A business associate agreement (BAA) is a contract that a healthcare organization signs with an outside company that handles its patient information. Use the FormsPal business associate agreement template below to build the document online, then download and print it. HIPAA rules dictate that these business associates are required by law to still protect and hide the health data that they have access to.
Last Updated: October 2026. This guide is reviewed and updated regularly. If you notice an error or outdated information, please contact us.
Build Your Document
Answer a few simple questions to make your document in minutes
Save and Print
Save progress and finish on any device, download and print anytime
Sign and Use
Your valid, lawyer-approved document is ready
A business associate is any organization or entity that accesses protected health information (PHI) to provide functions or activities to a covered entity. The service involves access to PHI and ranges from processing health insurance claims to transcription. This definition follows the US Department of Health and Human Services (HHS).
Other examples of business associates can include CPAs that require access to protected healthcare information to provide accounting services, consultants, benefits managers at pharmacies, or other subcontractors that need to access health information to perform their functions.
It should be noted that there are some legal exceptions that do not require a business associate agreement.
Every person or entity that is considered a business associate is required to still provide the necessary protection when it comes to PHI. They must have a specific, defined purpose for the health information in question, and prove that they have a secure system to store that information.
Business associates are required to provide a statement declaring that they will not disclose any protected information, other than what is required by the law. Also, business associates need a plan of action in the event of a breach to maintain their HIPAA compliance.
Covered entities are individuals, organizations, and agencies that have access to protected health information to provide a healthcare service. In a business associate agreement, the covered entity is the party that shares that information with the business associate. Under HIPAA, covered entities fall into three main categories:
Each covered entity must fulfill the privacy requirements under HIPAA. They must disclose how PHI is being used, and do everything they can to keep their data secure. When they coordinate with a business associate of some kind, there must be a business associate agreement between the covered entities and the business associates to ensure the associate will not use sensitive health information incorrectly.
To protect the health information of an individual, HIPAA outlines appropriate protections and procedures that must be taken by covered entities. However, covered entities will often use subcontractors to fulfill business purposes that they are not equipped to carry out.
In this case, PHI must still be protected from outside forces to ensure the privacy of clients. HHS has set business associate agreements in place as a legal way to allow business associates to fulfill their business obligations to the covered entities without compromising the privacy of PHI being exchanged between the two parties.
The signed agreement serves each side in a different way:
To ensure the privacy of sensitive health documents, the Health Insurance Portability and Accountability Act was created in 1996. HIPAA protects individuals from having their protected health information open to anyone besides their healthcare providers.
The focus of each agreement must be to only use health information for necessary purposes and to protect it from parties that do not need access to the information to fulfill their jobs. There are strict rules for what must be included within the business associate agreement itself. A business associate agreement must contain:
By including these stipulations, the agreement is meant to abide by the Privacy Rule created to safeguard individuals. Both parties must follow the rules required by the contract.
Beyond the blanks you fill in, the agreement spells out the points below.
All terms must be properly defined to avoid any confusion. Exactly what the business associate is required to do with the health data must be clearly defined. They must provide satisfactory assurances that health information will be protected, and provide breach notification to the covered entity when data has been compromised.
Also outlined within the document must be the permissible requests from the covered entity.
Lastly, the business associate and the covered entity must agree to only amend the document in writing with signatures from both parties. Any other provisions must be decided upon as well.
Most problems with a BAA start before anyone signs it, such as skipping the agreement or filling in the form too fast. Watch for these slips when you fill out the form. Use our non disclosure agreement template when you only need a general confidentiality contract.
Unfortunately, it is occasionally believed that business associates do not require a rigorous agreement like the ones required by HHS. While there are certainly exceptions to this rule, the vast majority of cases will need a proper business associate agreement or they are open to prosecution.
A business associate agreement does not remove any culpability from a covered entity. Both the covered entity and the business associate are required to abide by HIPAA, and if the business associate is found to have broken the privacy rule, the covered entity they have a contract with may also be held responsible.
An individual or entity that breaks HIPAA will be required to pay hefty fines. The HHS Office for Civil Rights (OCR) takes each HIPAA case very seriously and will prosecute any wrongdoing it may find. In addition, future clients may decide to go with companies that have not breached HIPAA privacy, causing a loss of potential profit. One case shows the scale. North Memorial Health Care was fined $1.55 million for not having a business associate agreement.
Creating an accurate BAA is necessary to be HIPAA compliant. The steps below follow the FormsPal Business Associate Agreement HIPAA template, a five-page form. Build it online with our form-building software, or download the PDF and complete it with the FormsPal PDF editor.
The screenshots under each step show the FormsPal Business Associate Agreement HIPAA template filled with sample entries in blue, so you can see where each answer goes. The names, addresses, dates and amounts are examples only.
To fill out a BAA correctly, these steps must be followed:
Date and parties
In the first paragraph, enter the agreement date, then the name of the Covered Entity and the name of the Business Associate in the two name blanks. The covered entity must first name themselves within the contract, as well as the business associate.
Permissible purposes
On page 2, write on the four lines the purposes for which the Business Associate may use or disclose protected health information. The exact use of data within the relationship between the covered entity and the business associate must be laid out.
Effective and termination dates
On page 3, enter the date the agreement takes effect and the date it ends in the two Term blanks. The rest of the termination wording is preprinted, so leave it as it is.
Signature blocks
On page 5, each party signs on its By line, then prints a name and a title on the lines beneath. The Covered Entity uses one block and the Business Associate the other.
A few minutes of checking before signing saves time later. Go through the points below with the vendor or company in front of you, so the finished business associate agreement template matches what both sides actually do with patient information.
After both parties sign, make a copy for each side and store the signed BAA with your other vendor records. Send the PDF by email or upload it to a shared folder so the right people can find it. The FormsPal builder lets you save your progress, finish on any device, then download and print the document anytime.
For work that does not involve patient information, other FormsPal templates may fit better, such as the confidentiality agreement template, the subcontractor agreement or the independent contractor agreement.
These answers cover the questions people ask most often about the business associate agreement template, from what PHI covers to which parts of the form you fill in and how to edit the PDF before printing.
HIPAA agreements of any kind are enforced by the law. By breaking the policies and procedures of a business associate agreement, the entity in question will be subject to civil penalties under the law. HHS does not allow health information to be misappropriated and expects its firm privacy rule to be followed. A HIPAA complaint can end up costing the offending party big money.
While a patient’s name or phone number may not seem like protected health information, it certainly can be. Any information that has been considered PHI in the past needs to be safeguarded. On the other hand, the release of information in critical situations (like a drug overdose) to family members is permitted and required in certain situations.
A covered entity is a healthcare provider, health plan or clearinghouse that creates or receives patient information. A business associate is an outside company that handles that information on its behalf, such as a billing company or a transcription service. The BAA is the contract that links the two, and it covers the work the associate does.
Save the finished document as a PDF, then send it by email or upload it to a shared folder. Ask the vendor to send back a signed copy, and keep both copies together with your other compliance records.
You fill in a few blanks and the signature blocks. The rest of the text is preprinted.
The template runs five pages. It has six numbered parts, covering definitions, obligations and activities of the business associate, permitted uses and disclosures, provisions for the covered entity, term and termination, and miscellaneous items. A signature block for each party closes the form.
Yes. Download the PDF and complete it with the PDF editor linked in the steps above, or build the document online with the Create My Document button.
General information, not legal or tax advice.
