Adam Frankel
General Counsel · Technology & AI
15+ years as General Counsel to technology, cloud & AI companies
Business Associate Agreement (US) by OLL
Open Legal LibraryUpdated 7 Oct 2026
This HIPAA Business Associate Agreement is for a U.S. healthcare entity engaging a service provider who handles protected health information. It establishes the mandatory regulatory safeguards for data privacy and security required by HIPAA and the HITECH Act.
BUSINESS ASSOCIATE AGREEMENT
HIPAA covered entity to business associate (United States)
Note: Use this Agreement when a health care provider, health plan or health care clearinghouse that is a covered entity under HIPAA engages an outside company that will create, receive, maintain or transmit protected health information (PHI) on its behalf. Typical examples are a software vendor hosting patient records, a billing company, a scheduling or reminder service, an answering service, a consultant, or a law or accounting firm that sees PHI. The Privacy Rule requires a written contract with that company before any PHI is shared (45 C.F.R. Section 164.502(e)), and this Agreement contains every term that 45 C.F.R. Sections 164.504(e)(2) and 164.314(a)(2) require.
Note: Three choices drive most of the negotiation. How quickly the Business Associate must report a breach (Section 4.2). Whether it may keep de-identified or aggregated data for its own use (Sections 2.5 and 2.6). And who pays when a breach happens (Section 10). Each has Option blocks or a fallback note. The rest of the Agreement is regulatory text that both sides should expect to leave alone.
Note: This Agreement sits alongside, and does not replace, the commercial contract for the services. Put the price, service levels and general liability terms in that contract and name it in Exhibit A. If there is no separate contract, describe the services in Exhibit A and this Agreement stands on its own for HIPAA purposes.
This Business Associate Agreement (this "Agreement") is entered into as of [Effective Date e.g. October 15, 2026] (the "Effective Date") between:
(1) [Full Legal Name of the Covered Entity], [Entity Type and State of Organization of the Covered Entity e.g. a Texas nonprofit corporation], with its principal place of business at [Principal Business Address of the Covered Entity] (the "Covered Entity"); and
(2) [Full Legal Name of the Business Associate], [Entity Type and State of Organization of the Business Associate e.g. a Delaware corporation], with its principal place of business at [Principal Business Address of the Business Associate] (the "Business Associate").
The Covered Entity and the Business Associate are each a "Party" and together the "Parties".
Note: Name each Party exactly as it appears on its formation documents. If the Covered Entity is a hybrid entity (a single legal entity that has designated only part of its operations as its health care component), name the legal entity as the Party, because it stays responsible for its business associate agreements (45 C.F.R. Section 164.105(a)(2)(iii)(C)), and describe in Recital B the health care component the Services support. If the Business Associate's affiliates will also handle PHI, either name them here or require them to sign their own agreement; an affiliate that is not a party is not bound.
RECITALS
A. The Covered Entity is a covered entity under the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations.
This is a preview. The full template is free on GitLaw.
5.0 out of 5 on Google
Read reviewsAs seen in
About this template
What is this template?
This Business Associate Agreement establishes the mandatory regulatory safeguards for protected health information (PHI) required by US federal law. It is not a commercial services agreement and should sit alongside a separate contract defining prices and service levels. It contains specific options for breach notification periods, data de-identification rights, and liability caps.
When should you use it?
Use this when a health care provider or health plan shares patient data with an outside service provider. Use a Data Processing Addendum instead for GDPR compliance in the European Union where HIPAA does not apply.
What's inside
| Clause | Name | What it does |
|---|---|---|
| 2 | Permitted and Required Uses and Disclosures | Limits the Business Associate to using protected health information only for the specific Services defined in Recital B or as Required by Law. |
| 3.1 | Safeguards | Incorporates the Security Rule's administrative, physical, and technical safeguards found in 45 C.F.R. Sections 164.308, 164.310, and 164.312. |
| 4.1 | Impermissible uses and security incidents | Requires the Business Associate to report security incidents in writing within [Security Incident Report Period in Business Days e.g. 5] Business Days. |
| 4.2 | Breach of unsecured PHI | Mandates notification of a Breach without unreasonable delay and no later than [Breach Notification Period in Calendar Days e.g. 10] calendar days. |
| 5.1 | Flow-down of obligations | Obliges the Business Associate to enter written agreements with Subcontractors that mirror the data protection requirements of this Agreement. |
| 6.3 | Accounting of disclosures | Requires documentation of PHI disclosures and reporting them to the Covered Entity within [Individual Rights Response Period in Business Days e.g. 10] days. |
| 8.1 | Access by the Secretary | Provides the Secretary of Health and Human Services access to internal books and records to determine HIPAA compliance. |
| 9.2 | Termination for breach | Permits the Covered Entity to terminate the agreement and associated services if a material violation is not cured within [Cure Period in Days e.g. 30] days. |
| 9.3 | Return or destruction of PHI | Requires the Business Associate to return or destroy all PHI within [Return or Destruction Period in Days after Termination e.g. 30] days. |
Who it's for
- a US healthcare provider engaging a software vendor to host patient records
- a health plan contracting with a third-party billing or scheduling service
- a HIPAA covered entity sharing protected health information with a law or accounting firm
- a US business associate engaging a subcontractor to process electronic protected health information
How long it runs and how it's signed
How long
Runs until the work is done
Stated duration
until the later of termination of the Services Agreement and the date all PHI is returned or destroyed
Survives the end
2.4, 3.4, 4, 6.3, 8.1, 9.3, 10, 11
Signed by
COVERED ENTITY authorized representative, BUSINESS ASSOCIATE authorized representative
Witness
Not required
Notarisation
Not required
Law it's drafted under
Governed by
Health Insurance Portability and Accountability Act of 1996
Governed by
HITECH Act
Governed by
45 C.F.R. Parts 160 and 164
Governed by
42 U.S.C. Section 17931(a)
Governed by
Electronic Signatures in Global and National Commerce Act
United States note
This version is drafted for US law generally. Contract, employment and consumer rules vary by state — for example on non-competes and at-will employment. Tell GitLaw which state applies and it adjusts the draft.
