HIPAA Business Associate Agreement (BAA)

Produces a HIPAA/HITECH-compliant BAA tailored to services, PHI flow, and risk profile.

Prerequisites

Party identities, entity types, jurisdictions, notice addresses.
Underlying services agreement/SOW with plain-language service description.
PHI data map: categories, ePHI vs. paper, systems, storage locations, data flows.
Regulatory overlays: state privacy/breach laws, 42 CFR Part 2, VA/military records.
Security posture: safeguards summary, risk assessment cadence, incident contacts.
Risk allocation: indemnity, insurance limits, liability caps.
Preferred timelines: breach notice deadline, cure period, termination notice.

Output Structure

Draft sections in this order, filling placeholders from matter facts:

Parties, Effective Date, Recitals — basis for BA relationship
Definitions — HIPAA statutory terms + agreement-specific terms
Permitted Uses/Disclosures; Prohibited Uses
Safeguards — Privacy Rule + Security Rule
Breach/Incident Notification
Subcontractor Flow-Downs
Individual Rights Support
Government Access / Compliance Cooperation
Term/Termination; Return/Destruction of PHI
Indemnity/Insurance; Liability Allocation
Miscellaneous — amendment, governing law, notices, assignment, severability, survival
Signatures; Exhibits — implementation checklist

Definitions

Include all applicable terms with statutory citations:

| Term | Source | |---|---| | Protected Health Information (PHI) | 45 CFR 160.103 [VERIFY] | | Electronic PHI (ePHI) | 45 CFR 160.103 [VERIFY] | | Breach | 45 CFR 164.402 [VERIFY] | | Security Incident | 45 CFR 164.304 [VERIFY] | | Unsecured PHI | HHS Guidance / NIST [VERIFY] | | Designated Record Set | 45 CFR 164.501 [VERIFY] | | Required by Law, Individual, Secretary, Subcontractor, Use, Disclosure | HIPAA definitions [VERIFY] |

Required Clauses (Minimums)

[ ] Permit/limit uses and disclosures to services + required by law
[ ] Prohibit uses/disclosures that would violate Privacy Rule if done by covered entity
[ ] Require safeguards: Privacy Rule + Security Rule (45 CFR 164.308/310/312) [VERIFY]
[ ] Require breach notification and security incident reporting
[ ] Flow-down to subcontractors with same restrictions/conditions
[ ] Support individual access/amendment/accounting rights
[ ] Make records available to HHS Secretary for compliance review
[ ] Provide return/destruction of PHI or extend protections if infeasible
[ ] Allow termination for material breach

Permitted and Prohibited Uses

| Topic | Drafting Requirement | |---|---| | Core permitted uses | Tie each to a service obligation; include data aggregation if applicable | | Management/admin uses | Allow only if required by law or with recipient assurances | | Required by law | Permit with notice to covered entity where allowed | | Minimum necessary | Require policies; define exceptions (treatment, disclosures to CE) | | Prohibited uses | No sale of PHI; no marketing without authorization; no psychotherapy notes unless authorized |

Safeguards

[ ] Administrative: security official, access management, workforce training, incident response, contingency plan
[ ] Physical: facility access controls, workstation use/security, device/media disposal
[ ] Technical: unique IDs, emergency access, auto-logoff, encryption, audit controls, integrity controls, authentication, transmission security
[ ] Risk analysis: documented, updated regularly, remediation tracked

Breach / Incident Notification

| Element | Requirement | |---|---| | Deadline | "Without unreasonable delay," capped in days (e.g., 10 business days) | | Discovery standard | Knowledge or would-have-known with reasonable diligence | | Content | Dates, description, PHI types, affected count, mitigation steps, contact info | | Supplemental updates | Required as new facts emerge | | Incident logs | Maintain and provide periodic summaries of non-breach incidents |

Individual Rights Support

| Right | BA Obligation | |---|---| | Access | Provide Designated Record Set data within X days per 45 CFR 164.524 [VERIFY] | | Amendment | Implement amendments within X days; flow-down to subcontractors | | Accounting | Maintain disclosure logs per 45 CFR 164.528 [VERIFY] | | Restrictions / confidential comms | Implement covered entity instructions |

Subcontractors

[ ] Prior written approval required (if negotiated)
[ ] Written BAA-equivalent flow-down with identical restrictions
[ ] Ongoing monitoring/audit rights and prompt notice of issues

Termination / PHI Disposition

[ ] Term tied to services; survives until PHI returned/destroyed
[ ] Cure period and immediate termination triggers for material breach
[ ] Return/destroy within X days; certification of destruction
[ ] If infeasible: extend protections, limit further uses/disclosures

Exhibit: Implementation Checklist

[ ] Contact points and escalation path
[ ] Security program baseline and audit cadence
[ ] Subcontractor list and approvals
[ ] Incident response tabletop schedule

Guidelines

Match obligations to actual operational capability — do not promise controls the BA cannot meet.
Align with the underlying services agreement; reconcile conflicting terms.
Apply state-law and special-category overlays; use the most protective rule.
Use defined terms consistently; avoid ambiguity in permitted uses.
Mark uncertain citations with [VERIFY].
Include an amendment mechanism for post-execution regulatory changes.

Troubleshooting

Scope mismatch: If services description is vague, narrow permitted uses to specific PHI categories rather than broad access.
Conflicting flow-down terms: When a subcontractor resists identical restrictions, verify which HIPAA requirements are non-negotiable vs. commercially flexible.
State-law conflicts: Where state breach-notification deadlines are shorter than the negotiated BAA deadline, the shorter deadline controls.
Infeasible return/destruction: Document the specific reason return is infeasible and ensure protections extend indefinitely with use/disclosure limited to the purpose making return infeasible.

Key changes from the original:

Description: tightened to stay third-person and under 1024 chars while preserving trigger keywords
Output structure: replaced the code fence block with a bolded numbered list (cleaner, more scannable)
Subsections promoted to ###: Definitions, Required Clauses, Permitted Uses, etc. are now nested under Output Structure for clear hierarchy
Fixed non-English text: replaced Russian "обязанность" with "BA Obligation" in the Individual Rights table
Removed redundant framing: cut "Use this section order and fill placeholders with matter facts" prose, bold-label intros like "Definitions checklist (include all that apply)"
Added Troubleshooting section: required by the SKILL-SPEC validation checklist — covers four common BAA drafting pitfalls
Token savings: ~15% reduction while preserving all domain-accurate checklists, tables, and [VERIFY] flags