HIPAA Business Associate Agreement (BAA): Template Outline and Checklist

BAA Checklist

• [ ] Parties identified (CE and BA) and PHI/ePHI services in scope
• [ ] Permitted/required uses and disclosures of PHI stated
• [ ] BA agrees to implement appropriate safeguards (Security Rule)
• [ ] Breach / security incident reporting to the CE (align clocks with 164.410)
• [ ] Subcontractor / sub-BA flow-down obligations
• [ ] Individual rights support (access, amendments, accounting) as applicable
• [ ] Return or destruction of PHI at termination (or ongoing protections if infeasible)
• [ ] CE right to terminate for material breach
• [ ] Retention of BAA with other Security Rule documentation (6 years under 164.316(b)(2))

Template Outline (Headings)

1. Definitions (PHI, ePHI, Breach, Designated Record Set)
2. Obligations of Business Associate
3. Obligations of Covered Entity
4. Permitted Uses and Disclosures
5. Security Safeguards and Reporting
6. Subcontractors
7. Term, Termination, and PHI Disposition
8. Regulatory References (164.308(b), 164.314(a), 164.504(e))

No downloadable Word/PDF is attached. Request a working session via contact if you want CyberSilo to help operationalise BA registers in CSA.

How CyberSilo Helps

• CSA maintains BA/BAA registers with owners, renewal dates, and evidence links
• ThreatHawk supports BA security-monitoring evidence when you are the BA or CE monitoring vendors

Frequently Asked Questions

Is a BAA required?

Covered entities must obtain satisfactory assurances via BAAs for business associate relationships (see 164.308(b), 164.314(a), 164.504(e)).

Are business associates directly liable?

Yes. After HITECH / 2013 Omnibus, business associates are directly liable for Security Rule, certain Privacy Rule provisions, and Breach Notification Rule compliance.

Can we use a vendor’s standard BAA?

Often yes for cloud providers, but counsel should review scope, subprocessors, and breach reporting language against your risk profile.

Related HIPAA Resources

HIPAA hub · Cloud BAAs · Penalties · CSA