# BAA Generator — HIPAA BAA Generator

> BAA Generator is a web application that generates HIPAA-compliant Business Associate Agreements (BAAs). Users answer a guided set of questions and receive a complete, audit-ready BAA document based on HHS model provisions. A free watermarked PDF is available; a clean PDF and editable Word (.docx) version are available for $49 — saving $500–$2,500 compared to attorney-drafted agreements.

## Key Facts

- **Price:** $49 one-time for a clean PDF plus editable Microsoft Word (.docx), or free with a watermarked PDF
- **Turnaround:** under 5 minutes from the first question to a downloadable file
- **Legal basis:** 45 CFR § 164.504(e); every clause is adapted from the HHS model Business Associate Agreement
- **Output formats:** PDF (free and paid) and Microsoft Word .docx (paid only)
- **How it compares:** a healthcare attorney charges $500–$2,500 for a BAA; subscription services (LegalZoom, Rocket Lawyer) charge $40–$80/month. BAA Generator is a $49 one-time fee with no account and no subscription.
- **Competitors:** hipaa.app ($59, Word + PDF), CaseMark ($25–$50 AI-generated), Terms.law (free interactive, no Word output), iFax and Lowerplane (free template downloads only)
- **No account required** for the free tier; no email required unless the user chooses the paid plan
- **Jurisdiction:** United States; BAAs are a HIPAA (federal) requirement, so the generator is valid in all 50 states

## Tool

- [BAA Generator](https://baagenerator.com/): Guided 11-step wizard that generates a HIPAA Business Associate Agreement. Covers covered entity details, business associate details, PHI types, permitted uses, safeguards, breach notification timeframes, term and termination, limitation of liability, and governing law. Output follows the HHS model BAA structure (6 sections + signature block) mapped to 45 CFR § 164.504(e).

## Pricing

- [Pricing](https://baagenerator.com/pricing): Free plan produces a watermarked PDF (legally valid, watermark indicates it was generated via BAA Generator). $49 one-time plan produces a clean PDF (no watermark) plus an editable Word .docx file. No subscription. Refunds considered within 7 days for technical defects. Comparison vs. healthcare attorney ($500–$2,500) and subscription legal services ($40–$80/mo).
- [Free BAA](https://baagenerator.com/free-baa): Details the free-tier path — watermarked PDF output, no email required, same clause coverage as paid version.
- [BAA Template](https://baagenerator.com/baa-template): Full walkthrough of the mandatory 45 CFR § 164.504(e) clauses with embedded HHS model language, plus optional clauses (indemnification, insurance, audit rights, choice of law).
- [Sample BAA](https://baagenerator.com/sample-baa): A fully annotated example BAA between fictional parties, with callouts explaining what each section does and why it is required.

## Comparisons

- [BAA Generator vs hipaa.app](https://baagenerator.com/vs/hipaa-app): $49 vs $59, both HHS-modeled, both produce Word + PDF. Primary difference is price and free tier availability.
- [BAA Generator vs CaseMark](https://baagenerator.com/vs/casemark): $49 one-time vs $25–$50 AI-generated. Primary difference is transparent pricing and HHS-model grounding vs AI generation.
- [BAA Generator vs Terms.law](https://baagenerator.com/vs/terms-law): $49/free vs free interactive. Primary difference is output format — BAA Generator produces a downloadable Word file, Terms.law is interactive-only.
- [BAA Generator vs LawDepot](https://baagenerator.com/vs/lawdepot): $49 one-time vs $40–$80/month subscription.
- [BAA Generator vs Rocket Lawyer](https://baagenerator.com/vs/rocket-lawyer): $49 one-time vs $40/month subscription.
- [Compare BAA Generators](https://baagenerator.com/compare): Hub page linking every head-to-head comparison page.
- [Best HIPAA BAA Generators in 2026 (Ranked)](https://baagenerator.com/blog/best-baa-generators-2026): Ranked listicle of every major BAA generator with price, output format, pros/cons, and who each tool is best for.

## About

- [About](https://baagenerator.com/about): Explains the methodology behind the generator — each clause maps to a specific provision of 45 CFR § 164.504(e) and the HHS model BAA. Includes a CFR-to-clause mapping table, review process (regulation cross-check, HHS alignment, OCR enforcement review), and the "not legal advice" disclaimer. Contact: support@baagenerator.com.

