Healthcare & HIPAA

Free HIPAA Business Associate Agreement Generator

Create a HIPAA BAA covering permitted PHI use, safeguards, incidents, subcontractors and termination. Edit model clauses and export Word, HTML or PDF.

No signup
Browser-based generation
HTML & Word downloads
Print or save PDF

Make it yours

Create your HIPAA Business Associate Agreement

Fields marked * are required. Open a section to begin; close it to bring the next section into view.

Covered entity legal name *

Covered entity address *

Covered entity privacy contact *

Covered entity email *

Covered entity telephone *

Business associate legal name *

Business associate address *

Business associate incident contact *

Business associate email *

Business associate telephone *

Country *Editable exampleEditable sample; confirm the actual jurisdiction.

Governing state law and courts *

Agreement date *Proposed date, not a recorded signature.

Underlying agreement and services *Identify actual agreement, services and order of precedence.

PHI categories, purpose and location *Describe minimum necessary categories, operations, permitted purpose and actual storage/access locations; do not enter patient records.

Permitted uses and disclosures *Editable example

Additional expressly agreed usesOptional: state any lawful management/administration or data-aggregation permission and its restrictions. No such permission is added automatically.

Actual safeguards and security responsibilities *Specify implemented protections and responsibilities appropriate to the PHI/ePHI. Do not claim unverified encryption, testing or certification.

Security and confidentiality obligations *Editable example

Incident reporting procedure *Editable example

Agreed reporting timelines and escalation *State actual contractual deadlines and escalation routes consistent with applicable breach-notification law.

Actual subcontractors and approval process *List authorised subcontractors, roles/locations and change controls, or state none.

Subcontractor protections *Editable example

Access, amendment and disclosure accounting *Editable example

HHS access *Editable example

Agreement term and material-breach termination *Specify the term and cure/termination process. The covered entity must be able to terminate for a material violation; where termination is infeasible, preserve required reporting to HHS.

Return, destruction and infeasibility *Specify return/destruction timing for all PHI and copies at termination. Where infeasible, require continued protection and limited uses/disclosures for the reason preventing return/destruction.

Additional agreed termsOptional reviewed commercial terms; no liability cap or indemnity is added automatically.

From information to a useful document

How to create your hipaa business associate agreement

Identify both parties and their roles, services, permitted PHI use, actual safeguards, incident contacts, subcontractors, return/destruction and execution terms.

01
Gather accurate information
Identify the responsible organisation, scope and actual contact routes. USA is an editable example country. HIPAA tools address US obligations; a location field does not establish whether a law applies.
02
Tailor examples and findings
Open each section. Keep suitable model wording or edit it, and use Restore example when needed. Actual parties, clinical explanations, controls and findings are not invented. Closing a section brings the next into view while keeping answers.
03
Review and export
Read the complete document and verify required details. Download Word or HTML, or open Print / Save PDF for a fixed copy. The preview, formatted copy and exports include a link to this exact tool.
04
Complete the private execution process
Share only with intended recipients. Obtain appropriate review and complete signatures or consent through the required process. The generator does not sign, obtain consent, send or file the document.

Purpose-specific content

What your document covers

Parties and services → PHI uses and restrictions → safeguards and incidents → individual rights and HHS access → subcontractors → termination → signatures.

Conditional questions follow the selected purpose or activity. Sample procedures stay editable. Patient records, identifiable student cases and credentials should remain in the organisation’s approved systems.

Before use

Scope, privacy and review

This unsigned BAA does not implement safeguards or certify HIPAA compliance. Confirm the covered-entity/business-associate relationship, state law, service agreement and any separate Part 2 obligations.

Generation takes place in this browser. Form answers are not sent to a document-generation service or saved between visits. Download before leaving.
Enter organisation-level details and relevant evidence summaries. Keep patient-identifying records and sensitive supporting evidence in approved organisational systems.
Check applicable requirements, operational capacity and authority before use. Model wording does not verify facts, implement safeguards or confer legal compliance.

Template maintenance

Substantive update: 9 October 2026. No certification or review by a named legal professional is claimed.

Common questions

Frequently asked questions

Is this tool free, and do I need an account?

Creating, copying and exporting your document is free and requires no account. Form answers are processed in this browser and are not saved between visits.

Does a signed BAA alone make a service HIPAA compliant?

No. The parties must implement applicable safeguards, procedures and other legal duties. A BAA allocates permitted uses and contractual responsibilities; the generator does not assess the service or execute the agreement.

Can I keep or edit the sample content?

Yes. Fields marked “Editable example” contain model wording with Restore example controls. USA is an editable sample country, not a determination of applicable law. Keep wording only when it matches the actual situation. Enter actual parties, contacts, clinical information supplied by a professional or assessment evidence as appropriate; do not enter patient records, student case details or credentials.

Which export formats are available?

Download HTML or an editable Word .docx document. For PDF, open Print / Save PDF and choose Save as PDF in the browser print dialog. Preview, formatted copy and exports contain a link to this exact tool. Publish policies where appropriate; share consent, contract and assessment documents privately with intended recipients.

Reference for your review

HHS: business associate contract provisions. Check the rules applicable to the organisation, records and activity; reference links do not establish applicability or certification.

Create your HIPAA Business Associate Agreement

Parties & agreement+

Services & permitted PHI use+

Safeguards, incidents & subcontractors+

Individual rights, oversight & termination+

How to create your hipaa business associate agreement

Gather accurate information

Tailor examples and findings

Review and export

Complete the private execution process

What your document covers

Scope, privacy and review

Frequently asked questions

Reference for your review

Related policy and review tools