Updated:
A business associate agreement (BAA) is a HIPAA contract covering patient data. Under 45 CFR 164.502(e), a covered entity documents a business associate's safeguards in a written contract. Health care providers, health plans and clearinghouses sign one with vendors handling patient data.
Key facts
Build Your Document
Answer a few simple questions to make your document in minutes
Save and Print
Save progress and finish on any device, download and print anytime
Sign and Use
Your valid, lawyer-approved document is ready
A HIPAA business associate agreement is a written contract between a covered entity and a vendor that handles its protected health information (PHI), setting what the vendor may do with that data and how it protects it.
The agreement turns the vendor's promise to protect patient data into signed contract terms. Under 45 CFR 164.502(e), a covered entity may disclose PHI to a business associate if it obtains satisfactory assurance that the business associate will appropriately safeguard the information. The BAA is where that assurance is written down.
The agreement is also called a business associate contract, a HIPAA agreement or a BAA form. Each name refers to the same document.
A business associate is defined in 45 CFR 160.103 as a person that creates, receives, maintains or transmits PHI on behalf of a covered entity, other than as a member of its workforce. The definition names these business associate examples:
Under 45 CFR 160.103, the term also includes a Health Information Organization, an E-prescribing Gateway, a vendor that offers a personal health record on behalf of a covered entity, and a subcontractor that handles PHI on behalf of a business associate. The same definition says a covered entity may be a business associate of another covered entity.
A covered entity is the party that shares PHI with the business associate. Under 45 CFR 160.103, a covered entity is one of three kinds:
The business associate definition in 45 CFR 160.103 leaves out several relationships, so no BAA covers them:
When both the covered entity and the business associate are governmental entities, 45 CFR 164.504(e) lets them use a memorandum of understanding with the same objectives in place of a BAA.
A business associate agreement is needed before a covered entity lets a vendor create, receive, maintain or transmit PHI on its behalf, because 45 CFR 164.502(e) ties the disclosure to satisfactory assurances documented in writing.
Under 45 CFR 164.502(e), the satisfactory assurances must be documented through a written contract or other written agreement or arrangement with the business associate that meets the applicable requirements of § 164.504(e). A verbal promise or a privacy statement on a vendor's website is not that document.
A subcontractor BAA is the agreement between a business associate and its own vendor that handles the same PHI. Under 45 CFR 164.502(e), a business associate may let a subcontractor handle PHI if it obtains satisfactory assurances that the subcontractor will appropriately safeguard the information, and the covered entity is not required to obtain them from the subcontractor itself.
Under 45 CFR 164.504(e), the contract requirements for a covered entity and a business associate apply in the same manner to the contract between a business associate and its subcontractor. A cloud host used by a billing company is one example of that chain.
A business associate agreement sets the permitted uses of PHI and the business associate's duties, and 45 CFR 164.504(e) lists the terms the contract must hold:
The H3 sections below explain the terms that most often need attention when the agreement is filled in.
The permitted uses clause is the core of the BAA: it names what the business associate may do with PHI for the covered entity. Under 45 CFR 164.504(e), the contract may not authorize a use or disclosure that would violate the Privacy Rule if the covered entity made it, except that it may permit uses for the business associate's proper management and administration and data aggregation services relating to the covered entity's health care operations.
Under 45 CFR 164.504(e), the contract may also let the business associate disclose PHI for its own management or legal responsibilities, but only if the law requires the disclosure, or if the recipient gives reasonable assurances of confidentiality and notifies the business associate of any breach of it.
The safeguards clause commits the business associate to protect PHI and to report misuse. Under 45 CFR 164.504(e), the contract provides that the business associate will use appropriate safeguards and report to the covered entity any use or disclosure not provided for by its contract of which it becomes aware.
Under 45 CFR 164.410, a business associate notifies the covered entity of a breach of unsecured PHI without unreasonable delay and in no case later than 60 calendar days after discovery of a breach, except as § 164.412 provides. Under 45 CFR 164.410, the notice includes, to the extent possible, the identification of each individual whose unsecured PHI has been, or is reasonably believed to have been, accessed, acquired, used or disclosed during the breach.
