Business Associates Agreement Form

Use a Business Associates Agreement Template template to make your document workflow more streamlined.

What this agreement form does

Business Associates Agreement Form is a written contract that documents how a business associate may handle protected health information for a HIPAA covered entity. It identifies the parties, services, permitted and required uses, safeguards, breach-reporting duties, subcontractor responsibilities, and termination obligations. The covered entity and business associate review those terms before signing. Upload the completed agreement to signNow, place or confirm signature fields, route it to each authorized signer, and retain the signed record with its completion certificate and audit trail. HIPAA requires certain documentation to be retained for six years under 45 CFR 164.530(j).

Healthcare organizations

Healthcare providers use Business Associates Agreement Form with vendors that create, receive, maintain, or transmit protected health information. The agreement documents permitted uses, safeguards, reporting duties, subcontractor obligations, and return or destruction requirements under HIPAA.

Business associates

Technology, billing, legal, and administrative service providers use the form when their services involve protected health information for a covered entity. signNow supports reusable templates, signer routing, audit trails, and mobile completion for these agreements.

Defined scope

Record the covered entity, business associate, services, and permitted PHI activities in one controlled agreement, reducing ambiguity about the relationship’s scope.

Guided completion

Place signatures, initials, dates, and required text fields directly on the uploaded agreement before routing it to the appropriate parties.

Signer routing

Route the agreement by email or signing link while preserving the order selected by the sender for multi-party review.

Audit trail

Capture timestamps, signer actions, authentication events, and completion evidence alongside the signed agreement for later review.

Reusable templates

Use reusable templates for recurring vendor agreements while allowing authorized staff to send the correct version for each relationship.

Controlled records

Store the signed agreement with its certificate of completion and exportable audit evidence under the organization’s HIPAA records policy.

How the signing workflow works

Follow the agreement from controlled upload through signer review, electronic execution, and audit-ready retention in signNow.

Upload: Upload the completed agreement to signNow.
Review: Auto-detect fields, then verify every required entry.
Route: Send to authorized parties in defined order.
Complete: Collect signatures and retain audit evidence.

be ready to get more

Get legally-binding signatures now!

Start free trial

Request a call

Best ROI. Our customers achieve an average 7x ROI within the first six months.
Scales with your use cases. From SMBs to mid-market, airSlate SignNow delivers results for businesses of all sizes.
Intuitive UI and API. Sign and send documents from your apps in minutes.

How to complete the agreement form

Prepare the parties, covered services, PHI safeguards, and signature requirements before sending this agreement through signNow.

Upload agreement:
Upload the Business Associates Agreement Form to signNow.
Check fields:
Review auto-detected fields and add missing signature, date, and text fields.
Add signers:
Enter each party’s email address and configure signing order.
Send agreement:
Send the agreement and monitor completion status.
Store evidence:
Download the signed agreement and certificate of completion.

Setting	Recommended configuration
Authentication method	Email verification with SMS OTP
Signature type	Legally binding electronic signature
Audit trail	Enabled with completion certificate
Document retention	Six years under 45 CFR 164.530(j)
Encryption	TLS 1.2/1.3 and AES-256 encryption

Signer authentication:

Email link, SMS code, or configured identity checks attribute signing activity.

Timestamp capture:

The system records when each agreement action occurs.

Document hashing:

The signed PDF records document integrity through cryptographic hashing.

Sealing record:

Completed documents receive tamper-evident completion records and certificates.

Action history:

The audit trail records views, signatures, invitations, and authentication events.

Audit retrieval:

Authorized users can retrieve and export completion evidence for retention.

Integrations for agreement administration

Connect agreement workflows with signNow integrations to route vendor records, store signed files, and coordinate approvals across healthcare operations.

Best practices for agreement completion

Accurate party details, precise HIPAA terms, complete signing evidence, and controlled retention make this agreement easier to administer and review.

Confirm parties and services

Confirm the covered entity and business associate legal names before uploading. Match the agreement’s service description to the actual functions involving PHI, and identify subcontractors whose access requires documented obligations under the HIPAA Rules.

Review HIPAA provisions

Review the agreement’s permitted uses, safeguards, access controls, incident reporting, and termination language before sending. Do not treat a signature as proof that the underlying terms satisfy every organization-specific HIPAA requirement.

Preserve completion evidence

Use signNow’s audit trail and certificate of completion with the signed PDF. Export them together after completion, restrict access to authorized personnel, and apply the organization’s approved records-management policy.

Review retention obligations

Reassess the agreement when services, PHI access, subcontractors, or regulatory requirements change. For HIPAA documentation, use six years as the federal retention period under 45 CFR 164.530(j), subject to applicable longer requirements.

Policy setup:

Define covered services, permitted PHI uses, safeguards, breach duties, and termination procedures.

First send:

Upload the agreement, verify fields, and send it to the provider or covered entity.

Team onboarding:

Give authorized staff shared templates and role-based access for delegated sending.

Signed record:

Export the completed agreement and certificate after all required parties sign.

HIPAA retention:

Retain required HIPAA documentation for six years under 45 CFR 164.530(j).

Trial access:

signNow provides a seven-day free trial without requiring a credit card.

Annual plan:

Business costs $8/user/month when billed annually; month-to-month pricing is higher.

Renewal review:

Review authorization, safeguards, and service scope when the relationship or law changes.

Retention periods for related records

Apply the retention period to the record category, not merely the signature date; state requirements or organizational policies may require longer preservation.

Six years — HIPAA records

HIPAA documentation must be retained for six years from creation or last effective date under 45 CFR 164.530(j).

Three years — tax records

Federal tax records connected to vendor administration generally use three years from filing under IRC §6501(a).

Later of two dates — I-9

Employment records are retained three years after hire or one year after termination, whichever is later, under 8 CFR §274a.2(b)(2)(i)(A).

Six years — broker records

Broker-dealer books and records use six years under 17 CFR §240.17a-4 when applicable to the organization.

Thirty years — exposure records

OSHA exposure records use 30 years under 29 CFR §1910.1020 when the agreement supports that regulated record set.

Business Associates Agreement Form troubleshooting

Resolve signing, field, retention, and HIPAA workflow questions before sending a Business Associates Agreement Form through signNow.

In signNow, upload the agreement and use the document editor to place signature, date, and text fields. Business Premium adds bulk send, while Business supports templates and audit trails. Confirm the final agreement includes required HIPAA provisions and obtain a separate BAA with signNow when PHI is involved.

The signNow Business plan costs $8/user/month with annual billing and includes legally binding eSignatures, templates, audit trails, and mobile apps. HIPAA compliance requires a BAA with signNow; plan selection alone does not create that legal arrangement.

A signer can open the agreement from the email invitation or a shareable signing link without creating an account in many workflows. If stronger attribution is needed, configure available authentication options and preserve the audit trail with the completed agreement.

Use signNow’s document editor to review auto-detected fields after upload, then add missing signature, initials, date, and text fields manually. Check each party’s legal name, services, PHI provisions, breach duties, and termination language before sending.

A completed agreement should remain associated with its certificate of completion and audit trail. Export those records from signNow and store them under the organization’s retention policy; HIPAA documentation requirements generally use six years under 45 CFR 164.530(j).

Electronic signing can satisfy ESIGN and applicable UETA requirements when intent, consent, attribution, and record retention are established. Those statutes do not replace HIPAA’s contracting requirements, so the agreement must still contain appropriate permitted-use, safeguard, and breach terms.

28M+Documents signed

13+Years in business

4.6/5Average G2 rating

BE READY TO GET MORE

Get this form now!

If you believe that this page should be taken down, please follow our DMCA take-down process.