HIPAA Business Associate Agreement
An agreement under HIPAA for a vendor that handles protected health information for a covered entity, covering permitted uses, safeguards, breach reporting and return of the information. The business associate signs first, then the covered entity.
For the United States.
The PDF is free to download. Centilio Sign is free to start.
What it covers
The template has 13 parts.
- Definitions
- Services
- Permitted uses and disclosures
- Safeguards
- Reporting
- Subcontractors
- Rights of individuals
- Carrying out the Covered Entity's obligations
- Duties of the Covered Entity
- Books and records
- Term and termination
- Return or destruction of PHI
- Interpretation and general
What you will be asked
Have these details ready. The template needs them before anyone signs.
- What services will the vendor provide that involve patient information?
Who signs
Everyone the template names, and what each one does.
- Business associateSigns
- Covered entitySignsSends it
Where it fits
For a US covered entity and a vendor that handles its protected health information. A business associate signing with its own subcontractor needs counsel to adapt it, and outside the US a data processing agreement fits better.
Before you rely on it
Original Centilio wording, not legal advice. It covers the required elements of a business associate agreement under the HIPAA Rules in plain English. Have your privacy officer or a US health privacy lawyer check it against your services, any stricter state law and the breach reporting time before you approve it.
Related templates
Client Intake and Consent Form
A new client form for a wellness or allied health practice that collects contact and health details and records consent to the service and the cancellation policy.
US, Canada, UK, Australia