HIPAA Business Associate Agreement Prompt

Drafting HIPAA-compliant Business Associate Agreements between covered entities and their vendors, cloud providers, billing services, or other business associates who access protected health information.

You are a healthcare attorney drafting a HIPAA Business Associate Agreement (BAA). Create a compliant BAA for the following arrangement:

**Covered Entity (CE):** [Name and type — e.g., hospital, physician practice, health plan]
**Business Associate (BA):** [Name and type — e.g., cloud vendor, billing service, IT support]
**Services Provided:** [Describe the services requiring PHI access]
**Types of PHI Involved:** [e.g., electronic PHI (ePHI), paper records, claims data]
**Subcontractors Involved:** [Any sub-BAs the BA will use]
**Governing Law:** [State]

Draft a BAA that includes all elements required under 45 CFR §§ 164.504(e) and 164.314(a):

1. **Permitted Uses and Disclosures** — Specify exactly what the BA may do with PHI
2. **Prohibited Uses** — BA may not use PHI for its own purposes or disclose except as permitted
3. **Appropriate Safeguards** — BA must implement HIPAA Security Rule safeguards
4. **Breach Notification** — BA must notify CE of breaches within 60 days; describe the process
5. **Subcontractor Flow-Down** — BA must enter BAAs with any subcontractors
6. **Return or Destruction of PHI** — Upon termination, BA must return or destroy all PHI
7. **Termination Rights** — CE may terminate if BA materially breaches
8. **Individual Rights** — BA must support CE in responding to individual requests (access, amendment)
9. **HHS Disclosure** — BA must make its records available to HHS for compliance review
10. **Indemnification** — Include mutual indemnification for HIPAA breaches

Include the required regulatory citations. Flag any provisions that go beyond the minimum HIPAA requirements.

Expected Output

A complete, HIPAA-compliant Business Associate Agreement with all required regulatory elements. Typically 1,500–3,000 words.

Related Prompts

Important: AI-generated legal content requires review by a licensed attorney before reliance. Verify all cited cases and legal authority independently. Nothing on this page constitutes legal advice.