HIPAA BAA Template: Sample Business Associate Agreement

There is no required HIPAA BAA template: HHS publishes sample business associate agreement provisions, and any business associate agreement (BAA) meets HIPAA's contract rules if it contains the terms that 45 CFR 164.504(e) and, for electronic PHI, 164.314(a) require (HHS; eCFR). Use the checklist below to draft one or to review a vendor's. Curve Compliance, which signs a BAA on every plan for HIPAA-compliant ad tracking, checked HHS's sample and the eCFR text on October 26, 2026.

Book a call. A BAA with each vendor that handles PHI on your behalf is the rule, and Meta and Google Ads do not sign one. Curve Compliance sends conversions server-side, strips PHI before data reaches an ad platform, and signs a BAA on every plan. Book a call with Curve.

Is there an official HIPAA BAA template?

The closest thing is HHS's Sample Business Associate Agreement Provisions, published January 25, 2013, which HHS's business associate guidance points readers to (HHS). HHS says: "This is only sample language and use of these sample provisions is not required for compliance with the HIPAA Rules." HHS warns that the provisions "alone may not be sufficient to result in a binding contract under State law" and do not replace "consultation with a lawyer or negotiations between the parties to the contract" (HHS). Treat the sample as a clause list, not a finished contract, and talk to your counsel before you sign. HHS also hosts a Model Business Associate Agreement PDF, a full form with blanks and signature lines. Its HITECH clause says the law's changes "may be further clarified in forthcoming regulations and guidance," so check any copy against the checklist below, which follows the current eCFR text.

Our BAA explainer covers what a BAA is and who must sign one; see also what a business associate is and what a covered entity is.

The required clauses, as a checklist

A contract between a covered entity and a business associate must contain the terms in 45 CFR 164.504(e)(2) (eCFR). When electronic PHI is involved, the Security Rule adds the terms in 164.314(a)(2)(i) (eCFR). The third column maps each term to HHS's sample (HHS).

Required term	Rule	HHS sample section	What to check in a draft
Permitted and required uses and disclosures of PHI	164.504(e)(2)(i)	Permitted Uses and Disclosures, (a)	A list of purposes, or a pointer to the services agreement. Whether the vendor may de-identify PHI.
No other use or disclosure	164.504(e)(2)(ii)(A)	Obligations, (a)	Uses limited to the contract or as required by law.
Safeguards, and the Security Rule for electronic PHI	164.504(e)(2)(ii)(B); 164.314(a)(2)(i)(A)	Obligations, (b)	A reference to Subpart C of 45 CFR Part 164.
Reporting of uses not allowed, breaches and security incidents	164.504(e)(2)(ii)(C); 164.314(a)(2)(i)(C)	Obligations, (c)	A reporting deadline, and who notifies patients, OCR and the media.
Subcontractors agree to the same terms	164.504(e)(2)(ii)(D); 164.314(a)(2)(i)(B)	Obligations, (d)	Flow-down before any subcontractor gets PHI.
Patient access to PHI	164.504(e)(2)(ii)(E)	Obligations, (e)	Who answers a patient's request, and how fast.
Amendment of PHI	164.504(e)(2)(ii)(F)	Obligations, (f)	The same: who acts on a request, and when.
Accounting of disclosures	164.504(e)(2)(ii)(G)	Obligations, (g)	Who keeps the record, and who answers the patient.
Privacy Rule duties done for you	164.504(e)(2)(ii)(H)	Obligations, (h)	Only if the vendor carries out a Privacy Rule duty for you.
Books and records open to HHS	164.504(e)(2)(ii)(I)	Obligations, (i)	Access for HHS, not just for you.
Return or destroy PHI at the end	164.504(e)(2)(ii)(J)	Term and Termination, (c)	Return or destruction; if that is not feasible, the contract's protections extend to what is kept; anything kept for the vendor's own administration; and survival after the contract ends.
Termination for a material violation	164.504(e)(2)(iii)	Term and Termination, (b)	Whether the vendor gets a cure period first.

