Do BAAs require notarization or witnesses?

Generally no. A BAA is a contract and typically does not require notarization or witnesses for validity. Validity depends on mutual consent and signature attribution. Check specific state contract formalities if unusual statutory language applies.

Who must sign the BAA to bind the parties?

An individual with authority to bind each organization should sign—commonly a privacy officer, contracting officer, or authorized corporate officer. Ensure the signer's authority is documented in procurement records.

Can a Legal BAA be signed electronically?

Yes. Electronic signatures meeting the ESIGN Act (15 U.S.C. ch. 96) and applicable state law are generally valid. Ensure intent, consent, attribution, and retention requirements are met for enforceability.

How long should I retain executed BAAs?

Retain BAAs for at least six years for HIPAA-related records (45 CFR §164.530(j)) and longer if state law or business needs require it. Maintain linkage to vendor records and audit evidence.

What happens if the business associate breaches obligations?

The BAA should specify remediation, indemnity, and termination rights. Covered entities must assess breach scope and, where required, perform breach notifications and coordinate with regulators per HIPAA procedures.

Can I revoke or amend a BAA later?

Yes, but amendments and revocations should be documented in writing and executed by authorized signatories. The agreement should describe termination effects, data return/destruction, and surviving obligations.

Legal BAA Form

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

LEGAL BUSINESS ASSOCIATE AGREEMENT

This Business Associate Agreement ("Agreement") is entered into as of Effective Date: by and between Covered Entity Name: , with principal place of business at (hereinafter "Covered Entity"), and Business Associate Name: , with principal place of business at (hereinafter "Business Associate").

RECITALS

WHEREAS, Covered Entity is a health care provider, health plan, or health care clearinghouse that creates, receives, maintains or transmits protected health information in the course of providing health care operations and services; and

WHEREAS, Business Associate performs services for or on behalf of Covered Entity that require Business Associate to create, receive, maintain, or transmit Protected Health Information; and

WHEREAS, the parties desire to set forth their respective obligations with respect to Protected Health Information in order to comply with the Health Insurance Portability and Accountability Act of 1996 and implementing regulations (collectively, the "HIPAA Rules").

NOW, THEREFORE, in consideration of the mutual covenants below, the parties agree as follows:

1. DEFINITIONS

For purposes of this Agreement, the following terms shall have the meanings set forth below. "Protected Health Information" or "PHI" means individually identifiable health information transmitted or maintained in any form that is created or received by Business Associate from or on behalf of Covered Entity and that relates to the past, present, or future physical or mental health of an individual, provision of health care to an individual, or payment for health care. "HIPAA Rules" means the Privacy, Security, Breach Notification and Enforcement Rules at 45 C.F.R. Parts 160 and 164 and any applicable state law requirements governing the privacy, security or breach notification of PHI.

2. PERMITTED USES AND DISCLOSURES

Business Associate may use and disclose PHI only as necessary to perform the specific services set forth in the underlying service agreement between the parties (the "Underlying Agreement"), and as expressly permitted by this Agreement. Business Associate shall not use or disclose PHI in any manner that would violate the HIPAA Rules if done by Covered Entity. Business Associate may use PHI for its proper management and administration and to carry out its legal responsibilities, provided that such uses are permitted under 45 C.F.R. §164.504(e).

3. OBLIGATIONS OF BUSINESS ASSOCIATE

Business Associate shall: (a) implement administrative, physical and technical safeguards that reasonably and appropriately protect the confidentiality, integrity and availability of PHI in accordance with the HIPAA Security Rule; (b) ensure that any person or entity to whom Business Associate provides PHI agrees in writing to the same restrictions and conditions that apply to Business Associate under this Agreement; (c) not use or disclose PHI except as permitted by this Agreement or as required by law; and (d) report to Covered Entity any use or disclosure of PHI not permitted by this Agreement, any security incident, and any Breach of Unsecured PHI without unreasonable delay and in no event later than days after discovery.

4. PERMITTED DISCLOSURES TO SUBCONTRACTORS

Business Associate may disclose PHI to Subcontractors only upon obtaining reasonable written assurances, through a contract, that the Subcontractor will safeguard PHI in a manner consistent with this Agreement and the HIPAA Rules. Business Associate shall remain fully responsible for its Subcontractors' compliance with this Agreement.