The patient rights clauses keep a patient's requests working when the data sits with a vendor. Under 45 CFR 164.504(e), the business associate makes PHI available for access under § 164.524, for amendment under § 164.526, and for an accounting of disclosures under § 164.528.
The termination clause decides what happens to patient data when the work ends. Under 45 CFR 164.504(e), at termination of the contract the business associate returns or destroys all PHI it still maintains, if feasible, and keeps no copies; if return or destruction is not feasible, the protections of the contract extend to the information and further uses are limited to the purposes that make return or destruction infeasible.
The material breach clause gives the covered entity a way out of the contract. Under 45 CFR 164.504(e), the contract authorizes termination by the covered entity if the covered entity determines that the business associate has violated a material term of the contract.
The business associate agreement form has preprinted terms and a few blanks: the parties, the permitted purposes, the term and the signatures.
The template runs five pages. It has six numbered parts, covering definitions, obligations and activities of the business associate, permitted uses and disclosures, provisions for the covered entity, term and termination, and miscellaneous items. A signature block for each party closes the form.
The business associate agreement is filled out in four steps: the date and parties, the permissible purposes, the term dates and the signatures. The FormsPal PDF editor opens the PDF for completion on screen.
The screenshots under each step show the FormsPal Business Associate Agreement HIPAA template filled with sample entries in blue, so you can see where each answer goes. The names, addresses, dates and amounts are examples only.
Enter the date and parties
In the first paragraph, enter the agreement date, then the name of the Covered Entity and the name of the Business Associate in the two name blanks. Use each organization's full name as it appears in its own papers.
Write the permissible purposes
On page 2, write on the four lines the purposes for which the Business Associate may use or disclose protected health information. Name the actual services, such as claims processing or transcription, rather than a vague phrase.
Set the effective and termination dates
On page 3, enter the date the agreement takes effect and the date it ends in the two Term blanks. The rest of the termination wording is preprinted, so leave it as it is.
Sign the signature blocks
On page 5, each party signs on its By line, then prints a name and a title on the lines beneath. The Covered Entity uses one block and the Business Associate the other.
A signed BAA matches what both sides actually do with patient information only when its blanks are checked against the service contract before signing.
A business associate agreement takes effect on the effective date both parties sign to in the Term blanks on page 3.
Most BAA problems start before anyone signs, from skipping the agreement to filling in the form too fast.
A signed BAA does not end the covered entity's own duty. Under 45 CFR 164.504(e), a covered entity that knew of a pattern of activity or practice of the business associate that was a material breach of the contract is not in compliance, unless it took reasonable steps to cure the breach or end the violation and, if those steps failed, terminated the contract, if feasible. The same section applies that rule to a business associate that knew of such a pattern by its subcontractor.
A business associate agreement covers only work that involves protected health information; other confidentiality and service contracts fit other work.
These answers cover the questions people ask most often about the business associate agreement, from what PHI covers to whether the HIPAA rules reach the vendor itself.
A business associate agreement is a signed contract, so its terms bind both parties like any other contract they sign. Under 45 CFR 164.504(e), the contract authorizes the covered entity to terminate it if the business associate violates a material term.
The Privacy Rule binds a business associate directly: under 45 CFR 164.502(a)(3), a business associate may use or disclose PHI only as permitted or required by its business associate contract or as required by law. Under 45 CFR 164.504(e), to the extent the business associate carries out such an obligation, it complies with the requirements of the Privacy Rule that apply to the covered entity in the performance of that obligation.
PHI is individually identifiable health information, as defined in 45 CFR 160.103, transmitted or maintained in electronic media or in any other form or medium. The same definition excludes information in education records covered by the Family Educational Rights and Privacy Act.
A covered entity can be a business associate of another covered entity, as stated in 45 CFR 160.103. A hospital that provides billing services for another provider is one example.
A government covered entity and a government business associate can use a memorandum of understanding in place of a BAA. Under 45 CFR 164.504(e), the memorandum contains terms that accomplish the objectives of the business associate contract requirements.
Yes. Download the PDF and complete it with the PDF editor linked in the steps above, or build the document online with the Create My Document button.
General information, not legal or tax advice.