## Resources

- [HIPAA BAA for AI Vendors: Which AI Tools Sign a BAA?](https://baagenerator.com/blog/hipaa-baa-for-ai-vendors): Hub guide covering HIPAA BAA availability for AI and ML vendors — OpenAI (API + ChatGPT Enterprise: Yes; consumer: No), Anthropic (API + Claude Enterprise: Yes; consumer: No), Azure OpenAI (Yes, all commercial), Google Cloud Vertex AI (Yes, self-service), AWS Bedrock/SageMaker (Yes, via AWS Artifact), GitHub Copilot (Enterprise only), Sentry (Business/Enterprise), Datadog (Enterprise), Segment (Business/Enterprise), Mixpanel (Enterprise), Amplitude (Enterprise), FullStory (Enterprise), Hotjar (No). Includes explanation of the conduit exception, observability tool PHI risks, and what to do when a vendor won't sign.
- [Does Your Vendor Sign a HIPAA BAA? — Complete Vendor List](https://baagenerator.com/blog/does-your-vendor-sign-a-hipaa-baa): Hub page covering HIPAA BAA availability for 40+ major software vendors — Google Workspace, Microsoft 365, Zoom, AWS, Slack, Dropbox, DocuSign, Stripe, Mailchimp, HubSpot, Salesforce, Calendly, Notion, OpenAI, Anthropic, Azure, GCP, Twilio, SimplePractice, TherapyNotes, Sentry, Datadog, Segment, GitHub, and more. Each entry links to a full vendor-specific guide.
- [What Is a Business Associate Agreement?](https://baagenerator.com/blog/what-is-a-business-associate-agreement): Plain-language explanation of what a BAA is, why HIPAA requires one, who qualifies as a business associate, and the consequences of operating without one.
- [When Do You Need a HIPAA BAA?](https://baagenerator.com/blog/when-do-you-need-a-hipaa-baa): Explains which vendor relationships trigger the BAA requirement under 45 CFR § 160.103, including examples of relationships that do and do not require a BAA.
- [HIPAA BAA Requirements: What Must Be Included](https://baagenerator.com/blog/hipaa-baa-requirements): Clause-by-clause breakdown of the mandatory provisions under 45 CFR § 164.504(e) — permitted uses, safeguards, breach notification, subcontractor assurances, individual rights, and termination.
- [BAA vs. NDA: What's the Difference?](https://baagenerator.com/blog/baa-vs-nda-difference): Explains why a Non-Disclosure Agreement does not satisfy HIPAA's BAA requirement, with a side-by-side comparison of key differences.
- [HIPAA Compliance Checklist for Small Practices](https://baagenerator.com/blog/hipaa-compliance-checklist-for-small-practices): Practical checklist covering BAAs, security risk assessments, workforce training, technical safeguards, physical safeguards, and breach response for small healthcare organizations.
- [Does Google Workspace Sign a HIPAA BAA?](https://baagenerator.com/blog/does-google-workspace-sign-a-baa): Yes — Google Workspace signs a HIPAA BAA on all paid plans (Business Starter, Standard, Plus, Enterprise). Self-service via Google Admin console. Covers Gmail, Drive, Meet, Calendar, Chat, Vault, and more.
- [Does Microsoft 365 Sign a HIPAA BAA?](https://baagenerator.com/blog/does-microsoft-365-sign-a-baa): Yes — Microsoft's HIPAA BAA is built into the Online Services Terms (OST) for all commercial Microsoft 365 plans. No separate contract required. Covers Exchange Online, SharePoint, OneDrive for Business, Teams, and more.
- [Does Zoom Sign a HIPAA BAA?](https://baagenerator.com/blog/does-zoom-sign-a-baa): Yes — but only on Zoom for Healthcare or eligible Business/Enterprise plans with HIPAA mode explicitly enabled. Free Zoom accounts cannot be used for telehealth involving PHI.
- [Does Slack Sign a HIPAA BAA?](https://baagenerator.com/blog/does-slack-sign-a-baa): Yes — but only on Slack Enterprise Grid (custom enterprise plans). Slack Pro and Business+ are not eligible. Small healthcare practices typically use Microsoft Teams or Google Chat as HIPAA-compliant alternatives.
- [Does Dropbox Sign a HIPAA BAA?](https://baagenerator.com/blog/does-dropbox-sign-a-baa): Yes — on Dropbox Business, Business Plus, Advanced, and Enterprise plans. Free and personal Dropbox Plus accounts are not eligible. Must request via Dropbox Business support. Dropbox Sign (e-signature) requires a separate BAA.
- [How to Create a HIPAA Business Associate Agreement (Step by Step)](https://baagenerator.com/blog/how-to-create-a-hipaa-baa): 5-step HowTo guide — identify business associates, confirm mandatory clauses, draft the BAA, execute with counterparty signature, store for 6 years. Includes HowTo schema and full clause checklist.
- [What to Do When a Vendor Won't Sign a HIPAA BAA](https://baagenerator.com/blog/vendor-wont-sign-baa): Practical guide for healthcare organizations whose vendors refuse BAA requests. Covers escalation tactics, how to present your own BAA template, negotiation approach, and when you must discontinue PHI sharing.

