Business Associate Agreement Template

When Is a Business Associate Agreement Required?

A HIPAA Business Associate Agreement is necessary whenever a business associate organization is tasked to work at or with an organization providing medical services and is charged with the handling or sharing of PHI for clients or patients. Business Associate Agreement stipulations will also be necessary when an organization shares PHI with a secondary organization to protect all groups from liability as well as certifying that HIPAA governance is followed across multiple organizations.

How to Write a Business Associate Agreement?

To craft a sample Business Associate Agreement that can be utilized on an as-needed basis, you will want to include the details listed below:

1. An introductory statement of the Business Associate Agreement that both entities will be agreeing on. Both business names and entity descriptors (covered entity, business associate, or business associate subcontractor) should be listed in the first sentence of the document. For example, you can write the agreement between, "Dr. John Stevens (covered entity) and Top Safe Group (business associate)."

2. A statement that this contract will remain in effect for the duration of the agreement and that both parties will agree to the terms listed below.

3. An in-depth list of all HIPAA regulations that both parties agree to adhere to when handling PHI.

   • You will need to incorporate language detailing regulations from HITECH (the Health Information Technology for Economic and Clinical Health Act, 2009) that will be followed;
   • PHI will only be disclosed when permitted by law.

4. Include the potential to dissolve said Business Associate Agreement if the business associate organization violates any portion of the agreement. The covered entity must also allow the business associate a chance to remedy the violation in five business days after notification is sent of the breach to allow the business associate to straighten out the issue. If the Business Associate fails to have taken the proper steps to staunch a breach, then the Covered Entity is responsible for taking the next action to terminate the agreement and notify the U.S. Department of Health and Human Services.

5. Guidelines detailing how PHI must be returned or destroyed should termination occur. It is the duty of the business associate organization to first try to destroy the PHI records and barring that, return them to the covered entity immediately.

6. Acknowledgment that no third party will benefit themselves from the agreement.

7. Right of the business associate or subcontractor to disclose de-identified material, as long as it does not contain any key to identify the information.

8. Amendments may later be added to the document with the approval of both entities.

9. All obligations within the agreement must still be met after the agreement has expired or been terminated in order to protect PHI.

10. Final signature section, detailing each party's role, date, and title of each signee.

Still looking for a particular form? Take a look at the related templates below:

• Notice of Closure;
• Performance Contract;
• Press Release.