Free HIPAA reference template · v1.0 · Applies to covered entities & business associates
Adopting this document means committing to these HIPAA controls, the 45 CFR §164 requirements it helps satisfy, by area:
Template: have counsel review before use. This is a contract between a Covered Entity (or a Business Associate) and its Business Associate. It contains the terms 45 CFR §§ 164.504(e) and 164.314(a) require. Replace
[bracketed]items; add any state-law or business terms with your lawyer.
This Business Associate Agreement ("Agreement") is entered into by [Covered Entity] ("Covered Entity") and [Business Associate] ("Business Associate"), effective [YYYY-MM-DD]. Terms not defined here have the meaning in 45 CFR Parts 160 and 164 (the "HIPAA Rules").
Business Associate may use or disclose Protected Health Information (PHI) only: (a) as necessary to perform the services described in [the underlying services agreement]; (b) as required by law; and (c) for its own proper management and administration or to carry out its legal responsibilities, provided that disclosures for (c) are required by law or made with reasonable assurances of continued protection. Business Associate will not use or disclose PHI in any manner that would violate the HIPAA Rules if done by Covered Entity, except as permitted in Section 1(c).
Business Associate will: (a) not use or disclose PHI other than as permitted by this Agreement or required by law; (b) use appropriate administrative, physical, and technical safeguards, and comply with the Security Rule with respect to electronic PHI, to prevent unauthorized use or disclosure; (c) report to Covered Entity any use or disclosure not provided for by this Agreement of which it becomes aware, including security incidents and breaches of unsecured PHI, without unreasonable delay and no later than [X days / 60 days] after discovery; (d) ensure any subcontractor that creates, receives, maintains, or transmits PHI on its behalf agrees in writing to the same restrictions and conditions; (e) make PHI available for access (§ 164.524), amendment (§ 164.526), and an accounting of disclosures (§ 164.528) as directed by Covered Entity; (f) make its internal practices, books, and records available to HHS for a compliance determination; and (g) use the minimum necessary PHI to accomplish the intended purpose.
Covered Entity will notify Business Associate of any limitation in its Notice of Privacy Practices, any changes to or revocation of an individual's authorization, and any restriction on use/disclosure it has agreed to, to the extent these affect Business Associate's use or disclosure of PHI.
This Agreement is effective on the date above and continues until all PHI is returned or destroyed. Covered Entity may terminate if Business Associate materially breaches and fails to cure within [30 days]. On termination, Business Associate will return or destroy all PHI it holds and retain none; where return or destruction is infeasible, it will extend the protections of this Agreement to the retained PHI and limit further use to the purposes that make return or destruction infeasible.
The parties will amend this Agreement as needed to comply with the HIPAA Rules. This Agreement is interpreted to permit compliance with the HIPAA Rules. [Governing law, indemnity, and other business terms to be added by counsel.]
Covered Entity: [name / title / signature / date] Business Associate: [name / title / signature / date] · v1.0.
See where your organization stands on the controls this template cites.
Join Us