## Vertical Guides

- [HIPAA BAA for Therapists](https://baagenerator.com/baa-for-therapists): Guide for mental health providers (LCSWs, LMFTs, psychologists, psychiatrists) on BAA requirements for EHR vendors, billing companies, telehealth platforms, cloud storage, scheduling software, and IT support.
- [HIPAA BAA for Telehealth Providers](https://baagenerator.com/baa-for-telehealth): Guide for virtual care providers covering video platform BAA requirements, the end of COVID enforcement discretion (May 2023), full telehealth vendor BAA checklist, and RPM-specific considerations.
- [HIPAA BAA for SaaS Companies Selling to Healthcare](https://baagenerator.com/baa-for-saas): Guide for healthtech startups and SaaS vendors who are HIPAA business associates — BAA as a sales enabler, vendor-drafted BAA strategy, subcontractor obligations, and minimum security requirements.
- [Does AWS Sign a HIPAA BAA?](https://baagenerator.com/blog/does-aws-sign-a-baa): Yes — AWS Business Associate Addendum available self-service via AWS Artifact to all commercial accounts. Only covers HIPAA-eligible services (EC2, S3, RDS, Lambda, etc.). Shared responsibility model applies.
- [Does DocuSign Sign a HIPAA BAA?](https://baagenerator.com/blog/does-docusign-sign-a-baa): Yes — on Business Pro and Enterprise plans. DocuSign Personal and Standard plans are not eligible. Dropbox Sign (formerly HelloSign) is a lower-cost alternative with a BAA on Business plans.
- [Does Stripe Sign a HIPAA BAA?](https://baagenerator.com/blog/does-stripe-sign-a-baa): No — Stripe does not offer a HIPAA BAA and is not HIPAA compliant. Cannot be used for healthcare payments where PHI is involved. HIPAA-compliant alternatives include Helcim, Authorize.net, and Rectangle Health.
- [Does Mailchimp Sign a HIPAA BAA?](https://baagenerator.com/blog/does-mailchimp-sign-a-baa): No — Mailchimp (Intuit) does not offer a HIPAA BAA. Cannot be used with patient email lists or PHI. HIPAA-compliant alternatives include Constant Contact (BAA plans), Paubox, Klara, and Spruce Health.
- [Does HubSpot Sign a HIPAA BAA?](https://baagenerator.com/blog/does-hubspot-sign-a-baa): Yes — but only with the Healthcare Hub add-on (requires Enterprise plan). Standard HubSpot plans are not HIPAA eligible. Alternatives include Salesforce Health Cloud and Microsoft Dynamics 365.

