Your Business Associate Agreement, built from your vendor stack

[Your practice legal name] [Practice street address]

Effective date: July 29, 2026

Vendor BAA Tracker

A business associate is any vendor that creates, receives, maintains, or transmits protected health information on the practice's behalf (45 CFR 160.103). Before such a vendor touches PHI, the practice must have a signed agreement containing the required 45 CFR 164.504(e) terms (164.502(e); 164.308(b)). This tracker lists the vendors you selected, with the specific action for each. Most established healthcare vendors have their own BAA; signing theirs is normal and usually faster. Use the template below when a vendor has none.

[Select the vendors your practice uses and they will appear here, each with its BAA status and the action to take.]

Usually NOT business associates (no BAA needed): other treating providers you exchange records with for treatment purposes; health plans you bill; couriers such as USPS, UPS, or FedEx acting as mere conduits; cleaning crews and landlords with no access to records (incidental exposure only); and payment processors acting as financial institutions for payment transactions.

Keep this tracker with your signed BAAs and review it at least annually and before adding any new tool that touches patient information. Retain each BAA for six years after it is last in effect (45 CFR 164.530(j); 164.316(b)(2)(i)). If you learn of a pattern of activity that materially breaches a vendor's BAA, take reasonable steps to cure it, and if that fails, terminate the arrangement if feasible (45 CFR 164.504(e)(1)(ii)). (Guidance note, not part of the document.)

Business Associate Agreement

This Business Associate Agreement (“Agreement”) is entered into as of July 29, 2026 (“Effective Date”) by and between:

Covered Entity: [Your practice legal name], of [Practice street address] (“Covered Entity”), and

Business Associate: ______________________________________ (vendor legal name), of ______________________________________ (vendor address) (“Business Associate”).

Use this template when a vendor has no BAA of its own; most established healthcare vendors provide one, and signing theirs is fine as long as it contains the required 45 CFR 164.504(e) terms below. Fill the vendor blanks by hand or in the Word copy. (Guidance note, not part of the document. Remove before signing.)

Recitals

Covered Entity is a covered entity under the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations at 45 CFR Parts 160 and 164, as amended (collectively, “HIPAA”). Business Associate performs services for Covered Entity described in the underlying service arrangement (“Services”) that involve the creation, receipt, maintenance, or transmission of Protected Health Information (“PHI”). The parties enter this Agreement to satisfy 45 CFR 164.502(e), 164.504(e), and 164.308(b).