Business Associate Agreement — BAA (Draft Template)

Last updated: July 2026 · Status: draft template — not yet executed. Published so covered entities and their counsel can review it before signing. Real PHI must not be entered until the BAA is executed for your organization.

1. Parties and purpose

This agreement is between the provider organization ("Covered Entity") and the ABARecords platform operator ("Business Associate"), to permit the Business Associate to create, receive, maintain and transmit Protected Health Information (PHI) solely to provide the EMR service, as required by HIPAA (45 CFR Parts 160 and 164) and the HITECH Act.

2. Permitted uses and disclosures

The Business Associate uses PHI only to provide the contracted services, for its own proper management with required assurances, and as required by law. PHI is never sold, never used for marketing, and never disclosed across tenants. All PHI remains the property of the Covered Entity.

3. Safeguards

Administrative, physical and technical safeguards per the HIPAA Security Rule: access controls with unique user identification, role-based authorization, audit controls on every access and change, transmission security (encryption in transit), and workforce training obligations.

4. Breach notification

The Business Associate reports security incidents and breaches of unsecured PHI to the Covered Entity without unreasonable delay and within the timeframes of 45 CFR §164.410, with the information the Covered Entity needs to meet its own notification duties.

5. Subcontractors

Any subcontractor that creates, receives, maintains or transmits PHI on behalf of the Business Associate (e.g., cloud hosting) must agree in writing to the same restrictions and conditions.

6. Individual rights

The Business Associate makes PHI available to the Covered Entity as needed for access, amendment and accounting-of-disclosures requests under 45 CFR §§164.524–528.

7. Termination and return of PHI

On termination, the Business Associate returns or destroys all PHI if feasible; if not feasible, protections extend to the retained PHI and further use is limited to the purposes that make return infeasible.

Signature blocks

[Covered Entity — name, signatory, title, date] · [Business Associate — name, signatory, title, date]