## Vendor BAA Guides (expanded)

- [Does Salesforce Sign a HIPAA BAA?](https://baagenerator.com/blog/does-salesforce-sign-a-baa): Yes — but only for Health Cloud and specific healthcare products. Standard Sales Cloud is not covered. BAA requires contacting Salesforce Account Executive.
- [Does Calendly Sign a HIPAA BAA?](https://baagenerator.com/blog/does-calendly-sign-a-baa): Yes — on Teams and Enterprise plans only. Free and Standard plans are not HIPAA eligible.
- [Does Notion Sign a HIPAA BAA?](https://baagenerator.com/blog/does-notion-sign-a-baa): No — Notion does not sign a HIPAA BAA on any plan. Not eligible for PHI storage.
- [Does OpenAI Sign a HIPAA BAA?](https://baagenerator.com/blog/does-openai-sign-a-baa): Yes — for API customers and ChatGPT Enterprise. ChatGPT Free and Plus are not eligible.
- [Does Anthropic Sign a HIPAA BAA?](https://baagenerator.com/blog/does-anthropic-sign-a-baa): Yes — for Claude Enterprise and qualifying API customers with DPA. Consumer plans not covered.
- [Does Microsoft Azure Sign a HIPAA BAA?](https://baagenerator.com/blog/does-microsoft-azure-sign-a-baa): Yes — included in the Online Services Terms for all commercial Azure accounts. Self-service via terms acceptance.
- [Does Google Cloud (GCP) Sign a HIPAA BAA?](https://baagenerator.com/blog/does-google-cloud-sign-a-baa): Yes — self-service via the GCP Console. Covers Compute Engine, Cloud Storage, BigQuery, and more.
- [Does Twilio Sign a HIPAA BAA?](https://baagenerator.com/blog/does-twilio-sign-a-baa): Yes — for healthcare customers via Twilio sales team. Covers SMS, Voice, Video, and SendGrid for qualifying accounts.
- [Does SendGrid Sign a HIPAA BAA?](https://baagenerator.com/blog/does-sendgrid-sign-a-baa): Yes — covered under Twilio's enterprise HIPAA BAA process for qualifying customers.
- [Does Square Sign a HIPAA BAA?](https://baagenerator.com/blog/does-square-sign-a-baa): No standard BAA. Square's general payment processing does not include HIPAA coverage.
- [Does Acuity Scheduling Sign a HIPAA BAA?](https://baagenerator.com/blog/does-acuity-scheduling-sign-a-baa): Yes — on the Powerhouse plan ($45/mo). BAA available on request from Acuity support.
- [Does Intercom Sign a HIPAA BAA?](https://baagenerator.com/blog/does-intercom-sign-a-baa): No — Intercom does not sign a HIPAA BAA on any plan.
- [Does Typeform Sign a HIPAA BAA?](https://baagenerator.com/blog/does-typeform-sign-a-baa): No — Typeform is not HIPAA eligible on any plan. Cannot be used for patient intake forms.
- [Does JotForm Sign a HIPAA BAA?](https://baagenerator.com/blog/does-jotform-sign-a-baa): Yes — on the dedicated HIPAA plan (~$39/mo) with encrypted form storage.
- [Does Zapier Sign a HIPAA BAA?](https://baagenerator.com/blog/does-zapier-sign-a-baa): No — Zapier is not HIPAA eligible. Routing PHI through Zapier breaks the compliance chain.
- [Does Epic Sign a HIPAA BAA?](https://baagenerator.com/blog/does-epic-sign-a-baa): Yes — BAA provisions are included in Epic's standard implementation agreement.
- [Does Cerner / Oracle Health Sign a HIPAA BAA?](https://baagenerator.com/blog/does-cerner-sign-a-baa): Yes — BAA provisions are included in Oracle Health / Cerner's standard implementation agreement.
- [How to Review a BAA a Vendor Sent You](https://baagenerator.com/blog/how-to-review-a-baa): 7-step guide to checking a vendor's BAA before signing — breach notification timeline, permitted use scope, PHI destruction, and more.
- [What to Do When a Vendor Wants to Change Your BAA](https://baagenerator.com/blog/baa-vendor-requires-changes): Which vendor redlines are acceptable, which are red flags, and when to walk away.