5. SECURITY BREACH AND INCIDENT MANAGEMENT

Upon discovery of a Breach or security incident affecting PHI, Business Associate shall: (a) take immediate steps to mitigate harm and to protect PHI; (b) conduct a good faith investigation and provide Covered Entity with a written report describing the nature of the incident, the PHI involved, corrective actions taken, and steps to prevent future occurrences; and (c) cooperate with Covered Entity in meeting any notification obligations to affected individuals and regulators. Business Associate shall bear any costs legally required to be paid by Business Associate in connection with such Breach.

6. ACCESS, AMENDMENT AND ACCOUNTING

To the extent Business Associate maintains PHI in a Designated Record Set, Business Associate shall make such PHI available to Covered Entity or to an individual, at Covered Entity's direction, to satisfy Covered Entity's obligations under 45 C.F.R. §164.524 (access), §164.526 (amendment) and §164.528 (accounting). Business Associate shall timely incorporate any amendments directed by Covered Entity and provide accounting information requested by Covered Entity within timeframes required by law.

7. AUDIT, RECORDS AND INSPECTION

Business Associate shall make internal practices, books and records relating to the use and disclosure of PHI available to the Secretary of Health and Human Services for purposes of determining compliance with the HIPAA Rules. Upon reasonable notice, Business Associate shall permit Covered Entity or its designee to inspect facilities, systems, and records as necessary to verify compliance with this Agreement; provided, however, that Covered Entity shall conduct any audit in a manner intended to minimize disruption to Business Associate's operations.

8. RETURN OR DESTRUCTION OF PHI

Upon termination of this Agreement for any reason, Business Associate shall, at Covered Entity's election, return or destroy all PHI received from Covered Entity that Business Associate still maintains in any form. If return or destruction is not feasible, Business Associate shall extend the protections of this Agreement to the retained PHI and not use or disclose the PHI except as required by law, for the purpose for which the PHI was retained, or as permitted by a further written agreement.

9. INDEMNIFICATION

Business Associate shall indemnify and hold harmless Covered Entity from and against any losses, fines, penalties, damages, costs and expenses (including reasonable attorneys' fees) incurred by Covered Entity as a result of Business Associate's breach of this Agreement or violation of the HIPAA Rules, provided that Covered Entity notifies Business Associate promptly and cooperates in the defense of any claim.

10. TERM AND TERMINATION

This Agreement shall commence on the Effective Date and shall continue in effect until the Underlying Agreement terminates, unless earlier terminated as provided herein. Covered Entity may terminate this Agreement for cause if Covered Entity determines Business Associate has breached a material term of this Agreement and Business Associate fails to cure the breach within days after written notice.

11. SURVIVAL

The respective rights and obligations of Business Associate under Sections relating to return/destruction, indemnification, confidentiality, and any other provisions that by their nature should survive, shall survive termination or expiration of this Agreement.

12. REMEDIES; INJUNCTIVE RELIEF

The parties acknowledge that monetary damages may be inadequate for breach of certain covenants in this Agreement and that either party shall be entitled to seek injunctive relief or specific performance in addition to any other remedies available at law or in equity.

13. GOVERNING LAW

This Agreement shall be governed by and construed in accordance with the laws of the State of , without regard to conflict of laws principles.

14. ENTIRE AGREEMENT; AMENDMENT; SEVERABILITY; WAIVER

This Agreement constitutes the entire agreement between the parties with respect to the subject matter hereof and supersedes all prior agreements and understandings. This Agreement may be amended only by a written agreement signed by both parties. If any provision of this Agreement is held invalid or unenforceable, the remaining provisions shall remain in full force and effect. Failure to enforce any provision shall not constitute a waiver of future enforcement of that or any other provision.

15. NOTICES

All notices required or permitted under this Agreement shall be in writing and shall be delivered to the party's address set forth herein or to such other address as a party may designate by written notice. Notices shall be deemed given upon personal delivery, five (5) days after deposit in the U.S. mail, or one (1) day after deposit with an overnight courier service.

Covered Entity Notice Contact Business Associate Notice Contact

16. MISCELLANEOUS

The parties agree that to the extent any state law is more protective of PHI than the HIPAA Rules, such state law shall govern. The obligations of Business Associate under this Agreement are in addition to and not in limitation of any obligations of Business Associate under the Underlying Agreement. The parties agree to cooperate in good faith to amend this Agreement as necessary for Covered Entity to comply with the HIPAA Rules.

