vendor BAA Agreement

Typical parties that negotiate and sign a Healthcare Vendor BAA Agreement include covered entities and their vendors, legal and compliance teams, and relevant business units.

Covered entities and providers responsible for patient care and PHI handling.
Business associates such as cloud hosts, billing companies, and data processors.
Legal, privacy officers, and procurement teams managing vendor risk and contract terms.

Execution often involves delegated signatories (privacy officer or general counsel) and internal IT or security reviewers to confirm technical safeguards.

Core clauses you should expect in a professional BAA

A comprehensive Healthcare Vendor BAA Agreement defines roles, permitted uses, safeguards, subcontractor rules, breach response, and termination mechanics so both parties understand obligations and remedies.

Parties & Definitions

Clearly name the covered entity and business associate and define PHI, protected operations, and role-specific responsibilities to avoid ambiguity.

Permitted Uses

List specific services and the limited purposes for which the vendor may access or use PHI, including any marketing or research prohibitions.

Security Safeguards

Specify administrative, physical, and technical measures required to protect PHI, including encryption, access controls, and vulnerability management.

Subcontractors

Require written BAAs with subcontractors or third-party processors and state the process for approving or auditing subprocessor agreements.

Breach Notification

Define incident reporting timelines, investigation responsibilities, and obligations for notifying the covered entity and affected individuals.

Termination & Return

Specify data return or destruction procedures on termination, and surviving obligations such as record retention and audit rights.

Step-by-step: completing the Healthcare Vendor BAA Agreement

Follow a short, repeatable process to prepare, review, sign, and store the BAA to reduce legal and operational risk.

01

Prepare draft: Populate parties, services, and safeguards.
02

Internal review: Have legal and privacy teams confirm terms.
03

Execute signatures: Obtain authorized signatures from both parties.
04

Store and monitor: Retain signed copy and track subcontractors.

How to configure an online BAA workflow

Design a digital workflow that enforces required fields, captures audit data, and secures execution with appropriate signer authentication.

Document Workflow Field and Configuration	Recommended configuration or value for this field
Authentication Method for Signers (recommended)	Email link plus SMS OTP verification
Signature Process and Legal Consent	Capture explicit electronic consent per ESIGN
Audit Trail Retention and Export	Retain timestamps, IPs, and actions for six years
Subprocessor Clause Enforcement	Auto-flag missing subcontractor BAAs for follow-up

Where to send or file the executed BAA

Route signed copies to legal, privacy, and operational systems so obligations and audit evidence are available to stakeholders.

Vendor Legal: Send the fully executed copy to the vendor's legal contact.
Covered Entity Privacy Office: Provide the privacy officer a signed copy for compliance records.
Secure Archive: Upload to a secure contract repository with version history.
Subcontractor Notification: Share obligations with approved subcontractors if applicable.

Technical considerations for e-signing and storing BAAs

Choose a platform that captures a robust audit trail, supports strong signer authentication, and stores signed records securely.

Integrations: Salesforce, NetSuite, Google Workspace
Document formats: PDF/A and DOCX supported
Authentication options: Email, SMS OTP, SSO

Ensure the platform can execute a HIPAA-compliant workflow, provide a written BAA if required, and export signed agreements with immutable audit logs for retention and audits.

Required security assurances to include in the BAA

Encryption in Transit: TLS 1.2/1.3 required

Encryption at Rest: AES-256 or equivalent

Certifications: SOC 2 Type II and ISO 27001

HIPAA BAA: BAA must be executed

Audit Logs: Immutable access and action logs

Access Controls: Role-based access and MFA

Common risks and potential consequences of weak BAAs

Regulatory Fines: OCR enforcement and civil penalties

Breach Liability: Contractual indemnity and remediation costs

Operational Disruption: Service interruption and incident response costs

Reputational Harm: Loss of patient trust and referrals

Data Loss: PHI exposure and mitigation expenses

Termination Risk: Contract termination and transition costs

Comparing eSignature vendors for Healthcare Vendor BAA workflows

Price and feature trade-offs matter for HIPAA workflows. The table summarizes starting prices, trial availability, bulk send, audit trail, HIPAA support, and envelope caps for common vendors.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	7-day free trial	No	No	Yes, limited	Yes, limited
Bulk Send	Yes	Yes	Yes	Yes	No
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes	Yes	Yes	No	No
Envelope Cap	No cap	100 envelopes/user/year	Varies by plan	Varies by plan	Varies by plan

FAQs and common issues when preparing a Healthcare Vendor BAA Agreement

Answers to frequent questions about when a BAA is required, how to e-sign, retention, and post-signature obligations.

Need help? Contact support

Is a BAA always required?
Yes when a vendor creates, receives, maintains, or transmits PHI on behalf of a covered entity. The covered entity must obtain satisfactory assurances via a BAA under HIPAA (see 45 CFR §164.504(e)).
Can the BAA be signed electronically?
Yes. Electronic signatures are valid under the ESIGN Act (15 U.S.C. §7001) and UETA where adopted, provided intent, consent, attribution, and record retention are demonstrated.
Who should sign on behalf of the parties?
An authorized officer or designee with signature authority (e.g., privacy officer or general counsel). Document the signatory's title and authority in the signature block.
How long must I keep BAAs?
Retain BAAs and related audit logs at least six years to align with HIPAA practices (45 CFR §164.530(j)); longer retention may be required by state law.
How do I update or amend a BAA?
Execute an amendment signed by both parties describing the changes and effective date. Track amendments with the original agreement and audit trail for legal clarity.
What happens after a breach involving a vendor?
Follow the BAA breach notification provisions, notify affected individuals and regulators as required by HIPAA, and preserve evidence for OCR inquiries and any required mitigation.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now