## BAA Lifecycle & Process Guides

- [How Much Does a HIPAA BAA Cost?](https://baagenerator.com/blog/how-much-does-a-baa-cost): $0 (self-generated) to $3,000+ (custom attorney-drafted). Cost breakdown by method with guidance on when an attorney is necessary.
- [How to Amend a HIPAA BAA](https://baagenerator.com/blog/how-to-amend-a-baa): Step-by-step process for amending an existing BAA — triggers, required provisions, and 6-year retention requirements.
- [Does a HIPAA BAA Expire? BAA Renewal Guide](https://baagenerator.com/blog/baa-renewal): BAAs do not auto-expire. When to review and update an existing BAA — vendor renewals, scope changes, regulatory updates.
- [How to Terminate a HIPAA BAA](https://baagenerator.com/blog/baa-termination): Written notice, PHI return or destruction, and 6-year documentation under 45 CFR § 164.504(e).
- [What to Do If You Discover a Missing HIPAA BAA](https://baagenerator.com/blog/discovered-missing-baa): Immediate action plan — stop PHI sharing, execute retroactively if possible, assess breach notification obligations.
- [How to Negotiate a HIPAA BAA](https://baagenerator.com/blog/baa-negotiation): 4 provisions worth fighting for: breach notification timeline, permitted use scope, subcontractor disclosure, and PHI destruction terms.
- [How to Keep a BAA Compliance Log](https://baagenerator.com/blog/baa-compliance-log): Vendor tracking template covering all fields OCR expects. Retain for 6 years per 45 CFR § 164.530(j).
- [HIPAA BAA Audit Readiness](https://baagenerator.com/blog/baa-audit-readiness): What OCR checks: BA inventory, executed agreements, subcontractor BAA enforcement, and remediation documentation.
- [HIPAA BAA Enforcement Actions: What OCR Has Penalized](https://baagenerator.com/blog/ocr-enforcement-actions): Real enforcement cases, penalty tiers ($141–$1.9M/year), and what makes OCR more likely to investigate.
- [Breach Notification When a Business Associate Is Involved](https://baagenerator.com/blog/hipaa-breach-notification): The BA-to-CE notification chain, the 60-day requirement under 45 CFR § 164.410, and why BAAs should require faster disclosure.
- [BAA vs. Data Processing Agreement (DPA)](https://baagenerator.com/blog/baa-vs-dpa): HIPAA BAA (U.S. federal) vs. GDPR DPA (EU). Different legal regimes — organizations operating in both need both documents.
- [HIPAA BAA vs. SaaS Agreement: When You Need Both](https://baagenerator.com/blog/baa-vs-saas-agreement): A SaaS agreement and a BAA are separate documents covering different obligations. How to verify if a vendor's ToS qualifies.
- [Subcontractor BAAs: When Business Associates Need Their Own BAAs](https://baagenerator.com/blog/subcontractor-baa): Under 45 CFR § 164.308(b)(2), BAs must get BAAs from their own PHI-touching subcontractors. How the chain works.
- [Can You Sign a HIPAA BAA Electronically?](https://baagenerator.com/blog/sign-baa-electronically): Yes — under ESIGN and UETA. DocuSign, Adobe Sign, and admin console acceptance are valid. How to document e-signed BAAs.
- [What to Do If a Vendor Wants to Backdate a BAA](https://baagenerator.com/blog/vendor-backdates-baa): Backdating is legally problematic. What to do instead and how to document a BAA gap without creating a false record.

## Vertical Guides (expanded)

- [HIPAA BAA for Chiropractors](https://baagenerator.com/baa-for-chiropractors): Covered entity obligations — EHR (ChiroTouch, Genesis), billing, imaging, and IT providers require BAAs regardless of practice size.
- [HIPAA BAA for Optometry](https://baagenerator.com/baa-for-optometry): Optometrists are covered entities — EHR (Eyefinity, RevolutionEHR), imaging, billing, and recall vendors need BAAs for clinical PHI.
- [HIPAA BAA for Pharmacies](https://baagenerator.com/baa-for-pharmacy): Pharmacies are covered entities — pharmacy management software (QS/1, PioneerRx), PBM interfaces, and delivery vendors require BAAs.
- [HIPAA BAA for Home Health Agencies](https://baagenerator.com/baa-for-home-health): Field staff mobile apps, telehealth platforms, and subcontractor caregiver relationships create unique BAA obligations.
- [HIPAA BAA for FQHCs](https://baagenerator.com/baa-for-fqhc): Federally Qualified Health Centers have covered entity BAA obligations plus 340B vendor and HIE considerations.
- [HIPAA BAA for Urgent Care Clinics](https://baagenerator.com/baa-for-urgent-care): EHR (Experity, Charm Health), billing, imaging, and kiosk vendors all require BAAs. Occupational health adds complexity.
- [HIPAA BAA for Nursing Homes & SNFs](https://baagenerator.com/baa-for-nursing-homes): Long-term care EHR (PointClickCare, MatrixCare), pharmacy, therapy systems, and family portals require BAAs.
- [HIPAA BAA for Hospice Providers](https://baagenerator.com/baa-for-hospice): Hospice software, bereavement services, volunteer platforms, and pharmacy vendors all require BAAs.
- [HIPAA BAA for Digital Health Companies](https://baagenerator.com/baa-for-digital-health): Digital health companies are typically business associates — must sign BAAs for clients AND get sub-BAAs from cloud and analytics vendors.
- [HIPAA BAA for Healthtech Startups](https://baagenerator.com/baa-for-healthtech-startups): Two-sided BAA obligations: sign BAAs with healthcare clients AND get BAAs from cloud, analytics, and LLM vendors that touch PHI.
- [HIPAA BAA for Nurse Practitioners](https://baagenerator.com/baa-for-nurse-practitioners): Independent NPs operating their own practices have the same covered entity BAA obligations as physician-owned practices.
- [HIPAA BAA for Concierge Medicine & DPC](https://baagenerator.com/baa-for-concierge-medicine): "We don't bill insurance" does not exempt a concierge or DPC practice from HIPAA BAA requirements.
- [HIPAA BAA for Ambulance & EMS Services](https://baagenerator.com/baa-for-ambulance-services): EMS agencies are covered entities — EMS software (ImageTrend, ESO), CAD, dispatch, and billing require BAAs.
- [HIPAA BAA for Clinical Laboratories](https://baagenerator.com/baa-for-clinical-labs): CLIA labs are covered entities — LIS vendors (Epic Beaker, Sunquest), billing, and reference lab interfaces require BAAs.
- [HIPAA BAA for Dental Labs](https://baagenerator.com/baa-for-dental-labs): Dental labs are business associates — the dental practice must provide the BAA before sharing patient-identifiable case data.
- [HIPAA BAA for DSOs](https://baagenerator.com/baa-for-dso): DSOs are typically business associates for affiliated practices. Group vendor contracts must cover all affiliated practices.
- [HIPAA BAA for Healthtech Agencies](https://baagenerator.com/baa-for-healthtech-agencies): Software agencies building HIPAA systems are business associates. PHI in development tools (Jira, Slack, error logs) creates violations.

