How to review a HIPAA business associate agreement

Under HIPAA, a covered entity (such as a health plan or most health care providers) that shares protected health information (PHI) with a vendor performing services for it needs a business associate agreement (BAA). The HIPAA rules list terms every BAA must contain, and most of the negotiation happens around extras such as notice deadlines, indemnities and liability. This guide covers what to check and how to review a BAA in Word with LexDraft.

Last checked: 18 October 2026. The law changes; check the current position before relying on this page.

Required terms under 45 CFR 164.504(e)

A BAA must, among other things:

• Set out the permitted and required uses and disclosures of PHI by the business associate.
• Bar uses or disclosures other than those allowed by the contract or required by law.
• Require appropriate safeguards, including compliance with the Security Rule (Subpart C of Part 164) for electronic PHI.
• Require the business associate to report any use or disclosure not provided for by the contract, including breaches of unsecured PHI as required by 45 CFR 164.410.
• Require subcontractors that create, receive, maintain or transmit PHI for the business associate to agree to the same restrictions (see also 45 CFR 164.502(e)(1)(ii)).
• Make PHI available for individuals' rights of access, amendment and an accounting of disclosures.
• Where the business associate carries out a covered entity's Privacy Rule obligation, require compliance with the rules that apply to that obligation.
• Make internal practices, books and records available to the Secretary of HHS.
• Require return or destruction of PHI at termination where feasible, with protections extended to any PHI that cannot be returned.
• Allow the covered entity to terminate if the business associate violates a material term.

HHS publishes sample BAA provisions that many organisations start from. Check the current text of the regulations before relying on any template: HHS proposed changes to the Security Rule in January 2025, so confirm whether a final rule has been issued.

Negotiated terms to check

• Breach notification timing. The regulation requires a business associate to notify the covered entity without unreasonable delay and no later than 60 calendar days after discovery of a breach of unsecured PHI. Covered entities often ask for a much shorter contractual deadline. Check that "discovery" and "security incident" are defined, and how unsuccessful attempts such as pings are handled.
• Costs of a breach. Who pays for notifications, credit monitoring, call centers and regulator responses?
• Indemnities and liability caps. Whether BAA breaches sit inside or outside the main agreement's cap. See our limitation of liability guide and indemnification guide.
• De-identification and data aggregation. Whether the business associate may de-identify PHI or use it for data aggregation services, and for what purposes.
• Offshore restrictions. Limits on storing or accessing PHI outside the United States.
• Audit and security assessments. Questionnaires, audit rights and evidence of safeguards.
• Conflicts. An order of precedence so the BAA controls over the main agreement on PHI issues.
• Other laws. Substance use disorder treatment records can also be covered by 42 CFR Part 2, and state privacy and breach laws may add duties.

A BAA review workflow in Word

LexDraft is a Word add-in from Microsoft AppSource. It opens as a side panel in Word 365 (Windows and Mac), Word 2021 and Word on the web, so the agreement never leaves the tool you already draft in.

1. Open the agreement in Word and open LexDraft in the side panel.
2. Pick the governing law. Select the state named in the governing law clause so LexDraft looks for state-specific red flags.
3. Run the review. LexDraft has four built-in playbooks (NDA, SaaS MSA, DPA and services agreement) and no dedicated BAA playbook, so this runs as a general review against the governing law you chose. Use the checklist on this page to direct your own read. The DPA playbook is built for data processing addenda and is not a substitute for checking the HIPAA required terms.
4. Triage by severity. Findings are graded Critical, High, Medium or Low, and LexDraft flags standard terms that are missing.
5. Run the quick checks. The defined-term and cross-reference checks are rule-based and run without AI.
6. Accept or reject each redline. Accepted changes land as native Word tracked changes.
7. Verify and sign off. You check every output before it goes to the client or the other side.

Review the agreement text, not patient records: the document you open in LexDraft should not contain PHI.

What LexDraft does not do

LexDraft does not give legal advice or decide whether a vendor is a business associate. Nothing changes in your document until you accept a redline.

This guide is general information, not legal advice. LexDraft does not give legal advice; qualified counsel must review every draft. Spotted something out of date? Email support@lexdraft.ai and we will fix it.