What is a business associate agreement (BAA)? HIPAA compliance explained + template

November 24, 2025 8 min

Author:
Olga Asheychik
Senior Web Analytics Manager at PandaDoc

What is a business associate agreement

The stakes are high if your business handles protected health information (PHI) and partners with third-party vendors. It’s easy for missteps to happen, which can mean large fines and a damaged reputation, not to mention putting your business at legal risk and losing patient trust.

Under the Health Insurance Portability and Accountability Act (HIPAA) regulations, there are some entities that need to secure formal contracts, known as business associate agreements (BAAs), when vendors touch PHI.

What does this mean? If you’re a “covered entity” or you work with them, you need to make sure you’re compliant.

This article will walk you through everything you need to know about BAAs and more.

Here’s what we’ll cover:

• What exactly a business associate agreement (BAA) is and why it matters
• Who qualifies as a “covered entity,” who is a “business associate,” and when subcontractors come into play
• Key elements that a compliant BAA must include, plus pitfalls you should avoid
• How to make sure your BAA process works in practice when it comes to vendor oversight, breach procedures, audit readiness, and more
• The consequences of handling HIPAA-requirements and BAAs incorrectly

Let’s dive in!

What is a business associate agreement?

A BAA forms a legal contract between a covered entity and a business associate.

It’s important to note that not every business that deals with PHI needs a business associate agreement. The law only applies to the covered entities that are listed above.

Associates that need business associate agreements under HIPAA include:

• Associates that disclose PHI. This may cover an associate if they carry out some of the following tasks: Data administration, data analysis, and QA testing.
• Associates that disclose PHI when handling, accrediting, managing, consulting, aggregating, or carrying out financial activities for a covered entity.

What is a covered entity?

According to HIPAA rules, a covered entity can be any of the following:

• A healthcare provider
• A healthcare clearinghouse
• A healthcare provider that electronically transmits PHI. This covers any transactions that the Department of Health and Human Services (HHS) has adopted standards for.
• A “hybrid entity” that carries out HHS-covered electronic transitions. Most commonly, this applies to universities with student medical centers.

If you fall into any of the categories listed above, you will need a business associate contract.

What is a business associate?

“Business associate” is a broad term. It covers anyone who performs activities for a covered entity that involve working with PHI.

Typically, covered entities do not carry out health care activities themselves, preferring instead to outsource these tasks to external organizations. When this happens, these providers are classed as business associates.

Below are some examples of business associates:

• Vendors that carry out file sharing
• Companies that service medical equipment containing PHI
• Services that translate files
• Lawyers
• Cloud-based software providers
• Accountancy or consulting services
• File shredding services.

What is a subcontractor?

Your business associates may decide to outsource some of their services to external businesses. These are known as subcontractors.

You may only have an arrangement with a business associate. However, a subcontractor may be carrying out some services and working with your data.

What about employees?

As employees work for you, they are not classed as business associates. Staff that work with PHI don’t need to sign a BAA contract. When it comes to responsibility, however, the HHS is clear. It’s the job of the employer to ensure that staff are clued up. It’s important that you provide training so employees know how to keep PHI safe.

What about contractors?

Contractors hired by your business to carry out certain tasks are not associates. It is, however, still your responsibility if a contractor breaches PHI. In this scenario, a BAA is not required. The HHS reasons that a contractor working solely for you would not have the infrastructure to generate their own policies. Rather, HHS says that a confidentiality agreement is needed.

Key elements that a compliant BAA must include

When putting together your BAA agreement, there are many important BAA requirements to account for. Let’s look at some of the key ingredients that should be found within a BAA contract.

Clarify disclosure and use of PHI

This should form the basis of your BAA document. Your contract should clarify how an associate can use PHI. In other words, what services do you need them to complete? How does data play a part in those services? The agreement should specify that the use of data outside those requirements (unless specified by law) is a breach of contract.

Storage of data

HIPAA documents privacy and security requirements are clearly outlined. It’s important that PHI is stored safely and securely. Specify requirements for associates when storing PHI. What protections and firewalls need to be in place in case of a breach? You should also consider availability. HIPAA specifies a “right of access” for individuals. This allows patients to view their health data if they wish.

Liability

The HHS is free to investigate businesses at any time. If they find that you have breached HIPAA, who will be held responsible? It’s important that your agreements hand liability to a single party. Specify the consequences for failure to comply.

Education and training

Both parties need to ensure employees have an understanding of the law. Outline a clear set of protocols for education and training. Ultimately, staff should know how to keep PHI safe. They should know what they can and cannot do under the legislation.

Response to data breaches

How should an associate respond if a data breach occurs? Outline a step-by-step process for notifying your organization and responding. Consider steps that can be taken to reduce the harm of a data breach. It’s important not to overlook associates working with subcontractors. Establish the need for an equally clear protocol with third parties.

Data deletion

HIPAA specifies that individuals have the right to request their PHI be deleted. Ensure that your contract shows how you will meet this requirement. How should parties delete data if they receive a request?

Uniform procedures

As mentioned, associates may work with subcontractors to provide certain services. To ensure the protection of PHI, stipulate that associates apply the same conditions to subcontractors. Ask that associates inform you of how they’re working with subcontractors, and what data is being used.

What not to include

Unclear formatting

There will be times when you need to find important documentation at a pinch. Inconsistent formatting can impact your ability to find your document quickly. Try to establish a clear and uniform structure.

Overly complex documentation

It’s vital that both parties can understand your policies. Staff need to read and understand the documentation. Using overly complex “legalese” and writing reams of text will only confuse matters.

Unassessed policies

It goes without saying that your BAA document needs to be HIPAA compliant. The policies that you include must all work within the framework of legislation. Conduct risk assessments to ensure your document is in line with legal guidelines.

What happens when HIPAA regulations are violated?

Violating HIPAA can mean serious consequences for you and your business. The severity of the punishments depends on the “tier” of the infringement. HIPAA punishments are separated into four tiers. Aside from monetary fines, individuals can face jail time. The length of imprisonment ranges from one to ten years.

FAQ

• Is a business associate agreement legally required?
  Yes. A business associate agreement (BAA) is legally required under the Health Insurance Portability and Accountability Act (HIPAA). All covered entities need to have a signed BAA in place before sharing any protected health information (PHI) with a business associate or subcontractor. Without this, both parties will risk HIPAA violations and significant penalties.

• What's the difference between a BAA and an NDA?
  A BAA governs how PHI is used, protected, and disclosed under HIPAA. A non-disclosure agreement (NDA), on the other hand, protects confidential business information in general. You can think of an NDA as a broader confidentiality contract, and a BAA as a specific compliance agreement that helps safeguard PHI under federal law. Some businesses choose to use both when both PHI and proprietary data are shared.

• How long is a business associate agreement good for?
  A BAA continues to be in effect for as long as the business associate performs services involving PHI for the covered entity, or until the agreement is terminated in writing. But both parties need to keep documentation of the agreement for at least six years after termination to comply with HIPAA’s record-keeping requirements.

• What's the difference between a business associate and a contractor?
  All business associates are contractors, but not all contractors are business associates. A business associate specifically handles, processes, stores, or transmits PHI on behalf of a covered entity. A contractor could provide unrelated services, like marketing or office maintenance, for example, without accessing PHI. In this case, you wouldn’t need a BAA.

• Can a BAA be signed electronically?
  Yes! HIPAA and the U.S. Department of Health and Human Services (HHS) both recognize electronic signatures as valid for BAAs, as long as the signature solution meets any applicable authentication and record-keeping standards. You can use tools like PandaDoc to easily and securely create, send, and eSign compliant BAAs online.