HIPAA BAA template: the HHS sample clauses and how to adapt them

Where the HHS sample BAA comes from

HHS publishes sample business associate agreement provisions (opens in a new tab) on hhs.gov. That site blocked our automated check, so we worked from the version HHS first published as an appendix to the August 14, 2002 Privacy Rule amendments (opens in a new tab), and from today's rule text.

HHS's own caveat is worth repeating. The 2002 statement of intent says "use of these sample provisions is not required," the language "may be amended" to fit the business arrangement, and the provisions "alone are not sufficient to result in a binding contract under State law." It adds that the sample "does not replace consultation with a lawyer."

The 2002 version covers only the Privacy Rule. The template below adds what 45 CFR 164.504(e) (opens in a new tab) and 45 CFR 164.314(a) (opens in a new tab) now require: Security Rule compliance, incident and breach reporting, and written subcontractor flow-down. For the full list, see the required BAA clauses.

Definitions and permitted uses

What it says. Undefined terms take their HIPAA meaning. The permitted-use clause lists what the vendor may do with PHI, or points to the main services agreement. The vendor may not use PHI in a way that would break the Privacy Rule if your practice did it.

Commonly negotiated (illustrative). Whether the vendor may de-identify data or use it "to improve services," and whether it may use PHI for its own management and administration, which the rule allows if the contract says so. If you're unsure the vendor even qualifies, check who is a business associate.

Safeguards and the Security Rule

What it says. The vendor must use appropriate safeguards and comply with the Security Rule (Subpart C of Part 164) for electronic PHI.

Commonly negotiated (illustrative). Named controls such as encryption, multi-factor authentication and audit logging, and whether data may leave the US.

Breach and security-incident reporting

What it says. The vendor must report any use or disclosure the agreement doesn't permit, any security incident it becomes aware of, and breaches of unsecured PHI. Under 45 CFR 164.410 (opens in a new tab), that breach notice is due "without unreasonable delay and in no case later than 60 calendar days after discovery," and must identify affected individuals where possible.

Commonly negotiated (illustrative). A shorter window. Some vendors commit to one in their standard terms: HubSpot's BAA terms say it will report a breach "no later than ten (10) business days after discovery" (HubSpot Sensitive Data Terms (opens in a new tab)). Also negotiated: who pays for notifying patients. Your own duties to patients are set by the breach notification rule.

Subcontractors

What it says. The vendor must make sure any subcontractor that handles your PHI agrees in writing to the same restrictions and conditions (45 CFR 164.502(e)(1)(ii) (opens in a new tab)). You don't sign with the subcontractors yourself.

Commonly negotiated (illustrative). A list of subcontractors that receive PHI and notice before new ones are added. The chain is explained in subcontractor agreements.

Patient rights: access, amendment, accounting

What it says. If the vendor holds records patients can request, it must make them available for access and amendment, and keep the information you need to give an accounting of disclosures. It must also open its books and records to HHS for compliance reviews.

Commonly negotiated (illustrative). Turnaround times, in days, so you can meet your own deadlines to patients. The 2002 sample leaves these as "[Insert negotiated terms]."

Term, termination and return of PHI

What it says. The agreement runs from an effective date until the services end. You may terminate if the vendor violates a material term. At the end, the vendor returns or destroys all PHI, including copies held by subcontractors. If that isn't feasible, it extends the agreement's protections and limits further use to the reasons return is infeasible.

Commonly negotiated (illustrative). A cure period before termination, which the 2002 sample offers as an option. A deadline and a written certificate for destruction. How backups are handled. Agencies' versions of these terms belong in your marketing agency contracts.

Copy the HIPAA BAA template

Template version: October 23, 2026. Replace bracketed fields, then have your attorney review it.

Business Associate Agreement

1. Parties and effective date. This Agreement is between [Practice legal name] ("Covered Entity") and [Vendor legal name] ("Business Associate"), effective [date].
2. Definitions. Capitalized terms not defined here have the meanings given in 45 CFR Parts 160 and 164 ("HIPAA Rules").
3. Permitted uses and disclosures. Business Associate may use or disclose PHI only to perform [list services, or name the services agreement], as required by law, or [optional: for its proper management and administration as permitted by 45 CFR 164.504(e)(4)], consistent with Covered Entity's minimum necessary policies.
4. Safeguards. Business Associate will use appropriate safeguards and comply with Subpart C of 45 CFR Part 164 for electronic PHI.
5. Reporting. Business Associate will report to Covered Entity any use or disclosure not provided for by this Agreement, any Security Incident, and any Breach of Unsecured PHI as required by 45 CFR 164.410, within [number] [business/calendar] days of discovery.
6. Subcontractors. Business Associate will ensure, under 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2), that any subcontractor that handles PHI on its behalf agrees in writing to the same restrictions, conditions and requirements.
7. Individual rights. Business Associate will make PHI available for access (45 CFR 164.524) and amendment (164.526), and maintain the information needed for an accounting of disclosures (164.528), within [number] days of Covered Entity's request.
8. Covered Entity obligations. Where Business Associate carries out an obligation of Covered Entity under Subpart E of 45 CFR Part 164, it will comply with the requirements that apply to Covered Entity.
9. Books and records. Business Associate will make its internal practices, books and records available to the Secretary of HHS for determining compliance.
10. Term and termination. This Agreement ends when [the services agreement ends / date]. Covered Entity may terminate this Agreement if Business Associate violates a material term [optional: and fails to cure within [number] days of written notice].
11. Return or destruction. On termination, Business Associate will return or destroy all PHI, including PHI held by subcontractors, and retain no copies, certifying destruction in writing within [number] days. If return or destruction is infeasible, Business Associate will extend this Agreement's protections to that PHI and limit further uses to the purposes that make return infeasible.
12. Survival and interpretation. Section 11 survives termination. Ambiguities are resolved to permit compliance with the HIPAA Rules.

Signatures: [Name, title, date] for each party.

Medfy signs a BAA with every practice; see Medfy's BAA and safeguards. To check which of your tools touch patient data, start with a free marketing audit. For the overview of which vendors need a BAA at all, see business associate agreements.

Frequently asked questions

Is there an official HHS BAA template?

HHS publishes sample business associate agreement provisions, not a mandatory form. In the version we read, HHS says using the sample is not required, the language may be amended to fit the arrangement, and the provisions alone are not sufficient to create a binding contract under state law. Treat it as the list of required concepts and have your attorney turn it into a contract.

Can we use the vendor's BAA instead of ours?

Yes, and with large platforms you usually must; Microsoft, for example, says it can't use a customer's BAA. What matters is the content, not whose letterhead it's on. Check the vendor's version against the clauses 45 CFR 164.504(e) requires, confirm which products and plans it covers, and have your attorney review terms such as liability caps before you accept.

Does a BAA need to be signed by both parties?

HIPAA requires a written contract or other written arrangement, and the rule text doesn't spell out signature formalities. Large vendors often use click-through acceptance; AWS, for example, has customers accept its BAA in AWS Artifact. Whether a given form of acceptance is enforceable is a state contract-law question, so keep a dated copy of the accepted agreement and ask your attorney.

How often should a BAA be updated?

HIPAA sets no fixed schedule. Review a BAA at renewal, when the vendor's service, plan or subcontractors change, and when the rules change, as they did in 2013. The Security Rule asks for documentation to be reviewed periodically and kept for six years, so a yearly check alongside your risk analysis is a sensible habit. Have counsel confirm any changes.