Free HIPAA Business Associate Agreement (BAA) — Fill Out & Download Instantly
A HIPAA Business Associate Agreement (BAA) is a legally required contract between a HIPAA-covered entity (such as a hospital, physician practice, or health plan) and a business associate — any vendor, contractor, or subcontractor that creates, receives, maintains, or transmits protected health information (PHI) on behalf of the covered entity. Under the HIPAA Privacy Rule (45 CFR § 164.504(e)) and Security Rule, covered entities must have a signed BAA in place with all business associates before sharing PHI.
⚠️ Legal Disclaimer: This template is attorney-reviewed and built to US legal standards. It does not substitute for professional legal advice. For complex situations, we recommend consulting a licensed attorney.
What Is a HIPAA Business Associate Agreement (BAA)?
A HIPAA Business Associate Agreement (BAA) is a legally required contract between a HIPAA-covered entity (such as a hospital, physician practice, or health plan) and a business associate — any vendor, contractor, or subcontractor that creates, receives, maintains, or transmits protected health information (PHI) on behalf of the covered entity. Under the HIPAA Privacy Rule (45 CFR § 164.504(e)) and Security Rule, covered entities must have a signed BAA in place with all business associates before sharing PHI. Failure to execute a BAA can result in significant civil and criminal penalties.
When Do You Need It?
A HIPAA BAA is required whenever a covered entity shares PHI with an outside vendor or contractor who will use, access, or store that information to perform services on the covered entity's behalf. Common business associates include: cloud storage providers, billing services, IT support companies, practice management software vendors, transcription services, attorneys and accountants who access PHI, and shredding companies. The BAA must be in place before any PHI is shared.
What's Included in This Template
- State of governing law
- Covered entity name and address
- Business associate name and address
- Effective date
- Description of services performed
- Permitted uses and disclosures of PHI
- Required safeguards (administrative, physical, technical)
- Breach notification timeline (number of days)
- PHI return or destruction obligations upon termination
- Termination for cause provisions
How to Fill It Out
Legal Requirements & Notes
Under 45 CFR § 164.504(e), covered entities must have a written Business Associate Agreement in place with all business associates before sharing protected health information. Failure to execute or enforce a BAA can result in HIPAA violations carrying civil penalties of $100 to $50,000 per violation (up to $1.9 million per category per year) and potential criminal liability. The HITECH Act (2009) made business associates directly liable for HIPAA compliance. This template provides a general framework — healthcare organizations should have BAAs reviewed by HIPAA legal counsel to ensure compliance with current HHS guidance, state law, and their specific risk profile. HHS OCR provides model BAA language at hhs.gov.
Frequently Asked Questions
A BAA is a legally required contract between a HIPAA-covered entity and any vendor (business associate) that creates, receives, maintains, or transmits protected health information on the covered entity's behalf. The BAA establishes the permitted uses of PHI, safeguard requirements, breach notification obligations, and terms for PHI return or destruction at contract end.
Related Templates
HIPAA Consent Form
A HIPAA consent form (formally known as a HIPAA Authorization under 45 CFR § 164.508) is a written document that authori...
Medical Consent Form
A medical consent form documents a patient's informed consent to receive medical treatment or undergo a specific procedu...
Service Level Agreement (SLA) Template
A Service Level Agreement (SLA) is a contract between a service provider and a client that defines the expected level of...