Description
Every vendor, contractor, or service provider that handles protected health information on behalf of a covered entity needs a signed Business Associate Agreement before PHI is ever shared.
Missing or deficient BAAs are among the most frequently cited issues in HIPAA enforcement actions. The HIPAA Business Associate Agreement Template gives you a professionally written, complete contract template that covers all mandatory provisions under the Privacy Rule at 45 CFR 164.504(e) and the Security Rule. It is written to be clear and workable for both parties without cutting corners on regulatory requirements.
This template is designed to be adapted for a wide range of business associate relationships, from technology vendors and billing services to consultants and managed service providers. It covers everything OCR looks for in a compliant BAA.
What This Template Covers
- Definitions section aligned to HIPAA regulatory terminology
- Permitted and prohibited uses and disclosures of PHI
- Business associate safeguard obligations across administrative, physical, and technical categories
- Subcontractor and downstream business associate requirements
- Individual rights obligations covering access, amendment, and accounting of disclosures
- Breach notification obligations and required timelines
- Obligations upon termination or expiration of the agreement
- Return, destruction, or continued protection of PHI at termination
- Signature blocks and effective date provisions
Who This Is For
Healthcare providers, health plans, clearinghouses, and business associates that need a ready-to-use BAA template for vendor relationships, technology contracts, or service agreements involving PHI. Also useful for attorneys and compliance consultants who work with healthcare clients.
Delivered as an editable Microsoft Word (.docx) file. Available immediately after purchase.
