# HIPAA Business Associate Agreement (BAA)

> **⚠️ Legal template — review by a qualified attorney is required before use.** Generic starting point from SentinelPanda reflecting the HIPAA Privacy and Security Rules (45 CFR Parts 160 & 164). **Not legal advice.** Must be tailored to your arrangement and reviewed by counsel.

This Business Associate Agreement ("BAA") is between **[Covered Entity / Business Associate — legal name]** ("Covered Entity") and **[Business Associate — legal name]** ("Business Associate"), effective [Effective Date], and governs Protected Health Information ("PHI") the Business Associate creates, receives, maintains, or transmits for the Covered Entity.

## 1. Definitions
Terms used have the meaning in the HIPAA Rules (45 CFR §§160.103, 164.501).

## 2. Permitted uses & disclosures
Business Associate may use or disclose PHI only: (a) as permitted by this BAA or the underlying services agreement; (b) as required by law; or (c) for its proper management and to provide data-aggregation services to the Covered Entity, consistent with the Rules. Business Associate will not use or disclose PHI beyond what the Covered Entity could.

## 3. Safeguards
Business Associate will implement administrative, physical, and technical safeguards (including those required by the Security Rule for electronic PHI) to protect PHI, and will comply with the Security Rule with respect to ePHI.

## 4. Subcontractors
Business Associate will ensure any subcontractor that creates, receives, maintains, or transmits PHI on its behalf agrees in writing to the same restrictions and conditions.

## 5. Minimum necessary
Business Associate will limit use, disclosure, and requests of PHI to the minimum necessary to accomplish the intended purpose.

## 6. Breach & incident reporting
Business Associate will report to the Covered Entity any use or disclosure not permitted by this BAA, any Security Incident, and any Breach of Unsecured PHI, without unreasonable delay and no later than [number] days after discovery.

## 7. Access, amendment, accounting
Business Associate will make PHI available to satisfy the Covered Entity's obligations regarding individual access (§164.524), amendment (§164.526), and accounting of disclosures (§164.528).

## 8. Termination
On termination, Business Associate will return or destroy all PHI where feasible and retain none; if infeasible, it will extend protections and limit further use.

## 9. Compliance
The parties will amend this BAA as needed to comply with changes in the HIPAA Rules.

**Covered Entity:** ____________ Name/Title: ________ Date: ______
**Business Associate:** ____________ Name/Title: ________ Date: ______