Business Associate Agreement (BAA)
A HIPAA-compliant Business Associate Agreement designed for startups and technology companies that handle protected health information (PHI) on behalf of covered entities.
Business Associate Agreement (BAA)
What it is
A Business Associate Agreement (BAA) is a legally required contract under HIPAA between a covered entity (such as a healthcare provider or health plan) and a business associate—any company that creates, receives, maintains, or transmits protected health information (PHI) on their behalf. If your startup processes, stores, or has access to PHI, you need a BAA in place before handling that data.
When you need it
You need a BAA whenever your company acts as a business associate under HIPAA. Common scenarios include: providing cloud hosting or SaaS tools to healthcare clients, offering data analytics on patient data, handling billing or claims processing, building health-tech applications, or providing IT support to healthcare organizations. Failing to have a proper BAA in place can result in significant fines and legal liability.
Why this template
This BAA template was drafted by attorneys with experience advising startups in the healthcare technology space. It covers the essential provisions required by HIPAA while remaining practical and readable. It's designed to give you a strong starting point—though we always recommend having an attorney review any agreement before execution.
What is in it
- Permitted uses and disclosures of PHI
- Safeguard obligations and security requirements
- Breach notification procedures and timelines
- Subcontractor compliance requirements
- Return or destruction of PHI upon termination
- Individual rights and access to PHI
A template is a starting point, not advice. This one is drafted for the common case; your product, your counterparty and your jurisdiction will each pull it in a direction the document cannot anticipate. Nothing here creates an attorney-client relationship, and if the agreement matters, have a lawyer read it, ours or anyone else’s.