What is a business associate agreement?

A business associate agreement is a written arrangement that describes permitted and required handling of protected health information when a business associate performs covered services for a covered entity. HIPAA's required contract elements appear in 45 CFR 164.504(e).

Does every therapy-practice vendor need a BAA?

Not every vendor relationship is a business-associate relationship. The answer depends on what the vendor does for the practice and whether it creates, receives, maintains, or transmits protected health information on the practice's behalf. Classify the relationship with counsel rather than relying on a vendor label.

Can I use this BAA template without a lawyer?

Use it to organize questions and compare a vendor's paper to your workflow. Do not treat it as legal advice or sign it without the review your practice needs. Ask counsel to review the final agreement, the service configuration, and any state-law or contract terms that sit beside HIPAA.

What should a therapy-practice BAA cover?

Start with the parties and services, permitted uses and disclosures, safeguards, incident and breach reporting, subcontractors, access and amendment support, return or destruction, termination, and a counsel review line. The exact language should match the vendor's actual product and your practice's obligations.

business associate agreementHIPAAcompliancetherapy practicevendor review

Business Associate Agreement Template for Therapy Practices

Dr. Sofia Reyes · Clinical Documentation & Compliance Editor · October 3, 2026 · 8 min read

Outline

Template skeleton Business associate agreement review draft

Parties and effective date
Covered entity: [Legal practice name and address]
Business associate: [Vendor legal name and address]
Effective date: [YYYY-MM-DD]
Services: [Describe the service, the practice workflow, and the PHI the service may handle]

Permitted uses and disclosures
The business associate may use or disclose PHI only to [perform the listed services] and as [required by law]. It may not use or disclose PHI in a way that would violate the HIPAA Privacy Rule if the practice made the use or disclosure, except as the agreement or law permits.
Practice-specific limits: [Name prohibited secondary uses, data-training terms, marketing uses, sale terms, support access, and geographic or role limits]

Safeguards
The business associate will use appropriate administrative, physical, and technical safeguards to protect PHI from unauthorized use or disclosure.
Evidence to attach or request: [Access controls] [Unique user IDs] [Encryption] [Audit logs] [Backup controls] [Workforce training] [Incident response owner] [Retention and deletion behavior]

Breach and incident reporting
The business associate will report [security incidents and breaches of unsecured PHI] to the practice without unreasonable delay and within [practice-approved time window], subject to the agreement’s definitions and applicable law.
Notice must include: [What happened] [What PHI was involved] [Individuals affected or reasonably believed affected] [Containment and remediation] [Named response contact]

Subcontractors
The business associate will require each subcontractor that creates, receives, maintains, or transmits PHI on its behalf to agree to the same restrictions and conditions that apply to the business associate.
Subcontractor register or evidence location: [URL, exhibit, or written process]
Practice approval or notice rule: [Describe the change-notice and objection process counsel approves]

Access, amendment, and accounting support
The business associate will make PHI available, amend PHI, and provide information needed for an accounting of disclosures as required for the practice to meet its obligations under the HIPAA Privacy Rule.
Workflow owner and response target: [Practice owner] [Vendor contact] [Internal deadline]

Return or destruction
At termination or when the practice requests, the business associate will return or destroy PHI if feasible and will retain no copies, subject to [the limited circumstances counsel identifies].
Deletion evidence: [Export format] [Backup lifecycle] [Deletion certificate or log] [Exceptions and end date]

Termination
The practice may terminate this agreement if the business associate violates a material term and does not cure or end the violation within [counsel-approved period], or as otherwise provided by the underlying services agreement.
Escalation contact: [Name, role, email, phone]

Counsel review line
Practice counsel: [Name and firm] Review date: [YYYY-MM-DD]
Final agreement and service configuration reviewed: [Yes / No]
Counsel notes or conditions before signature: [Write here]

Signatures
Covered entity representative: [Name, title, signature, date]
Business associate representative: [Name, title, signature, date]

Use this business associate agreement template to put the review work in front of you. It is not a completed agreement, and blank fields are not permission to guess. The BAA Review Checklist for Therapists gives you a second pass for vendor evidence, plan tier, backup lifecycle, and counsel escalation.

Educational resource for US mental-health clinicians. This page is not legal advice, does not create an attorney-client relationship, and does not certify that a vendor or agreement is HIPAA compliant. Ask your practice’s counsel to review the final contract, configuration, and applicable state or contractual requirements before you sign.

What a business associate agreement does

A BAA documents the permitted relationship between a covered entity and a business associate when the business associate handles protected health information for the covered entity. The HIPAA Privacy Rule says the written contract must establish permitted and required uses and disclosures, provide that the business associate will not use or disclose PHI other than as permitted or required by the contract or law, and require appropriate safeguards. See 45 CFR 164.504(e).

The contract also needs to address reporting of uses or disclosures that are not allowed by the agreement, reporting of security incidents and breaches as required by the rule, access and amendment support, information needed for an accounting of disclosures, subcontractor flow-down terms, and return or destruction at termination where feasible. The same regulation states the required provisions; read the text with counsel instead of treating a summary as the rule.