Watch for two optional terms. Under 164.504(e)(4), the contract may let the business associate use PHI "for the proper management and administration of the business associate" or "to carry out the legal responsibilities of the business associate," and under 164.504(e)(2)(i)(B) it may permit "data aggregation services relating to the health care operations of the covered entity" (eCFR). For the fine print beyond the required terms, see what a BAA covers.

HHS's sample provisions, section by section

HHS notes that "Words or phrases contained in brackets are intended as either optional language or as instructions to the users of these sample provisions" (HHS). Here is what each part does, in plain English.

• Definitions. A catch-all clause gives terms such as Breach, Security Incident and Subcontractor "the same meaning as those terms in the HIPAA Rules," and two blanks name the business associate and the covered entity (HHS).
• Obligations and Activities of Business Associate. The duties lettered (a) to (i), matching the checklist above. A bracketed note says the parties may add "a stricter timeframe for the business associate to report a potential breach to the covered entity," and decide who notifies patients and OCR (HHS).
• Permitted Uses and Disclosures by Business Associate. Two options: a specific list of purposes, or a reference to the services agreement, such as "as necessary to perform the services set forth in Service Agreement." The parties should also say whether the vendor may de-identify PHI, and set minimum necessary limits (HHS).
• Provisions for Covered Entity to Inform Business Associate. Optional: you tell the vendor about limits in your notice of privacy practices, changes in a patient's permission, and restrictions you agreed to under 45 CFR 164.522 (HHS).
• Permissible Requests by Covered Entity. Optional: you will not ask the vendor to use or disclose PHI in a way that would break the Privacy Rule "if done by covered entity" (HHS).
• Term and Termination. Start and end dates, termination for cause with an optional cure period, and what happens to PHI. Under Option 1 the vendor returns or destroys it and "shall retain no copies of the protected health information." Option 2 lets it keep only what it needs for its own administration or legal duties, under the same safeguards. These obligations "shall survive the termination of this Agreement" (HHS).
• Miscellaneous. Optional: rule references mean the section "as in effect or as amended," the parties will amend the agreement as the rules require, and any ambiguity is read "to permit compliance with the HIPAA Rules" (HHS).

Subcontractor BAAs

A business associate that passes PHI to its own vendor needs a BAA with that vendor too. Under 45 CFR 164.502(e)(1)(ii), it may let a subcontractor handle PHI on its behalf "if the business associate obtains satisfactory assurances" (eCFR), and 164.504(e)(5) applies the same contract terms "in the same manner" (eCFR). HHS says its sample "may be adapted for purposes of the contract between a business associate and subcontractor" (HHS).

The covered entity does not need its own BAA with the subcontractor. The rule says it "is not required to obtain such satisfactory assurances from a business associate that is a subcontractor" (eCFR). Agencies should read what an agency BAA commits you to.

Your BAA or the vendor's?

Either works if it contains the required terms. HHS says the provisions "may be incorporated into an agreement for the provision of services" or into "a separate business associate agreement," and "The language may be changed to more accurately reflect business arrangements" (HHS). Software vendors often bring their own BAA, and some offer it only on certain plans: Box on its Enterprise tiers and Dropbox on the team plans it lists. On a vendor's paper, check the breach reporting deadline, which products and plans it covers, and what happens to your data when you leave.

BAA vs NDA

A nondisclosure agreement (NDA) and a BAA both promise confidentiality, but only the BAA must contain the terms listed in 45 CFR 164.504(e)(2) (eCFR). An NDA can sit alongside a BAA, but unless it contains every term in 164.504(e)(2), it cannot stand in for one.

What a BAA does not cover: ad platforms

A BAA covers the PHI that one business associate handles for you. It does not stretch to companies outside it, including the ad platforms your website sends data to. The BAA Directory lists Meta and Google Ads as not signing one; see which ad platforms sign a BAA. HHS's tracking guidance says that if a regulated entity does not want a business associate relationship with a vendor that meets the definition, "it cannot disclose PHI to such a vendor without individuals' authorizations" (HHS). See HIPAA authorization and ad tracking.