Jurisdiction
United States of America
Document info
GitLaw document. Document created on Wed Oct 7th, 2026. Last updated on Wed Oct 7th, 2026.
This document is public
Licensed under CC BY 4.0 (Attribution).
Come to agreements faster
Write, review, negotiate, and manage legal contracts
Related documents
FeaturedUS
Acceptable Use Policy by Mozilla
This policy defines prohibited activities for users of a company's digital services and products. It establishes clear boundaries against illegal acts, harassment, malware distribution, and intellectual property infringement while reserving the right to suspend users who violate these terms.
Updated 13 Aug 2026
US
Github Terms Github Pre Release License Terms (GitHub)
This software license governs the use of pre-release, non-production versions of products for testing and evaluation. It restricts use to internal non-production environments and grants the company broad rights to collect telemetry data and feedback.
Updated 13 Aug 2026
US
Firefox Relay Privacy Notice by Mozilla
This privacy notice outlines how an email alias service handles user data, including the processing of email messages and account information. It details data collection for Firefox Accounts, interaction logs, and technical device data while clarifying that email content is not read or stored.
Updated 13 Aug 2026
US
Github Terms Github Marketplace Terms Of Service (GitHub)
This agreement governs the use of a digital marketplace for selecting and purchasing developer applications or actions. It establishes the legal relationship between the platform operator, third-party software providers, and users who install these tools.
Updated 13 Aug 2026
Business Development Agreement
This agreement establishes a professional relationship where one party provides specialized business development and tender advisory services to another. It includes specific provisions for a success-based commission calculated as a percentage of contract value if a bid is awarded.
Updated 13 Aug 2026
Report a Violation on Formulaic by Mozilla
This notice explains how users can report content policy violations on a digital platform and outlines the subsequent moderation and appeals process. It specifies the information required for a report, the potential penalties for publishers, and the six-month window for appealing a moderation decision.
Updated 13 Aug 2026
Frequently asked questions
A template isn't binding on its own - like any contract, it becomes binding once it's properly completed and signed. Templates in our curated library are professionally drafted for US or UK law; review any template before you sign it.
Yes. Chat with GitLaw to edit any section, or make changes directly in the editor.
Yes, read about team plans here.
Describe what you need in the chat and GitLaw will draft it for you.
Templates in our curated library are professionally drafted for US or UK law. The wider library comes from the GitLaw community and public sources - a solid starting point, but check any template fits your situation before you rely on it.
Mostly US and UK law. Some templates use general commercial terms that work across jurisdictions, and many note which law they're written for.
It depends on the situation. Templates work well for routine business agreements. For anything involving significant money, complex IP, employment, or areas you're unsure about, it's worth getting professional advice before you sign. GitLaw provides templates and tools, not legal advice.
Open any template in GitLaw and describe the change you want in the chat — 'make clause 4 mutual' or 'add a 30-day notice period', for example. GitLaw drafts the revised language and shows it as a suggested edit. You accept, reject, or keep editing from there.
Yes. Upload a Word, PDF, or Markdown file and GitLaw will open it in the editor. You can review, edit, or chat with GitLaw about it the same way you would with any template from the library.
Trusted by 5,000+ businesses
From template to signed, in one place
Every template opens in an editor with an AI agent alongside it.
1
Open
Pick a template and open it. Nothing to download, and no credit card to start.
Free to open
2
Edit with AI
Describe your situation in chat and the agent adapts the wording, clause by clause.
Tracked changes you can review
3
Send and sign
Share it for negotiation, then collect signatures without leaving GitLaw.
eSign included
Built for your legal work,
with practicing lawyers
Trained on 5,500+ clauses and specialist areas of law. Built with a standards committee of independent lawyers.
Adam Frankel
General Counsel · Technology & AI
15+ years as General Counsel to technology, cloud & AI companies
Juliana Calil
Principal Counsel · Technology & Entertainment
20+ years in-house at Google, Intel, Disney and Looker
Adam Wardel
General Counsel, Data Privacy Officer & AI Advisor
12+ years leading legal & privacy for SaaS and AI companies
John Hoffman
Associate Director, Corporate Counsel · Life Sciences & Technology
20+ years in corporate counsel, incl. senior counsel at Certara
Richard Nohe
General Counsel · Telecom, Cloud & Data Centers
20+ years in-house, regional General Counsel at BT across 30+ countries
Joe Al-Khayat
General Counsel · Technology & High-Growth Companies
Cross-jurisdictional M&A and SaaS contracting across the UK, US & Australia
Joshua Woo
Technology, AI & Privacy Counsel · APAC
Former Goldman Sachs Executive Director for AI, cybersecurity & privacy in APAC
Sahil Verma
International Business & Investment Lawyer
13+ years in business law, investment law & dispute resolution
Matthew Willis
CRO & General Counsel · SaaS
Former President of the ACC's 2,200-attorney Chicago Chapter · JD + Kellogg MBA
Mayowa Ogunrinola
Legal Consultant · Fintech & AI Compliance
Regulatory strategy, AI governance & data protection for fintech and AI
Steven J. Shanker
Partner and Chair of Corporate and Employment Law
25+ years as a corporate & employment attorney in New York
As seen in
Ready to get started?
No sales calls, no credit card. Just chat with GitLaw.
GitLaw provides templates and tools, not legal advice. Templates are a starting point, not a substitute for advice on your situation - for anything significant, speak to a qualified lawyer.