ENTITY TYPE

Covered Entity is (select all that apply): Corporation Partnership Individual Other

Business Associate is (select all that apply): Corporation Partnership Individual Other

Covered Entity:

By:

Date:

Business Associate:

By:

Date:

What a Legal BAA Form Is and when it applies

A Legal BAA Form (Business Associate Agreement) is a contract that defines how a business associate will receive, use, disclose, safeguard, and dispose of protected health information (PHI) on behalf of a covered entity. The BAA documents permitted uses, required administrative, physical, and technical safeguards, breach notification duties, term and termination triggers, and procedures for return or destruction of PHI. BAAs are required under HIPAA when PHI is exchanged with vendors who perform services involving access to health information and are an essential part of HIPAA compliance programs.

Why a properly drafted Legal BAA Form matters

A complete BAA clarifies responsibilities for PHI, reduces regulatory risk, and documents breach response obligations required by HIPAA. It creates contractual remedies and operational expectations between covered entities and vendors handling health information.

Who prepares and who signs a Legal BAA Form

Covered entities and their vendors commonly exchange BAAs to document PHI handling responsibilities and legal obligations before data sharing begins.

Health systems, clinics, and providers who control PHI and must limit liability and ensure vendor compliance.
Vendors and service providers that create, receive, maintain, or transmit PHI on behalf of covered entities.
Compliance, privacy, and procurement teams that assess security controls, insurance coverage, and contractual indemnities.

Parties should review technical controls and confirm authorized signers before executing the BAA to avoid gaps in protection or enforcement.

Common signatories and their roles

Privacy Officer

The Privacy Officer signs for the covered entity and certifies that the BAA reflects the entity's HIPAA policies, scope of permitted PHI use, breach reporting requirements and any required administrative safeguards. They coordinate legal and operational review prior to execution.

Authorized Rep

An authorized representative of the business associate signs to accept specified obligations, implement technical safeguards, and attest to subcontractor flow-down requirements. The signatory should have authority to bind the vendor contractually.

Key elements to include in a professional Legal BAA Form

A professional BAA is concise but complete: it identifies parties, describes PHI scope, assigns responsibilities for safeguards and breach response, sets term and termination rights, and requires subcontractor flow-down and audit support.

Parties and Scope

Identify covered entity and business associate by legal name and specify the categories and types of PHI and services covered so there is no ambiguity about what data or activities the agreement governs.

Permitted Uses

List explicit permitted uses and disclosures of PHI and prohibit any uses beyond those purposes; include whether data may be used for de-identification, research, or analytics if applicable.

Security Obligations

Specify administrative, physical, and technical safeguards required of the business associate, including encryption, access controls, logging, vulnerability management, and incident response capabilities.

Breach Notification

Define notification timelines, required content of notices, coordination with covered entity obligations, and responsibilities for notification to individuals and regulators when required.

Subcontractor Flow-Down

Require the business associate to impose equivalent obligations on subcontractors that will access PHI, including audit rights and proof of compliance.

Termination and Return

State termination triggers for breaches, procedures for return or secure destruction of PHI on termination, and residual obligations that survive termination, such as audit cooperation.

Step-by-step: completing and executing a Legal BAA Form

Follow a clear sequence to draft, review, sign, and store the BAA so PHI exchange does not begin until obligations are contractually in place.

01

Prepare draft: Insert parties, scope, and security requirements into a standard BAA template.
02

Internal review: Have privacy, legal, and IT review controls, insurance, and indemnity language.
03

Obtain signatures: Collect authorized signatures from both parties and record execution dates.
04

Store and track: Archive the executed BAA and link it to vendor onboarding records.

Typical digital workflow settings for a Legal BAA Form

Configure your e-signing workflow to require signer authentication, attach exhibits, and route copies to compliance and procurement teams.

Field	Configuration
Authentication method	Email link with optional SMS code or higher KBA for added identity assurance
Document retention	Enable secure archival with search and export for six years minimum
Notifications	Auto-notify privacy and procurement teams upon completion
Template versioning	Lock approved BAA templates and track revisions for audit

How eSigning a Legal BAA typically flows

Use a repeatable digital flow so each BAA is consistently completed, authenticated, and archived with an audit trail.