## Vendor BAA Guides (wave 2 — EHR, DevOps, analytics)

- [Does SimplePractice Sign a HIPAA BAA?](https://baagenerator.com/blog/does-simplepractice-sign-a-baa): Yes — all paid plans (Starter, Essential, Plus). Self-service via Account Settings → Security. Used by 200,000+ mental health clinicians.
- [Does TherapyNotes Sign a HIPAA BAA?](https://baagenerator.com/blog/does-therapynotes-sign-a-baa): Yes — included in standard subscriber agreement for all tiers. Purpose-built EHR for behavioral health providers.
- [Does Doxy.me Sign a HIPAA BAA?](https://baagenerator.com/blog/does-doxy-me-sign-a-baa): Yes — on Professional and Clinic paid plans only. Free plan has NO BAA and cannot be used for PHI-involved telehealth sessions.
- [Does Athenahealth Sign a HIPAA BAA?](https://baagenerator.com/blog/does-athenahealth-sign-a-baa): Yes — standard enterprise agreement covers athenaClinicals, athenaCollector, athenaCommunicator, and Athenaone.
- [Does eClinicalWorks Sign a HIPAA BAA?](https://baagenerator.com/blog/does-eclinicalworks-sign-a-baa): Yes — standard service agreement covers all eClinicalWorks products including healow patient portal.
- [Does Kareo (Tebra) Sign a HIPAA BAA?](https://baagenerator.com/blog/does-kareo-sign-a-baa): Yes — Kareo rebranded to Tebra in 2022 after merging with PatientPop; BAA coverage continued through the rebrand.
- [Does Sentry Sign a HIPAA BAA?](https://baagenerator.com/blog/does-sentry-sign-a-baa): Yes — Business and Enterprise plans only. Free and Team plans have no BAA. Error logs can contain PHI in health apps.
- [Does Datadog Sign a HIPAA BAA?](https://baagenerator.com/blog/does-datadog-sign-a-baa): Yes — Enterprise plan only. Monitoring logs and APM traces in healthcare infrastructure can contain PHI.
- [Does Segment (Twilio) Sign a HIPAA BAA?](https://baagenerator.com/blog/does-segment-sign-a-baa): Yes — Business and Enterprise plans only. Event data in health apps can easily contain PHI.
- [Does Mixpanel Sign a HIPAA BAA?](https://baagenerator.com/blog/does-mixpanel-sign-a-baa): Yes — Enterprise plan only. Product analytics events in health apps frequently contain PHI.
- [Does Amplitude Sign a HIPAA BAA?](https://baagenerator.com/blog/does-amplitude-sign-a-baa): Yes — Enterprise plan only. Growth and Plus plans have no BAA.
- [Does GitHub Sign a HIPAA BAA?](https://baagenerator.com/blog/does-github-sign-a-baa): Yes — GitHub Enterprise via Microsoft's enterprise agreement. Standard GitHub.com plans have no BAA.
- [Does Box Sign a HIPAA BAA?](https://baagenerator.com/blog/does-box-sign-a-baa): Yes — Business Plus, Enterprise, and Enterprise Plus plans. Standard Business plan has no BAA.
- [Does Monday.com Sign a HIPAA BAA?](https://baagenerator.com/blog/does-monday-com-sign-a-baa): Yes — Enterprise plan only. All lower tiers (Free through Pro) have no BAA.
- [Does drchrono Sign a HIPAA BAA?](https://baagenerator.com/blog/does-drchrono-sign-a-baa): Yes — included in standard service agreement. Now part of EverHealth / Global Payments.
- [Does Zoom for Healthcare Sign a HIPAA BAA?](https://baagenerator.com/blog/does-zoom-for-healthcare-sign-a-baa): Yes — Zoom for Healthcare tier only. Standard Zoom Free/Pro/Business plans have no BAA and cannot be used for telehealth involving PHI.
- [Does RingCentral Sign a HIPAA BAA?](https://baagenerator.com/blog/does-ringcentral-sign-a-baa): Yes — Advanced, Ultra, and RingCentral for Healthcare plans with HIPAA configuration.
- [Does FullStory Sign a HIPAA BAA?](https://baagenerator.com/blog/does-fullstory-sign-a-baa): Yes — Enterprise plan only. Session replay tools are high-risk for PHI capture; requires privacy masking configuration.
- [Does Hotjar Sign a HIPAA BAA?](https://baagenerator.com/blog/does-hotjar-sign-a-baa): No — Hotjar does not offer a HIPAA BAA on any plan. Cannot be used on healthcare apps or portals that handle PHI.

