Business Associate Agreement

Covered Entity: [Name] Business Associate: [Name] Effective Date: [Date]

1. Purpose

This Agreement ensures Business Associate appropriately safeguards Protected Health Information ("PHI") it creates, receives, maintains, or transmits on behalf of Covered Entity, per HIPAA and the HITECH Act.

2. Permitted Uses and Disclosures

Business Associate may use or disclose PHI only as necessary to perform the services described in [the underlying services agreement], or as required by law.

3. Safeguards

Business Associate will implement appropriate administrative, physical, and technical safeguards to protect PHI, consistent with the HIPAA Security Rule.

4. Reporting

Business Associate will report to Covered Entity any use or disclosure of PHI not permitted by this Agreement, including any breach of unsecured PHI, without unreasonable delay and no later than [required timeframe under HITECH].

5. Subcontractors

Business Associate will ensure any subcontractor that creates, receives, or transmits PHI on its behalf agrees to the same restrictions and conditions.

6. Access and Amendment

Business Associate will make PHI available to Covered Entity as needed to respond to an individual's request for access or amendment under HIPAA.

7. Return or Destruction of PHI

Upon termination of this Agreement, Business Associate will return or destroy all PHI, if feasible, or extend these protections if return/destruction is not feasible.

8. Term and Termination

Covered Entity may terminate this Agreement if Business Associate materially breaches its obligations and fails to cure.

Covered Entity: ______________________ Date: ____________ Business Associate: ______________________ Date: ____________

*This document is provided for informational and educational purposes only and does not constitute legal advice. A BAA is a specific, legally required document under HIPAA when PHI is shared with a vendor — this general template covers the standard required elements, but have a healthcare-compliance attorney review it, since HIPAA enforcement carries real financial penalties for gaps.*