HHS Model Provisions — 45 CFR § 164.504(e)

Free HIPAA Business Associate Agreement Generator

Create a legally structured, HIPAA-compliant BAA in minutes — without attorney drafting fees. Built on the official HHS model Business Associate Agreement provisions and aligned with 45 CFR § 164.504(e).

Save $500–$2,500 vs. hiring an attorney, and skip 6–10 hours of drafting time. Answer a few guided questions, preview your BAA in real time, and download a polished agreement as PDF or editable Word (.docx).

Quick answer

BAA Generator creates a HIPAA-compliant Business Associate Agreement in under 5 minutes. Every clause maps to 45 CFR § 164.504(e) and the official HHS model BAA. The free preview shows the full legal structure with sample party data. The $49 Single BAA generates the same document with your actual party information — saving $500–$2,500 vs. attorney rates.

$49 one-time · PDF + Word · 5 minutes · Save $500–$2,500 vs. attorney

Vendor Plan · $19/mo Unlimited BAAs for multiple vendors.
Free to start No account required Download in minutes
Drafted to 45 CFR § 164.504(e)
30-day money-back guarantee
SSL encrypted · Stripe checkout

How It Works

Generate a professionally structured Business Associate Agreement in three guided steps.

1

Provide Key Details

Enter information about the Covered Entity, Business Associate, services provided, and PHI access. Guided questions ensure all legally required provisions are addressed.

2

Review Your Agreement

Watch your personalized BAA build in real time as you answer each question. Review every provision before downloading.

3

Secure & Download

Download a free sample-data preview, or pay $49 once to generate a clean, signable PDF and editable Word document with your actual party information.

Built for Every Healthcare Organization

Whether you're a solo therapist, a telehealth startup, or a SaaS company selling into healthcare — you need HIPAA BAAs.

Built on Official HHS Model Provisions

Our BAA framework is structured around the official HHS model Business Associate Agreement provisions and designed to align with HIPAA and HITECH requirements.

  • Core HIPAA Privacy & Security Rule provisions addressed
  • HITECH Act breach and subcontractor requirements included
  • Defined breach notification timeframes
  • Limitation of liability and termination provisions

What's Included

  • Permitted Use & Disclosure Framework
  • Administrative, Physical & Technical Safeguards
  • Structured Breach Notification Requirements
  • Subcontractor & Downstream Obligations
  • Term, Termination & Survival Clauses
  • Limitation of Liability Provisions

How Much Does a HIPAA BAA Cost?

Hiring a healthcare attorney to draft a Business Associate Agreement typically costs $500–$2,500. Subscription legal sites charge monthly fees. BAA Generator is a one-time $49 for your actual party data — or free as a sample-data preview.

Healthcare Attorney
$500–$2,500
per agreement
  • Custom-drafted for your situation
  • 1–3 weeks turnaround
  • Separate fee for every new BAA
  • Expensive for small practices and startups
Subscription Legal Sites
$40–$80
per month, recurring
  • Generic document library
  • Not HIPAA-specialized
  • Recurring subscription required
  • Cancel and you lose access
BAA Generator
Free – $49
one-time · or $19/mo unlimited
  • Built on official HHS model provisions
  • Live preview, download in minutes
  • PDF + editable Word (.docx) on paid plan
  • Generate unlimited BAAs at the same price

Attorney pricing based on typical healthcare-law hourly rates ($250–$500/hr) and 2–5 billable hours per BAA. Subscription pricing reflects published rates from LegalZoom and Rocket Lawyer as of 2026.

Popular vendor BAA guides

Does your vendor sign a HIPAA BAA? Eligibility, plan tiers, and setup steps for the most-asked vendors.

Frequently Asked Questions

Everything you need to know about HIPAA Business Associate Agreements and how BAA Generator works.

