Does a HIPAA Business Associate Agreement Expire? BAA Renewal Guide

By BAA Generator Editorial  ·  Published Apr 19, 2026  ·  Last reviewed Apr 19, 2026  ·  5 min read

One of the most common misconceptions about HIPAA BAAs is that they "expire" on a set schedule like an annual software license. That is not how BAAs work. Understanding what a BAA actually is makes this clearer — a BAA is a contract that governs an ongoing relationship, and it persists as long as that relationship persists unless actively terminated.

Do BAAs Have Expiration Dates?

HIPAA does not impose an expiration date on Business Associate Agreements. A BAA signed in 2018 is still legally valid and binding in 2026 if:

• Neither party has terminated it
• The relationship it governs is still active
• No regulatory changes have rendered its provisions non-compliant

Some BAAs include their own contractual expiration dates — for example, a BAA tied to a one-year service agreement might state "this agreement shall terminate upon the termination of the Service Agreement." That expiration is contractual, not a HIPAA requirement. If a BAA has no expiration clause, it does not expire by default.

Some organizations include automatic renewal clauses in their BAAs (e.g., "this agreement shall automatically renew annually unless terminated upon 30 days' notice"). This is a reasonable administrative structure but is not required by HIPAA.

When to Revisit and Update an Existing BAA

Even though BAAs don't expire, certain events should trigger a review — and potentially a formal amendment or replacement:

Vendor agreement renewal

When the underlying service contract renews, use that occasion to review the BAA. The services described in the BAA should still accurately reflect what the vendor does for you. If the vendor has added new features or data integrations, the BAA's permitted uses and data types need to match current reality.

Service scope changes

If the vendor begins handling PHI categories not described in the original BAA, or adds new subprocessors that weren't previously disclosed, the BAA needs to be updated. Common triggers include:

• Vendor adds AI/ML features that analyze PHI
• Vendor migrates to a new cloud infrastructure (new subcontractor)
• Your organization begins using a new module of the vendor's software that involves different PHI
• Vendor expands from data storage to also performing analysis

HIPAA regulatory changes

When HHS issues final rules amending the HIPAA Privacy, Security, or Enforcement Rules, existing BAAs may need to be updated to reflect the new requirements. The most significant example was the HITECH Act of 2009, which expanded BA obligations directly and required covered entities to update all existing BAAs. The 2025 HIPAA Security Rule updates similarly required BAA reviews. Monitor HHS rulemaking to catch these requirements.

Acquisition or ownership change of the vendor

If the vendor is acquired by another company or undergoes a merger, the existing BAA may no longer accurately identify the contracting entity. A new or amended BAA with the successor entity is needed. Do not assume the original BAA automatically transfers.

How to Set Up a BAA Review Schedule

A practical BAA review schedule for a small to mid-size practice:

Log each review in your BAA compliance log with the date reviewed and the outcome (no changes needed / amendment executed / replacement executed).

What Happens to the BAA When a Vendor Contract Ends

When you terminate the underlying service agreement with a vendor, you must also address the BAA. Under 45 CFR § 164.504(e)(2)(ii)(J), upon termination the business associate must:

• Return or destroy all PHI received from or created on behalf of the covered entity
• Retain no copies of the PHI
• If return or destruction is not feasible, extend PHI protections for as long as the PHI is retained and limit further uses and disclosures to those purposes that make return or destruction infeasible

Document the termination, including the date the service ended, the PHI disposition method (return or destruction), and any confirmation you received from the vendor. This documentation must be retained for 6 years. See our guide on how to terminate a BAA for the full process.

Frequently Asked Questions

Does a HIPAA BAA expire?

No. A HIPAA BAA has no statutory expiration date. It remains in effect until terminated by either party or superseded by a new agreement. Some BAAs include their own contractual expiration dates tied to an underlying service agreement — but that expiration is contractual, not a HIPAA requirement.

Should I renew my BAAs annually?

HIPAA does not require annual renewal. Best practice is an annual review — confirming terms still accurately reflect the vendor relationship — rather than automatic replacement. Replacing a BAA unnecessarily restarts the retention clock on the old document and creates administrative work without compliance benefit.

What happens to PHI after a BAA terminates?

Upon BAA termination, the business associate must return or destroy all PHI per 45 CFR § 164.504(e)(2)(ii)(J). If return or destruction is not feasible, the BA must continue to protect the PHI and limit further uses to those that make return/destruction infeasible. Document the PHI disposition and retain that documentation for 6 years.