# HIPAA Business Associate Agreement Checklist — Template

## BA Identification

| Field | Value |
|-------|-------|
| Vendor Name | |
| Services Provided | |
| PHI Access: Creates [ ] Receives [ ] Maintains [ ] Transmits [ ] | |
| BA Determination | [ ] Business Associate [ ] Not a BA |
| Risk Level | [ ] Critical [ ] High [ ] Medium [ ] Low |
| BAA Effective Date | |
| BAA Expiration/Renewal Date | |
| MSA Reference Number | |

---

## Required BAA Provisions (§164.504(e)(2))

| # | Provision | Present | Notes |
|---|-----------|---------|-------|
| 1 | Permitted and required uses/disclosures specified | [ ] | |
| 2 | Prohibition on unauthorized use/disclosure | [ ] | |
| 3 | Appropriate safeguards and Security Rule compliance | [ ] | |
| 4 | Breach reporting to covered entity | [ ] | |
| 5 | Subcontractor flow-down requirements | [ ] | |
| 6 | Support for individual access rights (§164.524) | [ ] | |
| 7 | Support for amendment rights (§164.526) | [ ] | |
| 8 | Information for accounting of disclosures (§164.528) | [ ] | |
| 9 | HHS access to books and records | [ ] | |
| 10 | Return or destruction of PHI at termination | [ ] | |

## Additional Recommended Provisions

| Provision | Present | Notes |
|-----------|---------|-------|
| Breach notification timeline (specify days) | [ ] | ____ business days |
| Indemnification for BA-caused breaches | [ ] | |
| Right to audit BA security practices | [ ] | |
| Subcontractor registry and notification requirement | [ ] | |
| Insurance requirements (cyber liability) | [ ] | |
| Data location restrictions (US-only) | [ ] | |
| Incident response cooperation | [ ] | |
| Annual security attestation requirement | [ ] | |

---

## Annual Compliance Review

| Review Element | Date | Status | Finding |
|---------------|------|--------|---------|
| BAA currency verified | | | |
| SOC 2 Type II reviewed | | | |
| Security questionnaire received | | | |
| Subcontractor registry obtained | | | |
| Incident history reviewed | | | |
| PHI access scope verified (minimum necessary) | | | |

---

## Approval

| Role | Name | Date |
|------|------|------|
| Privacy Officer | | |
| Legal Counsel | | |
| Procurement | | |