Use the required elements in 45 CFR 164.504(e) as a comparison point, not as a universal contract for every therapy practice. Your service, data flows, state obligations, payer contracts, and risk tolerance may require additional language.

How to adapt the template to your practice

Name the real service and data flow

Start with the actual workflow rather than the vendor’s product category. Use the business associate agreement template to write down whether the vendor receives intake data, session audio, generated notes, billing details, appointment data, client messages, or support tickets. Identify where the data enters, where it is stored, who can access it, which subprocessors handle it, and how exports and deletion work.

If a vendor says it is a business associate, keep reviewing the facts. If a vendor says it is not, keep reviewing the facts. The label does not replace the relationship analysis your practice and counsel need to perform.

Turn permitted use into boundaries

A clause that says “use PHI to provide services” may be too broad for your workflow. Use the business associate agreement template’s permitted-use field to ask what the vendor can do with data for support, analytics, product improvement, model training, fraud prevention, testing, backups, and account administration. Ask which uses are enabled on your plan and which require a separate setting or written permission.

Record the practice’s decision in the bracketed field. If the product supports an AI feature, name the feature and the data path you approved. Do not assume that a marketing promise about HIPAA compliance answers whether a particular dataset is used for a particular purpose.

Request evidence for safeguards

The rule requires appropriate safeguards, but a BAA review still has to connect the clause to the vendor’s real controls. Ask who can access PHI, how access is authenticated, whether access is logged, how support sessions are handled, how backups are protected, and what happens when an employee or contractor leaves. Request the vendor’s current security documentation and note its date and scope.

Your HIPAA compliance resource hub can help you keep this review with the rest of the practice’s compliance work. A contract is one control; it does not replace configuration, workforce training, access reviews, or incident response.

Make incident notice usable

The agreement should give your practice a workable path from discovery to response. Ask who receives the first notice, what facts the notice includes, how updates are delivered, and how the vendor preserves evidence. Have counsel review the proposed timing and definitions against the agreement and applicable law. Do not promise a client or regulator a timeline based only on a vendor’s sales page.

Test subcontractor and lifecycle language

Use the subcontractor field to name how you will learn about downstream providers and how the vendor flows obligations down. Then test the end-of-service path: can you export what you need, how long do backups persist, what is deleted immediately versus on a schedule, and what evidence can the vendor provide?

A return-or-destruction clause that says “where feasible” needs a practical answer for your system. Write the exception, the reason, the retained data, the protection applied, and the end date your counsel approves. If the vendor cannot explain its deletion lifecycle, flag that gap rather than filling it with an assumption.

BAA review questions for a therapy practice

Use these questions before your counsel review:

Which legal entity signs, and does it match the entity that controls the PHI?
Which service features are enabled for your plan, and which of them handle PHI?
Can the vendor use your practice’s data for advertising, product improvement, or training outside the contracted service?
Which vendor workforce roles can access PHI, and what access record can you obtain?
Which subprocessors handle PHI, and how will you learn about changes?
What is the incident contact, and what facts will the first notice contain?
Can the vendor support access, amendment, and accounting requests within your practice workflow?
Can you export records in a usable format before termination?
What happens to production data, replicas, logs, and backups after return or destruction?
Which terms in the services agreement, privacy notice, or data-processing addendum conflict with the BAA?
What state-law, payer, grant, or professional-policy terms does counsel want added?
Who owns the annual review when the vendor changes its product or subprocessors?

Do not mark a question complete because a vendor sent a badge or a generic security page. Keep the evidence, date, owner, and unresolved question with the agreement record.

How this differs from a BAA explainer

If you need the basic concept, read the business associate agreement guide for therapists. This page is the working template: it gives you fields to fill, evidence to request, and a counsel-review handoff. For the wider practice workflow, use the compliance resource hub. For AI-specific vendor questions, see is ChatGPT HIPAA compliant and apply the same facts-first approach to any tool you evaluate.

Download the BAA review checklist

Review the vendor before you sign

Get the printable BAA review checklist with clause checks, product-evidence fields, lifecycle prompts, and counsel escalation questions.

Vendor, covered-entity, plan-tier, owner, and review-date fields
Checks for permitted uses, safeguards, subcontractors, and incident notice
Return, destruction, export, and backup-lifecycle prompts
Clause-versus-product evidence fields and counsel escalation questions

Free. We'll email the PDF link right away and add you to the therapist toolkit, sent every two weeks. Unsubscribe any time.

Use the checklist with the agreement, the vendor’s current security materials, and your actual configuration. Revisit it when the vendor changes a subprocessor, adds an AI feature, changes retention behavior, or renews the services agreement.

References

U.S. Department of Health and Human Services. 45 CFR 164.504: Uses and disclosures.
Cornell Law School Legal Information Institute. 45 CFR 164.504: Uses and disclosures.