Question 1

What is a Business Associate Agreement?

Accepted Answer

A Business Associate Agreement (BAA) is a legally required contract under HIPAA between a covered entity (such as a healthcare provider or health plan) and a business associate (any vendor or partner that handles protected health information on the covered entity's behalf). The BAA outlines each party's responsibilities for safeguarding PHI and establishes liability in the event of a breach.

Question 2

Who needs a HIPAA BAA?

Accepted Answer

Any HIPAA covered entity — including hospitals, physician practices, dental offices, health plans, and healthcare clearinghouses — must sign a BAA with any vendor or service provider that creates, receives, maintains, or transmits protected health information (PHI) on their behalf. Common examples include EHR vendors, billing companies, cloud storage providers, and IT support firms.

Question 3

What happens if you don't have a BAA in place?

Accepted Answer

Operating without a required BAA is a direct HIPAA violation and can result in civil monetary penalties ranging from $100 to $50,000 per violation (up to $1.9 million per year for repeated violations), federal audits, corrective action plans, and reputational damage. The HHS Office for Civil Rights (OCR) actively investigates missing BAAs during compliance audits and breach investigations.

Question 4

Is a BAA the same as an NDA?

Accepted Answer

No. A Non-Disclosure Agreement (NDA) is a general confidentiality contract that can be used in any industry to protect trade secrets or proprietary information. A Business Associate Agreement is a HIPAA-specific contract with legally mandated terms that govern how protected health information may be used, disclosed, and safeguarded. An NDA does not satisfy HIPAA BAA requirements.

Question 5

What must a HIPAA BAA include?

Accepted Answer

Under 45 CFR § 164.504(e), a HIPAA-compliant BAA must include: (1) a description of permitted uses and disclosures of PHI; (2) a requirement that the business associate not use or disclose PHI beyond what is permitted; (3) safeguard obligations; (4) breach reporting requirements; (5) requirements to ensure subcontractors also sign BAAs; (6) provisions for returning or destroying PHI upon termination; and (7) authorization for the covered entity to terminate if the BAA is materially breached.

Generate an Audit-Ready
Business
Associate
Agreement

How It Works

Provide Key Details

Review Your Agreement

Secure & Download

Built on Official HHS Model Provisions

What's Included

Ready to Protect Your Organization?

Generate an Audit-Ready Business Associate Agreement