Yes. A BAA is required whenever a vendor will create, receive, maintain, or transmit PHI on behalf of a covered entity; see 45 CFR §164.502(e) and §164.504(e).

Can the BAA be electronically signed?

Yes. Electronic signatures are valid under the ESIGN Act (15 U.S.C. ch. 96) and UETA where adopted; ensure intent, consent, attribution, and retention are documented.

Does the BAA need notarization?

Not typically. Notarization is not required by HIPAA for a BAA, though specific state rules or internal policies may require notarization for contract validity.

What about subcontractors?

The business associate must require subcontractors to comply with BAA terms and implement safeguards; include flow-down clauses and require proof of compliance.

How quickly must breaches be reported?

Report breaches without unreasonable delay and no later than 60 days to affected individuals and HHS as required by the HIPAA Breach Notification Rule (45 CFR §164.408).

How should executed BAAs be stored?

Store executed BAAs with a clear audit trail in secure, access-controlled repositories; maintain signed PDFs and logs for at least six years per 45 CFR §164.530(j).

Electronic Signature
Templates
Other
HIPAA Business Partner Contract

HIPAA Business Partner Contract

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

What the HIPAA Business Partner Contract Is and When It Applies

A HIPAA Business Partner Contract (commonly called a Business Associate Agreement or BAA) is a written agreement between a HIPAA-covered entity and a business associate that will create, receive, maintain, or transmit protected health information (PHI) on behalf of the covered entity. The BAA defines permitted uses and disclosures of PHI, requires implementation of administrative, physical, and technical safeguards, addresses breach notification, and sets responsibilities for subcontractors and return or destruction of PHI at termination. A properly executed BAA helps satisfy HIPAA regulatory requirements and documents each party's compliance obligations.

Why a Clear, Enforceable BAA Matters

A written BAA is required by HIPAA when a vendor handles PHI; it allocates risk, mandates safeguards, and establishes breach reporting timelines to meet federal obligations.

Who Typically Signs a HIPAA Business Partner Contract

Covered entities and their third-party vendors use BAAs to formalize PHI handling obligations and controls before any PHI exchange.

Hospitals and Clinics – Health systems and independent practices engaging vendors for billing, cloud storage, or analytics.
Health IT and Cloud Vendors – SaaS providers storing or processing PHI on behalf of covered entities.
Legal and Billing Firms – Third-party administrators, accountants, and counsel with access to patient information.

Signing Authorities for a BAA

HIPAA Officer

Privacy or security officer at the covered entity who ensures the BAA maps to organizational policies, confirms safeguards meet HIPAA, and signs on behalf of the entity when authorized by corporate governance.

Vendor Executive

An authorized representative (CEO, CIO, or delegated contracting officer) from the business associate who accepts responsibilities, confirms technical controls, and signs to bind the vendor to contractual obligations.

Essential Clauses Every Professional HIPAA Business Partner Contract Should Include

A compliant BAA is concise but comprehensive. It should define PHI scope, list permitted uses, require safeguards, govern subcontractors, mandate breach notifications, and establish termination and return/destruction obligations.

Definitions

Clear definitions of 'Protected Health Information', 'Covered Entity', 'Business Associate', and any role-specific terminology to avoid scope ambiguity and support enforceability.

Permitted Uses

Explicitly state permitted uses and disclosures of PHI (e.g., treatment, payment, operations) and prohibit any unauthorized secondary uses such as marketing or sale of PHI.

Safeguards

Require administrative, physical, and technical safeguards aligned with the HIPAA Security Rule, including access controls, encryption where appropriate, and incident response procedures.

Subcontractors

Obligate the business associate to flow down BAA terms to subcontractors who create, receive, or access PHI and to maintain written agreements with those subcontractors.

Breach Notification

Specify prompt notification obligations for breaches of unsecured PHI, timelines for notification to the covered entity, and cooperation with required HHS notifications.

Termination & Return

Set termination rights for material breaches, procedures for return or secure destruction of PHI on termination, and conditions where limited retention is permitted for legal reasons.

Required Data Elements and Contract Fields

Party Names: Full legal names

Effective Date: MM/DD/YYYY

Scope of PHI: PHI categories listed

Permitted Uses: Allowed purposes

Breach Terms: Notification process

Subcontractor Rules: Flow-down requirement

Main Risks if the BAA Is Incorrect or Missing

Regulatory Penalties: Civil fines and corrective action

Civil Liability: Contractual damages and indemnity

Breach Costs: Notification and remediation expenses

Operational Disruption: Service interruptions and audits

Reputational Harm: Loss of trust and business

Termination: Contract cancellation risk

Common Mistakes to Avoid When Preparing a BAA

Using a generic vendor contract that lacks HIPAA-specific breach notification and PHI handling terms.
Failing to define permitted uses clearly, which can result in unauthorized PHI disclosures or compliance gaps.
Not requiring subcontractor flow-down; vendors often rely on subcontractors who also need BAA protections.
Skipping technical safeguards such as encryption or multifactor authentication where PHI is stored or transmitted.

Step-by-Step: How to Complete a HIPAA Business Partner Contract

Follow a consistent sequence to draft, review, and execute the BAA so both legal and technical requirements are addressed before PHI exchange.

