HIPAA BAA Agreement Template (Free Download)

BUSINESS ASSOCIATE AGREEMENT (BAA)
[Standard Federal HIPAA/HITECH Compliance Addendum]

This Business Associate Agreement ("Agreement") is entered into as of [EFFECTIVE DATE], by and between:

COVERED ENTITY:
Name of Organization: [COVERED ENTITY LEGAL NAME]
Address: [COVERED ENTITY ADDRESS]
Representative: [AUTHORIZED OFFICER NAME & TITLE]

and

BUSINESS ASSOCIATE:
Name of Organization: [BUSINESS ASSOCIATE LEGAL NAME]
Address: [BUSINESS ASSOCIATE ADDRESS]
Representative: [AUTHORIZED OFFICER NAME & TITLE]

RECITALS:
WHEREAS, Covered Entity is a "Covered Entity" as defined under the Health Insurance Portability and Accountability Act of 1996, as amended by the HITECH Act ("HIPAA"), codified at 45 CFR Parts 160 and 164; and
WHEREAS, Business Associate provides certain services to Covered Entity pursuant to an underlying Master Services Agreement that involves the creation, receipt, maintenance, or transmission of Protected Health Information ("PHI" or "ePHI");

NOW, THEREFORE, the parties agree as follows:

1. DEFINITIONS
Capitalized terms used, but not otherwise defined, in this Agreement shall have the same meaning as those terms in 45 CFR §§ 160.103, 164.402, and 164.501.
(a) Breach shall have the same meaning given under 45 CFR § 164.402.
(b) Designated Record Set shall have the same meaning given under 45 CFR § 164.501.
(c) Protected Health Information (PHI) shall have the meaning given under 45 CFR § 160.103.

2. OBLIGATIONS AND ACTIVITIES OF BUSINESS ASSOCIATE
(a) Permitted Uses and Disclosures. Business Associate agrees not to use or disclose PHI other than as permitted or required by this Agreement, the underlying Master Services Agreement, or as Required by Law.
(b) Safeguards. Business Associate shall implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of Electronic Protected Health Information (ePHI) in accordance with the HIPAA Security Rule (45 CFR §§ 164.308, 164.310, and 164.312).
(c) Encryption Standards. Business Associate agrees that all ePHI shall be encrypted both at rest (using NIST-validated AES-256 or equivalent) and in transit (using TLS 1.2 or higher).
(d) Reporting Unauthorized Disclosures and Breaches. Business Associate shall report to Covered Entity any acquisition, access, use, or disclosure of PHI not provided for by this Agreement, including Breaches of Unsecured PHI as required by 45 CFR § 164.410, within five (5) business days of becoming aware of such incident.
(e) Subcontractors. Business Associate agrees to ensure that any agent, including a subcontractor, that creates, receives, maintains, or transmits PHI on behalf of Business Associate agrees in writing to the same restrictions, conditions, and requirements that apply to Business Associate with respect to such information (45 CFR § 164.504(e)(1)(i)).

3. PERMITTED USES AND DISCLOSURES BY BUSINESS ASSOCIATE
Except as otherwise limited in this Agreement, Business Associate may:
(a) Use or disclose PHI to perform functions, activities, or services for, or on behalf of, Covered Entity as specified in the underlying Master Services Agreement;
(b) Use PHI for the proper management and administration of Business Associate or to carry out legal responsibilities;
(c) Provide data aggregation services relating to the health care operations of Covered Entity if authorized in writing.

4. TERM AND TERMINATION
(a) Term. This Agreement shall take effect on the Effective Date and shall terminate when all PHI provided by Covered Entity to Business Associate is destroyed or returned.
(b) Termination for Cause. If Covered Entity determines that Business Associate has breached a material term of this Agreement, Covered Entity shall provide written notice giving Business Associate thirty (30) calendar days to cure the breach. If Business Associate fails to cure, Covered Entity may immediately terminate the agreement.
(c) Effect of Termination. Upon termination, Business Associate shall return or destroy all PHI received from Covered Entity, or created or received by Business Associate. If return or destruction is not feasible, Business Associate shall extend the protections of this Agreement to such PHI and limit further uses.

IN WITNESS WHEREOF, the parties hereto have caused this Agreement to be executed by their duly authorized representatives.

COVERED ENTITY:                           BUSINESS ASSOCIATE:
Signature: ______________________        Signature: ______________________
Printed Name: ___________________        Printed Name: ___________________
Title: __________________________        Title: __________________________
Date: ___________________________        Date: ___________________________