Business Associate Agreement Templates for Healthcare

A HIPAA business associate agreement (BAA) is a contract required under federal law before a vendor can create, receive, maintain, or transmit Protected Health Information (PHI) on behalf of a healthcare practice. The requirement comes from the HIPAA Privacy Rule, at 45 CFR §164.504(e), and the Security Rule, at 45 CFR §164.308(b), and both call for the agreement to be signed before the vendor gets access to patient data, not after.

Skipping this step, or relying on an agreement that predates the 2013 HIPAA Omnibus Rule, puts both the practice and the vendor at risk of direct enforcement from the Department of Health and Human Services Office for Civil Rights (OCR). This guide covers what a compliant BAA must include, how requirements differ by vendor type, and the mistakes that show up most often when OCR investigates a breach involving a business associate.

The Privacy Rule and Security Rule together set the floor for what a BAA must contain. The 2013 Omnibus Rule, which implemented provisions of the HITECH Act, expanded these requirements by making business associates directly liable for HIPAA compliance rather than leaving enforcement to the covered entity's contract terms.

A vendor that signs a BAA but fails to implement the required safeguards can now face its own OCR investigation, independent of any report from the covered entity. HHS publishes sample BAA provisions covering the minimum required language, though every sample still needs customization for the specific vendor relationship. For more on how BAAs fit into the broader compliance picture, see our overview of HIPAA cybersecurity requirements.

Cloud providers, EHR vendors, billing companies, IT and managed security vendors, and professional service firms all qualify as business associates if they touch PHI, but a single generic template rarely fits all of them. Cloud vendors need provisions on data residency, encryption standards, and their own subprocessor relationships; AWS, Microsoft Azure, and Google Cloud each publish standard HIPAA BAA addenda, and a practice should review that language rather than sign it unread.

EHR and billing vendors carry the broadest PHI access and need explicit limits on using claims or clinical data for analytics or their own business development. IT support and managed security vendors often hold administrative credentials that reach every system in the practice, so their BAA should address access logging, background checks for staff with PHI access, and incident response coordination.

Behavioral health providers face an extra layer of restriction. Federal rules under 42 CFR Part 2 limit disclosure of substance use disorder treatment records more tightly than standard PHI, and BAAs with EHR or storage vendors need to reflect that overlay; see our guide to 42 CFR Part 2 compliance for addiction treatment centers for how the two frameworks interact.

Telehealth platforms raise jurisdiction questions when the patient, the provider, and the hosting server sit in different states. Our guide to HIPAA-compliant video conferencing for telehealth providers covers the retention and security provisions those agreements need. AI diagnostic and clinical decision support tools add a newer question: whether patient data used to train or refine a model counts as a disclosure under the Privacy Rule, so a BAA with an AI vendor should state directly whether patient data trains its models and how de-identification is handled.

Signing a BAA doesn't end the practice's obligation. OCR expects covered entities to actively monitor whether vendors are meeting their commitments, not just file the signed contract. Annual security questionnaires for high-risk vendors, current SOC 2 Type II or ISO 27001 certifications, and on-site audit rights for the highest-access vendors all give a practice evidence that oversight is actually happening.

Staff who manage vendor relationships benefit from training on how to evaluate security certifications and when to escalate concerns; our security awareness training guide covers what that training should include. When OCR investigates a breach involving a business associate, it looks at whether the covered entity had reasonable oversight in place, so this kind of monitoring fits into a practice's broader healthcare data security plan, not a separate compliance task.

Vendor risk has gotten more attention since the February 2024 ransomware attack on Change Healthcare, which disrupted pharmacy and billing operations for providers across the country and showed how one vendor relationship can affect downstream practices at scale. Modern BAAs increasingly require vendors to disclose ownership or key personnel changes, report their own security incidents even when covered entity PHI isn't confirmed affected, and carry cyber insurance at a specified minimum.

Ransomware also complicates breach notification, because many attacks exfiltrate data before encrypting it, which can meet the definition of a breach under the HIPAA Breach Notification Rule even if the attacker never opened a patient file. A BAA should treat a ransomware incident as a presumptive breach, subject to the 60-day notification window, unless the vendor can show PHI wasn't accessed.