How Curve Compliance helps

Curve Compliance acts as your business associate for ad tracking and signs a BAA on every plan, before live tracking begins (BAA Directory entry; why every plan includes one). Curve replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. Each platform receives only a fixed list of fields, contact identifiers are off by default on Meta, Google Ads and TikTok, and Curve checks every event for PHI-like patterns and strips PHI before data reaches an ad platform.

Curve is SOC 2 Type II, and Curve's team does the setup, typically live in about a week. Ask for Curve's BAA on your call and review it against the checklist above.

Sources, checked October 26, 2026: HHS, Sample Business Associate Agreement Provisions; 45 CFR 164.504; 45 CFR 164.314; 45 CFR 164.502; HHS, Business Associates FAQs; HHS, Use of Online Tracking Technologies; HHS, Guidance on HIPAA and Cloud Computing; HHS, Model Business Associate Agreement (PDF).

Frequently Asked Questions

Is there an official HIPAA BAA template?

HHS publishes Sample Business Associate Agreement Provisions, dated January 25, 2013, but says using them "is not required for compliance with the HIPAA Rules" (HHS). Any BAA meets HIPAA's contract rules if it contains the terms in 45 CFR 164.504(e) and, for electronic PHI, 164.314(a) (eCFR).

Does HIPAA require a business associate agreement?

Yes, whenever a covered entity lets a business associate create, receive, maintain or transmit PHI on its behalf. The covered entity needs "satisfactory assurance" that the business associate will safeguard the information, "documented through a written contract or other written agreement or arrangement" that meets 164.504(e) (45 CFR 164.502(e)).

What is an example of a business associate for HIPAA?

HHS's examples include a third party administrator that helps a health plan with claims processing, a CPA firm whose accounting work involves PHI, a cloud service provider that stores electronic PHI, and an IT contractor that supports systems holding it (HHS). See what a business associate is for the legal test.

Can you provide an example of a HIPAA business associate agreement?

HHS's Sample Business Associate Agreement Provisions are the example its business associate guidance points to, with brackets marking the choices the parties fill in (HHS). HHS also hosts a full Model Business Associate Agreement form; check either against the checklist above. The section-by-section guide above explains each part.

What is a HIPAA agreement?

Usually a business associate agreement: the satisfactory assurances a covered entity must get from a business associate, "in the form of a contract or other written arrangement" (HHS). A patient's signed HIPAA authorization is a different document; see HIPAA authorization and ad tracking.

Is a baa the same as an NDA?

No. An NDA promises confidentiality, while a BAA must contain the specific terms in 45 CFR 164.504(e)(2), such as permitted uses, safeguards, breach and security incident reporting, subcontractor flow-down and return or destruction of PHI (eCFR). An NDA without those terms does not meet the rule.

Can you be HIPAA compliant without a BAA?

Not if you share PHI with a vendor that meets the business associate definition. HHS says a covered entity that stores electronic PHI with a cloud provider without a BAA "is in violation of the HIPAA Rules" (HHS), and that without a business associate relationship with a tracking vendor, "it cannot disclose PHI to such a vendor without individuals' authorizations" (HHS). Some recipients, such as conduits and providers treating the patient, need no BAA.

For which of the following is a business associate contract not required?

HHS lists disclosures to a health care provider for treatment, to a health plan for payment, through conduits such as the US Postal Service, to people like janitors whose access to PHI is only incidental, and to banks processing payments for health care (HHS). See when you don't need a BAA.

Talk to Curve Compliance

Book a call. Your vendors that handle PHI sign a BAA, and your ad platforms do not. Curve Compliance signs a BAA on every plan, sends conversions server-side and strips PHI before data reaches an ad platform. Curve's team does the setup, typically live in about a week. Book a call with Curve.