What is a HIPAA Business Associate Agreement?
A Business Associate Agreement (BAA) is a legally required contract under HIPAA between a covered entity — a healthcare provider, health plan, or clearinghouse — and a business associate (any vendor or partner that handles protected health information on the covered entity's behalf). The BAA outlines each party's responsibilities for safeguarding PHI and establishes liability in the event of a breach.
Who needs a HIPAA BAA?
Any HIPAA covered entity — hospitals, physician practices, dental offices, therapists, health plans, and healthcare clearinghouses — must sign a BAA with any vendor or service provider that creates, receives, maintains, or transmits protected health information (PHI) on their behalf. Common examples include EHR vendors, billing companies, cloud storage providers (when PHI is stored), and IT support firms with system access.
How much does a BAA cost from an attorney?
A custom BAA drafted by a healthcare attorney typically costs between $500 and $2,500 depending on firm, jurisdiction, and complexity. Template-based online legal services (LegalZoom, Rocket Lawyer) charge $40–$80 per month for access to generic contract libraries. BAA Generator produces a comparable HIPAA-structured document for free as a sample-data preview, or $49 one-time for a clean PDF plus editable Word file with your actual party information.
Is a BAA generated online legally binding?
Yes. A BAA is a contract like any other — it becomes legally binding once both parties sign it. HIPAA does not require that a BAA be drafted by an attorney. What HIPAA requires is that the document contain the specific provisions listed in 45 CFR § 164.504(e). BAA Generator's output is built directly from the HHS model BAA and includes every required provision. You should still have an attorney review any contract before signing, especially if your situation is unusual.
What happens if you don't have a BAA in place?
Operating without a required BAA is a direct HIPAA violation. The HHS Office for Civil Rights (OCR) can impose civil monetary penalties ranging from $137 to $68,928 per violation (2024 adjusted amounts), with annual caps approaching $2 million for repeated violations. OCR actively investigates missing BAAs during compliance audits and breach investigations. Several multi-million-dollar OCR settlements trace back to a missing BAA.
Is a BAA the same as an NDA?
No. A Non-Disclosure Agreement (NDA) is a general confidentiality contract used in any industry. A Business Associate Agreement is a HIPAA-specific contract with legally mandated terms that govern how protected health information may be used, disclosed, and safeguarded. An NDA alone does not satisfy HIPAA's BAA requirement. See our full BAA vs. NDA comparison.
What must a HIPAA BAA include?
Under 45 CFR § 164.504(e), a HIPAA-compliant BAA must include: (1) a description of permitted uses and disclosures of PHI; (2) a prohibition on using or disclosing PHI beyond what is permitted; (3) safeguard obligations; (4) breach and security incident reporting; (5) requirements that subcontractors also sign BAAs; (6) provisions for returning or destroying PHI upon termination; and (7) authorization for the covered entity to terminate if the BAA is materially breached. See our full BAA requirements guide.
What's the difference between the free preview and the $49 Single BAA?
The free preview uses generic sample party names so you can see the exact legal structure — every clause, every provision — before committing. It is not executable. The $49 Single BAA generates the same document with your actual party information: clean signable PDF and editable Word (.docx). For SaaS companies, billing firms, and IT vendors who generate many BAAs, the Vendor Plan is $19/month with unlimited generation.
Do I need a separate BAA with every vendor?
Yes. HIPAA requires a written BAA for each business associate relationship. If you use three different vendors that access PHI — for example, an EHR provider, a cloud backup service, and an IT support firm — you need a separate BAA with each one. Some vendors provide their own BAA; others expect you to provide the agreement. BAA Generator is designed to let you create any number of BAAs for the same price.
Can a BAA be signed electronically?
Yes. HIPAA does not mandate a specific signature method. Electronic signatures executed through a reputable e-signature platform (DocuSign, Adobe Sign, Dropbox Sign, etc.) are generally valid and enforceable under both federal ESIGN and state UETA laws. Download your BAA as a PDF or Word file and route it through your e-signature tool of choice.

Generate Your HIPAA Business Associate Agreement

Skip the $500–$2,500 attorney bill. Create a HIPAA-compliant BAA in under 10 minutes — free to start, no account required.

Free preview  ·  Clean copy + Word .docx for $49  ·  Vendor Plan $19/mo

Conversational intake
Prefer a form? →