How to ask a vendor for a BAA

Check the Directory first

Of the 181 tools in the BAA Directory, 45 sign a BAA outright and 78 sign one only on specific plans. Their entries quote how the vendor offers it, often an admin accepting it inside the account or a request through sales. For the 23 tools with no public statement, and for any tool that isn't listed, the email below is the place to start.

Using several tools? Tick them in the BAA stack checker to see which vendors you still need to ask.

The email

Send it to the vendor's sales or compliance contact, and fill in the parts in square brackets. It names the HIPAA contract rule, 45 CFR 164.504(e), and asks the five questions that decide whether the BAA fits how you use the tool.

Vendor questionnaire

Each question below comes from what HIPAA says a business associate contract must contain. Under each one is the rule it comes from, quoted from the eCFR. The last question is based on a proposed rule that is not final.

1. Will you sign a BAA that covers the service and plan we use? If it needs a different plan, edition or add-on, which one?
   45 CFR 164.504(e)(2): “A contract between the covered entity and a business associate must:”
2. Which uses and disclosures of our patients' information will the BAA permit?
   45 CFR 164.504(e)(2)(i): “Establish the permitted and required uses and disclosures of protected health information by the business associate.”
3. Will you use or disclose our patients' information only as the BAA permits or as the law requires?
   45 CFR 164.504(e)(2)(ii)(A): “Not use or further disclose the information other than as permitted or required by the contract or as required by law;”
4. Which safeguards protect our patients' electronic information, and do you comply with the HIPAA Security Rule?
   45 CFR 164.504(e)(2)(ii)(B): “Use appropriate safeguards and comply, where applicable, with subpart C of this part with respect to electronic protected health information”
5. How, and how quickly, will you report a use or disclosure the BAA doesn't allow, a security incident or a breach of unsecured protected health information?
   45 CFR 164.314(a)(2)(i)(C): “Report to the covered entity any security incident of which it becomes aware, including breaches of unsecured protected health information as required by § 164.410.”
6. Which subcontractors create, receive, maintain or transmit our patients' information, and have they agreed to the same restrictions?
   45 CFR 164.504(e)(2)(ii)(D): “ensure that any subcontractors that create, receive, maintain, or transmit protected health information on behalf of the business associate agree to the same restrictions and conditions that apply to the business associate with respect to such information;”
7. How will you help us give patients access to their information, amend it, and account for its disclosures?
   45 CFR 164.504(e)(2)(ii)(E) to (G): “Make available the information required to provide an accounting of disclosures in accordance with § 164.528;”
8. Will you make your practices, books and records about our patients' information available to HHS when it asks?
   45 CFR 164.504(e)(2)(ii)(I): “available to the Secretary for purposes of determining the covered entity's compliance with this subpart”
9. What happens to our patients' information when the contract ends?
   45 CFR 164.504(e)(2)(ii)(J): “At termination of the contract, if feasible, return or destroy all protected health information received from, or created or received by the business associate on behalf of, the covered entity”
10. Can we end the contract if you violate a material term of the BAA?
    45 CFR 164.504(e)(2)(iii): “Authorize termination of the contract by the covered entity, if the covered entity determines that the business associate has violated a material term of the contract.”
11. Which of your products, features or plans does the BAA leave out?
    Not a rule: vendors often name products or features their BAA leaves out, and each directory entry lists them where the vendor says so.
12. Proposed: will you give us written verification of your technical safeguards at least once every 12 months?
    Proposed Security Rule, 90 FR 898 (January 6, 2025): “The Department proposes to require that the regulated entity obtain this written verification documenting the business associate's deployment of the required technical safeguards at least once every 12 months.”

Reading the vendor's answer

• It signs. Keep the signed BAA and note the date, the service and the plan it covers.
• It signs on specific plans. Get in writing that your plan, edition or add-on is one of them.
• It won't sign. Keep patient information out of the tool.
• No answer. Until the vendor puts a BAA in writing for you, treat it as a tool that has not agreed to protect patient data.

HHS's sample BAA provisions

HHS publishes sample business associate agreement provisions. In its words: “This document includes sample business associate agreement provisions to help covered entities and business associates more easily comply with the business associate contract requirements.” HHS also says “This is only sample language and use of these sample provisions is not required for compliance with the HIPAA Rules.”

For a sample agreement, see our HIPAA BAA template guide.

This page is not legal advice. Talk to your counsel before you sign a vendor's BAA or send your own.

Frequently asked questions