Upload: Place the BAA template into the signing platform
Assign fields: Add signature, name, date, and checkbox fields where required
Send to signers: Route to authorized signatories in the correct order
Archive copy: Store executed PDF and certificate of completion

Technical considerations for eSigning and storage

Ensure the signing platform supports secure authentication, tamper-evident signed PDFs, and retention policies compatible with HIPAA and corporate recordkeeping.

File formats: PDF and DOCX support for templates and signed copies
Integrations: Connectors to CRM, ERP, and cloud storage platforms
Authentication: Options for email, SMS, or stronger multi-factor authentication

Pricing and feature comparison for eSignature options used with Legal BAAs

Compare vendor starter pricing and key capabilities relevant to BAAs: base price, trials, bulk send, audit trail presence, HIPAA support, and envelope limits where applicable.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	7-day free trial	Available	Available	Available	Available
Bulk Send	Yes (Premium)	Yes	Yes	Yes	Yes
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes	Yes	Yes	No	No

Essential security and compliance points to include

Encryption: AES-256

In transit: TLS 1.2/1.3

Certifications: SOC 2

HIPAA status: BAA required

Audit trail: Complete logs

Access control: MFA supported

Primary legal and practical risks from an incomplete BAA

HIPAA fines: Civil monetary penalties

Criminal exposure: Willful violations risk criminal charges

Breach liability: Contractual damages and notification costs

Regulatory audit: Increased OCR scrutiny

Operational disruption: Service suspension or termination

Reputational harm: Loss of patient trust

Common mistakes when preparing a Legal BAA Form

Using a generic or outdated template that lacks current breach notification or subcontractor flow-down language leads to compliance gaps and operational confusion.
Failing to define the exact scope of PHI and services can allow unauthorized uses and make enforcement of the agreement difficult in audits or litigation.
Allowing non-authorized personnel to sign or using initials without a formal signature block can render the agreement unenforceable against the intended party.
Neglecting to attach required exhibits—such as security addenda or third-party subprocessor lists—creates ambiguity about responsibilities and weakens contractual protections.

Timing considerations and deadlines tied to BAAs

BAAs should be in effect before any PHI exchange occurs; other timing obligations arise from breach notification and contract retention rules.

Execution before PHI exchange:

Execute the BAA before any PHI is shared with the vendor

Breach reporting coordination:

Follow HIPAA breach notification timeframes and cooperate on regulator notices

Document retention:

Retain executed agreements per internal recordkeeping policies and applicable laws

Template reviews:

Review and update BAAs annually or when laws change

Subcontractor updates:

Obtain flow-down confirmations when subcontractors change

Key milestones for BAA processing and approval

A simple milestone sequence keeps onboarding predictable and ensures compliance checkpoints are met before PHI sharing begins.

01

Drafting milestone

Create or select an approved BAA template with required clauses

02

Legal and IT review

Privacy and security teams confirm controls and language

03

Signature collection

Obtain authorized signatures from both parties

04

Archival and linkage

Store executed copy and reference it in vendor records

Frequently asked questions about the Legal BAA Form

Answers below address common execution, enforcement, and eSignature questions when using a Legal BAA Form in the United States.

Need help? Contact support

Do BAAs require notarization or witnesses?
Generally no. A BAA is a contract and typically does not require notarization or witnesses for validity. Validity depends on mutual consent and signature attribution. Check specific state contract formalities if unusual statutory language applies.
Who must sign the BAA to bind the parties?
An individual with authority to bind each organization should sign—commonly a privacy officer, contracting officer, or authorized corporate officer. Ensure the signer's authority is documented in procurement records.
Can a Legal BAA be signed electronically?
Yes. Electronic signatures meeting the ESIGN Act (15 U.S.C. ch. 96) and applicable state law are generally valid. Ensure intent, consent, attribution, and retention requirements are met for enforceability.
How long should I retain executed BAAs?
Retain BAAs for at least six years for HIPAA-related records (45 CFR §164.530(j)) and longer if state law or business needs require it. Maintain linkage to vendor records and audit evidence.
What happens if the business associate breaches obligations?
The BAA should specify remediation, indemnity, and termination rights. Covered entities must assess breach scope and, where required, perform breach notifications and coordinate with regulators per HIPAA procedures.
Can I revoke or amend a BAA later?
Yes, but amendments and revocations should be documented in writing and executed by authorized signatories. The agreement should describe termination effects, data return/destruction, and surviving obligations.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now