Tools › Industries › Health Care and Social Assistance › Business Associate Agreement

Business Associate Agreement for Nursing and Residential Care Facilities

Nursing and Residential Care Facilities · NAICS 623 · Business Associate Agreement

A Business Associate Agreement (BAA) is a critical contract for nursing and residential care facilities that share protected health information (PHI) with vendors, contractors, and service providers. Under HIPAA, covered entities must obtain satisfactory assurances that business associates will safeguard PHI. This BAA template is tailored to the long-term care industry, addressing common scenarios such as therapy staffing, pharmacy services, medical record storage, and IT support. It includes provisions for permitted uses, safeguards, breach notification, and resident rights, helping you meet HIPAA obligations while maintaining operational efficiency. Use this tool to generate a solid foundation for your vendor agreements.

When you need this document

When hiring a third-party therapy provider (PT, OT, SLP) to treat residents
When contracting with a pharmacy or pharmaceutical supplier that handles resident medication records
When using an external billing service or revenue cycle management company
When engaging an IT vendor that hosts or maintains electronic health records (EHR) or other PHI systems
When sharing resident information with a consultant for quality improvement or compliance auditing

What the generated draft includes

Definitions of PHI and business associate consistent with HIPAA
Permitted uses and disclosures of PHI, including for treatment, payment, and health care operations
Obligations to safeguard PHI with administrative, physical, and technical safeguards
Breach notification procedures and timelines (including to HHS and the media when required)
Access, amendment, and accounting of disclosures rights for residents
Termination provisions for breach or non-compliance, including return or destruction of PHI

Frequently asked questions

Do I need a BAA with every vendor that touches resident PHI?

Yes, under HIPAA, you need a BAA with any vendor that creates, receives, maintains, or transmits PHI on your behalf. This includes therapy providers, billing services, IT support, and even waste disposal companies that handle medical records.

What happens if my business associate has a data breach?

Your BAA must require the business associate to notify you promptly of any breach of unsecured PHI. You then have obligations to notify affected residents, HHS, and potentially the media, depending on the scope of the breach.

Can I use a generic BAA for all my vendors?

While a generic BAA may be a starting point, it's best to tailor each BAA to the specific services and PHI access. This template helps you customize for the long-term care context, but you should have legal counsel review before execution.

Self-help document generator: you get a structured draft based on the facts you provide. It is not legal, tax, or financial advice; verify jurisdiction-specific rules before sending.