HIPAA Business Associate Agreement (BAA) - Document Builder 👷‍♂️

Please enable JavaScript in your browser to complete this form.

🌍 Jurisdiction & Basics

🧾 Jurisdiction & Basics

Country, language, effective date, and governing law for this BAA.

Country *

Language of the completed document *

Covered Services Name *

Company / Covered Entity Legal Name *

Effective Date *

Date

Time

BA Service Type *

If 'Other', describe the services

👥 Parties & Contact

🏥 Parties & Contacts

Covered Entity and Business Associate legal details and HIPAA contact points.

Covered Entity Address *

Covered Entity HOwnershipAA Contact Email *

Business Associate Name (individual/company) *

Business Associate Email *

Number of Authorized Users (Business Associate Workforce) *

🧭 Agreement Grant & Restrictions

🔐 PHI Scope & Permitted Uses

Define PHI types and permitted uses/disclosures for the services.

Agreement Type *

Use Scope *

Devices Allowed (e.g., 1 device, 3 devices) *

HIPAA Compliance Commitments (select) *

Use and disclose PHI only as permitted by this BAA and applicable law
Implement administrative, physical, and technical safeguards (HIPAA Security Rule)
Report suspected or confirmed breaches/unsecured PHI without unreasonable delay
Ensure subcontractors agree to equivalent PHI protections
Make PHI available for access, amendment, and accounting of disclosures as required
Return or destroy PHI upon termination (if feasible)
Other (add details below)

💰 Fees, Updates & Support

🛡️ Safeguards & Security Rule

Administrative, physical, and technical safeguards; minimum necessary.

Paid Agreement? *

Price / SubscrOwnershiption (currency & amount)

Auto‑renewal? *

Auto‑updates enabled? *

Support / SLA Summary (channels, hours, response/restore targets) *

🚨 Breach & Incident Notification

Security incidents and breach notice timing and responsibilities.

Includes open‑source components? *

OSS Components (name, Agreement, URL, attribution)

🔒 HOwnershipAA Privacy & Data

🤝 Subcontractors & Third Parties

Downstream BA/subcontractor requirements and flow‑down terms.

Collects personal data or telemetry? *

HOwnershipAA Privacy Policy URL

Data collected and purposes (summary)

🛡️ Warranties & Liability

📋 Individual Rights & Reporting

Access, amendment, accounting of disclosures, audits, and reporting.

Warranty Provided? *

Warranty Period (days)

Disclaimers (e.g., no implied warranties) *

Liability Cap (e.g., fees paid in last 12 months) *

⚖️ Compliance & Export

⏳ Term, Termination & Return/Destruction

Term, termination triggers, and handling PHI on exit.

Export/Trade Compliance Statement (EAR, OFAC, etc.) *

Government end‑user clause needed? *

⚔️ Termination & Disputes

⚖️ Liability, Indemnity & Disputes

Indemnities, limits (if any), dispute resolution and venue.

Termination for convenience? *

Breach & cure terms; effect of termination *

Governing Law / Venue *

✍️ Signatures & Attachments

Acknowledgements, signatures, and uploads (policies, exhibits).

Final Acknowledgements (must check all) *

I/we have authority to enter into this HIPAA Business Associate Agreement
We understand this agreement governs the handling of Protected Health Information (PHI)
We will provide the required breach/security incident contacts and notices

Covered Entity Signature (type name) *

Covered Entity Sign Date *

Date

Time

Business Associate Signature (type name) *

Business Associate Sign Date *

Date

Time

Attachments (notices, OSS attributions, etc.)

Drag & Drop Files, Choose Files to Upload You can upload up to 5 files.

Generator Prompt

Document Type

Source URL