Business Associate Agreement

A business associate agreement allocates HIPAA duties when a covered entity or business associate gives another business associate access to protected health information for permitted services.

A useful document turns the parties' actual arrangement into measurable duties, approvals, timing, remedies, and a reliable execution record. Its terms should be reconciled to the transaction rather than copied from an unrelated form.

• A covered health provider hires a vendor that handles protected health information
• A business associate engages a subcontractor with PHI access
• A service arrangement changes the permitted uses, systems, or breach responsibilities for PHI

The document name alone does not determine the right structure. Consider a different instrument or qualified legal review when any of these conditions applies:

• Do not call ordinary personal data PHI or use a BAA when the parties do not have a HIPAA covered-entity or business-associate relationship.
• A BAA does not replace a security risk analysis, privacy notices, patient authorization, or other applicable data-protection contracts.

Record exact facts before clauses are written. Names, authority, dates, amounts, defined terms, dependencies, and incorporated materials should be verifiable and consistent.

• Covered entity, business associate, subcontractor chain, and underlying services
• PHI types, permitted uses and disclosures, systems, locations, and workforce access
• Administrative, physical, and technical safeguards plus incident contacts
• Breach reporting, individual requests, audit access, return or destruction, and termination limits

These decisions shape the allocation of responsibility and should not be left for boilerplate to decide:

• Whether each party is a covered entity, business associate, or subcontractor
• Which PHI uses are necessary for the services
• What incident facts and timing the parties can operationally report
• Whether PHI can be returned or destroyed at termination

• Permitted and required PHI uses and disclosures
• Safeguards and Security Rule obligations
• Breach, security-incident, and impermissible-use reporting
• Subcontractors, individual rights, records, and HHS access
• Termination, mitigation, return or destruction, and survival

Every provision should use the same parties, dates, standards, defined terms, and document hierarchy. A clause that is reasonable by itself can still create a conflict when it is not reconciled with payment, default, termination, or another exhibit.

1. 01Describe the intended result and the relationship in plain language.
2. 02Confirm parties, authority, governing jurisdiction, dates, money, property, services, and approvals.
3. 03Resolve the key decisions and identify every schedule, exhibit, disclosure, consent, or filing.
4. 04Draft the provisions as one consistent system, then review the complete execution set before signature.

A BAA copied without role and system analysis may promise impossible reporting or omit actual subcontractor flows. HIPAA duties attach by law when the relationship qualifies, even if the document is missing.

The main agreement may establish the framework while schedules, exhibits, disclosures, consents, or operational records supply transaction-specific details.

• Underlying services agreement
• Security controls and PHI systems schedule
• Incident-response and subcontractor list

Each incorporated document should be identified precisely, use the same names and effective date, and follow a stated order of precedence if terms conflict.

Map PHI before signing, verify security ownership and incident contacts, flow terms to subcontractors, connect request handling to operations, and review the BAA whenever systems or services change.

• Confirm legal names, roles, capacity, addresses, and signing authority
• Reconcile dates, amounts, definitions, cross-references, schedules, and exhibits
• Confirm that duties, deadlines, approvals, acceptance standards, and payment triggers are measurable
• Check that default, termination, remedies, and surviving obligations work together
• Complete jurisdiction-specific forms, notices, witnesses, notarization, filings, or professional review when applicable
• Deliver and preserve the complete signed package with its incorporated documents

These sources provide federal, state-resource, regulatory, or institutional context. They do not replace checking the law and required forms applicable to the parties, transaction, and governing jurisdiction.

1. Source 1

   Business Associate Contracts

   U.S. Department of Health and Human Services. HIPAA business-associate requirements and sample provisions.

2. Source 2

   The Security Rule

   U.S. Department of Health and Human Services. HIPAA administrative, physical, and technical safeguard requirements.

3. Source 3

   Breach Notification Rule

   U.S. Department of Health and Human Services. HIPAA breach-assessment and notification framework.