Monday - Friday 9AM – 6PM EST
Put vendor arrangements in writing before any patient information moves. Build your HIPAA business associate agreement in minutes with Document Genius's step-by-step questionnaire.
Choose the state or form type you need to start.
Answer a few simple questions to customize your form.
Download or print your custom document in PDF or Word.
A HIPAA business associate agreement is a written contract between a healthcare organisation and a vendor that handles patient information on its behalf.
The relationship it governs is common. Billing companies, cloud hosting providers, transcription services, IT support, shredding companies, and analytics vendors may all encounter patient information while doing work for a provider.
The agreement is a compliance document rather than an ordinary commercial one. It exists because federal healthcare privacy regulation requires certain arrangements to be in place, and its contents are shaped by that regulation rather than by what the parties would otherwise negotiate.
It is distinct from a workforce confidentiality acknowledgement. That document covers your own staff; a HIPAA business associate agreement covers an outside organisation.
Healthcare privacy compliance is regulated in detail, and a general template page is the wrong place to learn what applies to you.
We do not state which organisations are covered, what makes someone a business associate, what the regulation requires an agreement to contain, what obligations flow down to subcontractors, what must happen after a breach, or what penalties apply. Those questions have specific answers set by regulation and enforced by a federal agency.
Getting them wrong has consequences for the organisation, for the vendor, and for patients whose information is involved.
If your organisation handles patient information, or handles it on behalf of someone who does, work with a healthcare compliance professional or an attorney experienced in healthcare privacy. That applies to providers, to vendors, and to subcontractors further down the chain.
This template is a general starting point that your advisers may adapt. It is not a compliance programme, not legal advice, and not a substitute for advice specific to your arrangement.
The category is broader than many organisations first assume, and vendors are frequently surprised to find themselves in it.
Subcontractors matter too. A vendor that passes patient information to someone else generally needs arrangements in place with that party as well, and providers should ask vendors how far down their chain the information travels.
Vendors who believe they never see patient information are worth checking on. Access to a system that contains it, even incidentally, is a different question from whether anyone opens a record.
Subject to what your compliance advisers require, a HIPAA business associate agreement typically covers the following ground.
Both organisations, and the work that brings the vendor into contact with patient information.
What the vendor may do with the information, and what it may not.
The administrative, physical, and technical protections the vendor will maintain.
That anyone the vendor engages is bound by equivalent obligations.
How and when the vendor notifies the provider of a suspected breach or improper use.
How the vendor assists with requests relating to patient records.
What the vendor makes available for compliance purposes.
How long it runs, and grounds for ending it.
What happens to patient information when the relationship ends.
Compliance advisers will tell you what is required. These are the operational failures that show up regardless.
Vendors get engaged without one. Someone signs up for a service, connects it to a system holding patient information, and no agreement exists. Procurement and IT need a check that catches this before access is granted, not after.
Nobody tracks what exists. Organisations frequently cannot say which vendors they have agreements with, when they were signed, or where they are stored. A simple register solves most of that.
The agreement is never revisited. Services change, vendors are acquired, and subcontractors are added, and an agreement signed years ago may no longer describe the arrangement.
Termination is forgotten. When a vendor relationship ends, someone needs to confirm what happened to the information, in writing.
Tip: Ask vendors directly where patient information is stored, who else can access it, and which subcontractors are involved. The answers frequently differ from what the sales conversation implied.
A HIPAA business associate agreement should be signed before any patient information is shared. Document Genius walks you through each section with simple questions.
Whether the relationship needs one, and what yours must contain.
What the vendor does and what information that involves.
Establish how far the chain extends.
Route and timing, agreed in advance.
Not after the service is already running.
Keep a record and revisit it when the service changes. Start yours now and confirm the form with your compliance advisers.
A signed document is one component, and it is worth being direct about the rest.
It does not secure the information. Encryption, access controls, monitoring, and vendor diligence do that, and a signature protects nobody by itself.
It does not transfer responsibility. Both organisations carry their own obligations, and a provider cannot contract its way out of its own.
It does not tell you whether a vendor is trustworthy. Assessing security practices before engagement is a separate exercise, and more informative than any clause.
It does not cover your own workforce. Staff obligations are handled through training and internal policies, which are a different matter entirely.
Nothing on this page is legal or compliance advice. No regulatory requirement, covered entity or business associate definition, breach threshold, notification timeframe, or penalty is stated anywhere on it. Take advice from a healthcare compliance professional or an attorney experienced in healthcare privacy.
One place to build, sign, and manage documents.
