Business Associate Agreement Template (2026) + Counterparty Tracker

A HIPAA Business Associate Agreement (BAA) is a contract required by 45 CFR § 164.504(e) any time a covered entity discloses PHI to a vendor for a function on its behalf. Every BAA must include ten specific clauses: permitted uses, prohibition on further disclosure, safeguards, breach reporting, subcontractor flow-down, individual access support, accounting of disclosures support, compliance with the covered entity's Privacy Rule obligations when the BA carries them out (per 45 CFR § 164.504(e)(2)(ii)(I)), internal-practices availability to HHS, and return-or-destruction at termination.

What auditors actually want

OCR Resolution Agreements through 2025 cite three BAA defects repeatedly: BAA missing entirely, BAA executed with the wrong legal entity (parent vs. operating subsidiary), and BAA that contains the section heads but is silent on breach notification timeline or subcontractor flow-down. Raleigh Orthopaedic ($750,000) involved a missing BAA with an imaging vendor; North Memorial Health ($1.55M) involved a missing BAA with a contractor at an off-site location.

In our analysis of 400+ d3rx client binders, the most common defect is not the BAA text itself — vendor templates are usually adequate. The defect is the counterparty tracker. Practices have BAAs in a folder but cannot answer: how many vendors process PHI, who has a current BAA, when does each expire, who is the subcontractor downstream, and which vendor saw the last breach notice.

The required entities to name in a credible BAA discussion: HHS Office for Civil Rights (OCR), the 45 CFR Part 164 Subpart E Privacy Rule, the Omnibus Final Rule (78 Fed. Reg. 5566, January 25, 2013) which extended direct liability to business associates, the HHS Sample BAA Provisions, and the breach notification rule at 45 CFR § 164.410.

The template — section by section

The BAA below is a 2026 version of HHS's sample provisions, tightened for clauses OCR enforcement most often cites. Use it as a starting point and have the practice's counsel review before signing.