## Vertical Guides (wave 2 — behavioral health, allied health, RCM)

- [HIPAA BAA for Behavioral Health Organizations](https://baagenerator.com/baa-for-behavioral-health): Covers HIPAA + 42 CFR Part 2 for mental health/SUD organizations; EHR platforms (SimplePractice, TherapyNotes, Valant) and telehealth all require BAAs.
- [HIPAA BAA for Addiction Treatment Programs](https://baagenerator.com/baa-for-addiction-treatment): Dual HIPAA and 42 CFR Part 2 compliance for residential, IOP, and MAT clinics; SUD records have stricter confidentiality requirements.
- [HIPAA BAA for Group Medical Practices](https://baagenerator.com/baa-for-group-practice): Multi-provider groups have more complex BAA obligations than solo providers — centralized billing, shared systems, and employer HR records all factor in.
- [HIPAA BAA for Radiology and Imaging Centers](https://baagenerator.com/baa-for-imaging-centers): PACS vendors, teleradiology services, cloud DICOM storage, and AI diagnostic tools are all business associates. DICOM image metadata is PHI.
- [HIPAA BAA for Occupational Therapists](https://baagenerator.com/baa-for-occupational-therapy): OT platforms (WebPT, Fusion, TheraOffice), billing, and school-based FERPA/HIPAA distinctions covered.
- [HIPAA BAA for Speech-Language Pathologists](https://baagenerator.com/baa-for-speech-language-pathology): SLP platforms, teletherapy tools, AAC cloud sync edge cases, and school-based FERPA/HIPAA boundary explained.
- [HIPAA BAA for Healthcare Staffing Agencies](https://baagenerator.com/baa-for-healthcare-staffing): Staffing agencies are business associates for hospitals AND need BAAs with their own credentialing, ATS, and background check vendors.
- [HIPAA BAA for Medical Transcription Services](https://baagenerator.com/baa-for-medical-transcription): Traditional and AI transcription services (Nuance DAX, Suki, Abridge) are business associates; audio cloud storage also requires BAAs.
- [HIPAA BAA for Health Plans](https://baagenerator.com/baa-for-health-plans): TPAs, PBMs (CVS Caremark, Express Scripts, OptumRx), utilization management, and data analytics vendors require BAAs with health plans.
- [HIPAA BAA for Mental Health Apps](https://baagenerator.com/baa-for-mental-health-apps): Consumer vs. clinical app HIPAA coverage analysis; infrastructure BAAs for cloud, analytics, push notifications, and video vendors.
- [HIPAA BAA for Remote Patient Monitoring Programs](https://baagenerator.com/baa-for-remote-patient-monitoring): RPM platform vendors are business associates; device manufacturers with cloud connectivity are BAs; cellular carriers are generally not (conduit exception).
- [HIPAA BAA for Revenue Cycle Management Companies](https://baagenerator.com/baa-for-revenue-cycle-management): RCM firms are BAs to covered entities AND need BAAs with their own subvendors. Change Healthcare breach (2024, 100M+ records) context included.