01

Identify Parties: Record full legal entity names and contacts.
02

Define PHI Scope: List PHI types and permitted processing activities.
03

Specify Safeguards: Add administrative, technical, and physical controls.
04

Sign and Archive: Obtain authorized signatures and retain executed copy.

Where to Send, File, and Store the Executed BAA

After execution, route signed copies to legal, compliance, and IT security teams and ensure the document is stored where it can be retrieved during audits or incident response.

Legal Repository: Central contract management storage.
Compliance Team: Store with HIPAA policies.
IT Security: Record technical controls and attestation.
Vendor Folder: Keep accessible vendor agreement copy.

Key Timelines and Notification Expectations

Observe statutory and contractual deadlines for breach notifications, regular reviews, and retention to remain compliant with HIPAA and related obligations.

Effective Date:

Date BAA starts (MM/DD/YYYY)

Annual Review:

Review security controls yearly

Breach Notification:

Notify promptly; HHS notifications within 60 days (45 CFR §164.408)

Subcontractor Updates:

Update flow-down terms when subcontractors change

Termination Actions:

Return or destroy PHI on termination

Supporting Documents and Export Options

Include supporting schedules and preserve signed BAAs in secure, auditable formats; choose formats that maintain an audit trail and are easy to retrieve for compliance.

Supporting Schedule

Include an exhibit listing PHI categories, systems in scope, and processing activities; attach technical safeguards and contact lists for incident response.

Signed PDF

Save the fully executed document as an audit-ready PDF with timestamped audit trail metadata to preserve signature attribution and integrity.

Export Formats

Retain copies in PDF and DOCX; keep the original signed PDF (ISO-compatible) for legal admissibility and rapid retrieval.

Access Logs

Keep system access logs and encryption key management records alongside the BAA for audit purposes and breach investigations.

Practical Tips for Accurate, Efficient BAA Completion

Use a consistent, organization-wide BAA template and involve legal, compliance, and IT early to reduce rework and close onboarding faster.

Use a Standard Template

Maintain a vetted BAA template to reduce negotiation cycles and ensure required HIPAA clauses are always present.

Involve IT Early

Confirm technical controls and encryption requirements before signing to prevent later noncompliance or remediation costs.

Require Subcontractor Flow-Down

Ensure the vendor commits to cascading BAA terms to subcontractors and provides attestations or copies of subcontracts.

Keep Execution Records

Store the executed BAA with a clear audit trail (signer, timestamp, IP, version) to support audits and investigations.

How Organizations Use a HIPAA Business Partner Contract in Practice

Real organizations use BAAs to enable cloud services, analytics, and outsourced billing while documenting PHI responsibilities and breach response commitments.

Fertility Centers of Illinois

Fertility Centers adopted an e-signed BAA to support remote patient intake and records sharing.

The vendor retained audit trails for every signer.
The signed BAA, combined with technical controls, helped streamline vendor onboarding and provided documented evidence of HIPAA obligations during operational reviews.

Xerox (NetSuite Integration)

Xerox integrated e-signatures into existing ERP workflows to collect vendor BAAs electronically.

The process included API-based storage and audit logs.
Centralizing executed BAAs improved retrieval for audits and reduced manual recordkeeping time across legal, compliance, and procurement teams.

eSignature Vendor Comparison for BAAs — pricing and core capabilities

Compare starting prices and key capabilities relevant to HIPAA BAAs. signNow is listed first per the vendor order requirement.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	7-day free trial	Varies by plan	Varies by plan	Varies by plan	Varies by plan
Bulk Send	Yes	Yes	Yes	Yes	Varies
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes	Yes	Yes	No	No

Frequently Asked Questions About the HIPAA Business Partner Contract

Answers to common legal and practical questions about when a BAA is required, what it must contain, and how to execute and store the agreement.

Need help? Contact support

Is a BAA required?
Yes. A BAA is required whenever a vendor will create, receive, maintain, or transmit PHI on behalf of a covered entity; see 45 CFR §164.502(e) and §164.504(e).
Can the BAA be electronically signed?
Yes. Electronic signatures are valid under the ESIGN Act (15 U.S.C. ch. 96) and UETA where adopted; ensure intent, consent, attribution, and retention are documented.
Does the BAA need notarization?
Not typically. Notarization is not required by HIPAA for a BAA, though specific state rules or internal policies may require notarization for contract validity.
What about subcontractors?
The business associate must require subcontractors to comply with BAA terms and implement safeguards; include flow-down clauses and require proof of compliance.
How quickly must breaches be reported?
Report breaches without unreasonable delay and no later than 60 days to affected individuals and HHS as required by the HIPAA Breach Notification Rule (45 CFR §164.408).
How should executed BAAs be stored?
Store executed BAAs with a clear audit trail in secure, access-controlled repositories; maintain signed PDFs and logs for at least six years per 45 CFR §164.530(j).

Explore Templates

Boston College Academic Transcript Request Form Quinnipiac Request Transcript Form UMass Dartmouth Transcript Request Form Ole Miss Transcript Request Form Transcript Request Allen University Transcript Request Form

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now