Required clauses with sample language

``` BUSINESS ASSOCIATE AGREEMENT

This Business Associate Agreement ("Agreement") is entered into between [Covered Entity legal name] ("Covered Entity") and [Business Associate legal name] ("Business Associate"), effective [Date].

1. DEFINITIONS

Terms used but not defined have the meaning set forth in 45 CFR Parts 160 and 164.

1. PERMITTED USES AND DISCLOSURES — 45 CFR § 164.504(e)(2)(i)

Business Associate may use and disclose PHI only as necessary to perform the services set forth in the underlying Service Agreement, as Required by Law, and as permitted by 45 CFR § 164.504(e)(4) for management, administration, or data aggregation services to Covered Entity.

1. SAFEGUARDS — 45 CFR § 164.504(e)(2)(ii)(B), 164.308, 164.310, 164.312

Business Associate will implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of any electronic PHI it creates, receives, maintains, or transmits on behalf of Covered Entity, in accordance with the HIPAA Security Rule.

1. REPORTING — 45 CFR § 164.504(e)(2)(ii)(C), 164.410

Business Associate will report to Covered Entity: (a) Any use or disclosure of PHI not permitted by this Agreement. (b) Any Security Incident as defined in 45 CFR § 164.304. (c) Any Breach of Unsecured PHI as defined in 45 CFR § 164.402. Reports will be made without unreasonable delay and in no case later than [10] calendar days after Business Associate's discovery.

1. SUBCONTRACTOR FLOW-DOWN — 45 CFR § 164.504(e)(2)(ii)(D)

Business Associate will ensure that any Subcontractor that creates, receives, maintains, or transmits PHI on its behalf agrees in writing to the same restrictions, conditions, and requirements applied to Business Associate under this Agreement.

1. INDIVIDUAL ACCESS — 45 CFR § 164.504(e)(2)(ii)(E), 164.524

Business Associate will, within [15] days of Covered Entity's request, make available PHI in a Designated Record Set so that Covered Entity can meet its access obligations.

1. AMENDMENT — 45 CFR § 164.504(e)(2)(ii)(F), 164.526

Business Associate will incorporate amendments to PHI as directed by Covered Entity, in accordance with 45 CFR § 164.526.

1. ACCOUNTING — 45 CFR § 164.504(e)(2)(ii)(G), 164.528

Business Associate will track disclosures of PHI required for an accounting under 45 CFR § 164.528 and provide the information to Covered Entity within [30] days of request.

1. ACCESS TO INTERNAL PRACTICES — 45 CFR § 164.504(e)(2)(ii)(H)

Business Associate will make its internal practices, books, and records relating to the use and disclosure of PHI available to the Secretary of HHS for purposes of determining compliance.

1. COMPLIANCE WITH COVERED ENTITY'S PRIVACY RULE OBLIGATIONS —

45 CFR § 164.504(e)(2)(ii)(I) To the extent Business Associate is to carry out one or more of Covered Entity's obligation(s) under Subpart E of 45 CFR Part 164 (the Privacy Rule), Business Associate will comply with the requirements of Subpart E that apply to Covered Entity in the performance of such obligation(s).

1. RETURN OR DESTRUCTION AT TERMINATION — 45 CFR § 164.504(e)(2)(ii)(J)

At termination, Business Associate will return or destroy all PHI received from Covered Entity or created on its behalf, and will retain no copies. If return or destruction is infeasible, Business Associate will extend the protections of this Agreement to the information and limit further uses and disclosures.

1. TERMINATION FOR CAUSE — 45 CFR § 164.504(e)(2)(iii)

Covered Entity may terminate this Agreement upon Business Associate's material breach of any term, with a cure period of [30] days or immediate termination if cure is not feasible.

1. GOVERNING LAW

This Agreement is governed by the law of [State], without regard to its conflict-of-law principles.

Signed: [Covered Entity signatory, title, date] [Business Associate signatory, title, date] ```

Field choices worth defending

• Breach reporting window: 10 calendar days is tight but standard. The Privacy Rule allows up to 60 days for the covered entity to notify the individual under § 164.404; the BAA should give the covered entity time to investigate and notify, so a 10-day BA-to-CE window is appropriate. 30 days is too generous if the covered entity has 60 days total.
• Individual access turnaround: 15 days lines up with the Privacy Rule's 30-day total access window at § 164.524, leaving the covered entity 15 days to assemble the response.
• Accounting turnaround: 30 days for the BA buys the covered entity room inside HIPAA's overall 60-day accounting deadline under 45 CFR § 164.528(c)(1) (which allows one 30-day extension on top of the initial 60 days). It is a buffer, not a mirror.
• Cure period: 30 days is standard. Immediate termination must remain available for un-curable breaches.

How to use this template

Step 1: Identify every business associate. Walk every vendor invoice for the last 12 months and every login screen on every workstation. Any vendor that creates, receives, maintains, or transmits PHI on the practice's behalf is a BA. Cross-check against the BAA vendor list for typical small-practice categories.

Step 2: Use the vendor's BAA when offered. Large vendors (EHRs, cloud providers, RCM firms) publish their own BAAs. Read them against the ten required clauses above; they are usually adequate but occasionally narrow the reporting window, remove the subcontractor flow-down, or omit the § 164.504(e)(2)(ii)(I) Privacy-Rule-obligation clause.

Step 3: Where no vendor BAA is offered, send the template above. Have the practice's counsel review the BAA the first time you adopt it and again any time you customize it.

Step 4: Track every executed BAA in the counterparty tracker below. The agreement is only useful if the practice can find it on demand.

The counterparty tracker

| Vendor (legal entity) | Service category | PHI types accessed | BAA executed (date) | BAA renewal | Subcontractors named | Last breach report | Status | |---|---|---|---|---|---|---|---| | EHR Vendor Inc. | EHR | dx, rx, labs, demographics | 2024-04-12 | Auto-renew | Cloud hosting (AWS BAA flow-down) | — | Current | | Email Vendor LLC | Email | dx, demographics | 2023-11-08 | Auto-renew | — | — | Current | | RCM Partner Corp | Billing | claims, demographics | 2025-02-20 | 2027-02-20 | Subcontractor list filed | 2025-08 incident report | Current | | Lab Interface Co. | Lab orders/results | labs, dx | 2024-09-15 | 2026-09-15 | — | — | Renewal due soon | | Transcription Services | Encounter notes | dx, treatment | 2022-06-10 | Expired | Unknown | — | EXPIRED — escalate | | IT MSP | Managed IT | full system access | 2025-01-05 | 2028-01-05 | Backup vendor (flow-down on file) | — | Current |

Required columns for an audit-ready tracker: legal entity name (not d/b/a), the underlying service that triggers the BAA, the categories of PHI accessed, the BAA execution date, the renewal/term date, named subcontractors, the most recent breach or incident report from the vendor, and a status flag.

What goes wrong

The recurring defects in d3rx's review:

1. Wrong legal entity. The BAA is signed with "EHR Vendor Inc." but invoices come from "EHR Vendor Operations LLC," a subsidiary. The OCR enforcement record treats this as no BAA on file.
2. No renewal tracking. The original BAA was executed five years ago, the vendor has since restructured, no renewal or amendment is on file.
3. Subcontractor flow-down silent. The BAA includes section 5 but the practice has no record of which subcontractors the vendor uses. When the subcontractor causes a breach, the chain breaks.
4. Breach reporting window too long. A 60-day BA-to-CE window leaves the covered entity zero days to investigate and notify.
5. No central tracker. The BAAs exist as PDFs in different mailboxes and shared drives. On audit day, the practice cannot produce the list.

Maintenance cadence

• At onboarding (every new vendor): execute BAA before the vendor receives any PHI. File in the binder.
• Monthly: review the tracker for expirations within 90 days. Escalate.
• Annually: confirm subcontractor list with each major vendor. Re-execute BAA on any vendor restructure, name change, or merger.
• On breach: file the BA's breach notice in the tracker against the vendor row.
• At termination: capture the return-or-destruction certification and file with the expired BAA. Retain for at least six years (longer for CA, TX state retention).

State preemption note: California's CMIA, Texas HB 300, and New York SHIELD impose additional contractual and notification obligations that may modify the standard BAA. The BAA is the floor; state-specific addenda may be needed for practices in those jurisdictions.

How d3rx fits

The d3rx compliance binder prompts on every new vendor to capture the BAA, files the dated executed copy, and tracks renewal dates and subcontractor flow-down in the counterparty tracker. It is an administrative documentation aid, not a substitute for counsel review of the BAA text. The practice remains responsible for negotiating BAA terms and for the underlying vendor relationships.