## HIPAA Concepts & BAA Process (wave 2)

- [HIPAA Data Use Agreement vs. BAA](https://baagenerator.com/blog/hipaa-data-use-agreement-vs-baa): DUA covers Limited Data Sets (PHI with 16 of 18 identifiers removed, per 45 CFR § 164.514(e)); BAA covers fully identifiable PHI. Not interchangeable.
- [HIPAA BAA for International Vendors](https://baagenerator.com/blog/baa-for-international-vendors): HIPAA has no geographic exemption — offshore vendors handling PHI must sign BAAs. EU vendors may also need a GDPR DPA alongside the BAA.
- [Can One BAA Cover Multiple Vendors?](https://baagenerator.com/blog/one-baa-multiple-vendors): No — BAAs are bilateral. A single BAA cannot cover multiple unrelated vendors. Parent/subsidiary exception explained.
- [HIPAA BAA Indemnification Clauses Explained](https://baagenerator.com/blog/hipaa-baa-clause-indemnification): Indemnification is not required by HIPAA but commonly negotiated. Mutual vs. one-sided indemnification; liability caps; red flags.
- [HIPAA BAA Breach Notification Clause Requirements](https://baagenerator.com/blog/hipaa-baa-clause-breach-notification): 45 CFR § 164.504(e)(2)(ii)(C) requires breach notification within 60 days; most BAAs negotiate 5–30 day contractual windows.
- [HIPAA BAA Permitted Uses and Disclosures Clause](https://baagenerator.com/blog/hipaa-baa-clause-permitted-uses): Closed-list principle — BAA must enumerate permitted uses; any use not listed is prohibited. Secondary marketing use restrictions explained.
- [HIPAA Minimum Necessary Standard and BAAs](https://baagenerator.com/blog/hipaa-minimum-necessary-and-baa): 45 CFR § 164.502(b) applies to BA disclosures. BAAs should reflect data minimization; treatment disclosures are exempt.
- [HIPAA Authorization vs. Business Associate Agreement](https://baagenerator.com/blog/hipaa-authorization-vs-baa): Patient authorization (45 CFR § 164.508) vs. vendor contract (45 CFR § 164.504) — completely different instruments. Comparison table included.
- [When Does HIPAA Apply?](https://baagenerator.com/blog/when-does-hipaa-apply): HIPAA applies to covered entities (healthcare providers, health plans, clearinghouses) and their business associates. Decision table for 7 organization types.
- [HIPAA Covered Entity vs. Business Associate](https://baagenerator.com/blog/hipaa-covered-entity-vs-business-associate): CE definition vs. BA definition; subcontractor BA chain; hybrid entities. Comparison table with enforcement mechanism differences.
- [HIPAA BAA Template for SaaS Vendors](https://baagenerator.com/blog/baa-template-for-saas): Required BAA elements for SaaS relationships; data portability at termination; subprocessor chain; how to review a vendor-provided SaaS BAA.
- [HIPAA BAA Template for Telehealth Vendors](https://baagenerator.com/blog/baa-template-for-telehealth): Session recording storage, post-COVID waiver expiration, video/scheduling/e-prescribing as separate BA relationships.
- [Free HIPAA BAA Template](https://baagenerator.com/blog/free-hipaa-baa-template): What every HIPAA BAA template must include per 45 CFR § 164.504(e); HHS model BAA limitations; BAA Generator provides a free customizable template.
- [10 Common HIPAA BAA Mistakes](https://baagenerator.com/blog/hipaa-baa-mistakes): Missing BAA, outdated pre-2013 template, no breach timeline, no subcontractor clause, accepting vendor BAAs without review — 10 mistakes with fixes.
- [Do I Need HIPAA Compliance? A Decision Guide](https://baagenerator.com/blog/do-i-need-hipaa-compliance): Decision framework for covered entity and BA status. Consumer apps, employers, and most non-clinical tech companies are generally not covered entities.

## Legal

- [Privacy Policy](https://baagenerator.com/privacy): Explains data handling — wizard inputs are processed in-browser and not stored on servers. Payment processed by Stripe. Analytics via Vercel. CCPA/GDPR rights available.
- [Terms of Service](https://baagenerator.com/terms): Service terms including not-legal-advice disclaimer, payment/refund policy, IP license, limitation of liability (capped at amount paid or $50), governing law (Delaware).

## Organization

- Name: BAA Generator
- Website: https://baagenerator.com
- Use case: HIPAA compliance tooling for healthcare covered entities and their business associates
- Pricing: Free (watermarked PDF) or $49 one-time (clean PDF + Word .docx)
- Legal basis: Documents generated are for informational purposes only and do not constitute legal advice. Clauses map to 45 CFR § 164.504(e).