Free HIPAA reference template · v1.0 · Applies to covered entities & business associates
Adopting this document means committing to these HIPAA controls, the 45 CFR §164 requirements it helps satisfy, by area:
Common threats (NIST SP 800-30 classes) that the controls behind this document defend against:
Exploits: Missing BAA; weak vendor controls · 164.308(b) / 164.502(e) BA Contracts
Template: have counsel review before use. This is the downstream BAA between a Business Associate and its Subcontractor. HIPAA requires the same protections to flow down (45 CFR §§ 164.502(e)(1)(ii), 164.504(e)). Replace
[bracketed]items.
This Subcontractor Business Associate Agreement ("Agreement") is entered into by [Business Associate] ("Business Associate") and [Subcontractor] ("Subcontractor"), effective [YYYY-MM-DD]. Terms not defined here have the meaning in the HIPAA Rules (45 CFR Parts 160 and 164).
Subcontractor may use or disclose PHI only as necessary to perform [the services] for Business Associate, as required by law, or for its own proper management, and never in a manner that would violate the HIPAA Rules or Business Associate's own BAA with the Covered Entity. Subcontractor uses only the minimum necessary PHI.
Subcontractor will: (a) not use or disclose PHI except as permitted here or required by law; (b) apply appropriate safeguards and comply with the Security Rule for electronic PHI; (c) report to Business Associate any use or disclosure not provided for, including security incidents and breaches of unsecured PHI, without unreasonable delay and no later than [X days] after discovery; (d) bind its own subcontractors in writing to the same terms; (e) make PHI available for access, amendment, and accounting as Business Associate directs so the Covered Entity can meet its obligations; (f) make its internal practices, books, and records available to HHS; and (g) at termination all PHI, or extend these protections to PHI it cannot feasibly return or destroy.
See where your organization stands on the controls this template cites.
Join UsEffective on the date above until all PHI is returned or destroyed. Business Associate may terminate on an uncured material breach within [30 days]. Return/destruction obligations survive termination.
The parties will amend this Agreement as needed to comply with the HIPAA Rules, and it is interpreted to permit such compliance. [Governing law and other business terms to be added by counsel.]
Business Associate: [name / title / signature / date] Subcontractor: [name / title / signature / date] · v1.0.