How to Create a HIPAA Business Associate Agreement (Step by Step)

By BAA Generator Editorial  ·  Published Apr 19, 2026  ·  Last reviewed Apr 19, 2026  ·  6 min read

Most HIPAA violations involving BAAs aren't about complex legal disputes — they're about organizations that simply never executed the agreement at all, or used a template missing required provisions. This guide walks through exactly what a BAA must contain and how to get one signed correctly.

Common business associates that require BAAs:

• EHR and practice management software vendors
• Medical billing companies and clearinghouses
• Cloud storage and backup services
• IT support companies and managed service providers
• Transcription and documentation services
• Telehealth video platforms
• Email service providers used for clinical communication
• Legal counsel who reviews patient records
• Accountants and auditors who access financial records containing PHI
• Document shredding companies (they physically access records)

Conduct this mapping annually and whenever you add a new vendor. A spreadsheet with vendor name, service description, PHI accessed, and BAA status is sufficient for most practices.

The 11 mandatory provisions a BAA must include:

1. Permitted uses and disclosures — what the business associate may do with the PHI
2. Prohibition on non-permitted uses — the BA may not use or disclose PHI other than as permitted
3. Appropriate safeguards — BA must implement reasonable safeguards to prevent unauthorized use
4. Reporting of breaches and security incidents — BA must report to covered entity within 60 days
5. Subcontractor requirements — BA must ensure subcontractors who access PHI have equivalent obligations
6. PHI access for individuals — BA must provide covered entity access to PHI for individual access requests
7. Amendment of PHI — BA must amend PHI per covered entity's direction
8. Accounting of disclosures — BA must make its accounting available to covered entity
9. Internal practices available to HHS — BA must make books and records available to HHS for compliance review
10. PHI at termination — BA must return or destroy all PHI upon termination of the agreement
11. Authorization for termination — covered entity may terminate if BA materially breaches the agreement

You have several options for drafting:

• HHS model BAA language — HHS publishes model contract provisions on its website. They're accurate but generic.
• BAA generator tool — produces a fully drafted, customized BAA in minutes based on your vendor relationship and services.
• Attorney-drafted template — appropriate for complex or high-value vendor relationships; expect $500–$2,500 in attorney fees.
• Vendor's standard BAA — most large vendors have their own. Review against the mandatory clause list before signing.

Key customization fields: covered entity name and contact, business associate name and contact, effective date, description of services, permitted uses of PHI, and specific breach notification contact information.

Execution process in practice:

1. Send the draft BAA by email (PDF or shared document link) with a cover note explaining what it is and asking for countersignature
2. Allow the vendor a reasonable review period (typically 5–10 business days for standard terms)
3. If the vendor proposes changes (redlines), review against the mandatory clause list — required provisions cannot be deleted, but negotiable provisions include breach notification timelines, indemnification, and liability caps
4. Once both parties agree, obtain electronic or wet-ink signatures from authorized signatories
5. Confirm the effective date — the BAA should be backdated if any PHI was already shared (note: sharing PHI before executing a BAA is itself a violation; don't compound it by leaving the BAA undated)

Practical storage and tracking recommendations:

• Store executed BAAs in a dedicated compliance folder in HIPAA-compliant cloud storage (Google Drive Workspace, Dropbox Business, OneDrive Business — all with their own BAAs)
• Maintain a master tracking spreadsheet: vendor, service, PHI type, BAA date, renewal/review date
• Set calendar reminders to review BAAs every 2–3 years or whenever a vendor's services change materially
• When a vendor relationship ends, note the termination date — the BAA must be retained for 6 more years
• Confirm the vendor has returned or destroyed your PHI per the BAA termination clause