Checklist · Health & Medical Law
HIPAA business associate agreement checklist
Checklist for the written terms in a HIPAA business associate contract under 45 CFR 164.504(e) and 164.502(e). It is a review list. It is not the contract.
- Kind
- Checklist. Steps or checks to work through and tick off.
- Where it applies
- United States
- AI use
- Yellow You and the tool draft together, with you directing. You check every statement you rely on.
- Law stated as at
- 22 October 2026
- Status
- Maintained. Checked on 22 October 2026 against the 2 authorities it cites, for United States.
- Version
- 1
- Source
- Written for this library
When to use it
Use when a covered entity or business associate is reviewing a written contract before protected health information is shared. Do not use it as the signed contract, and do not use it to decide who is a business associate.
Used for these tasks
- Review a hospital or health-services agreement
- Review an AI clinical-tool vendor contract for privacy and TGA issues
- Map health-privacy duties across the records systems
Each task page says how far AI may help with the task and what the lawyer must review.
How AI may be used
Yellow: the lawyer checks every term against the contract and the current regulation before anyone signs.
AI may
- List the contract terms described in 45 CFR 164.504(e)(2) as questions against the draft.
- Record the names of the parties and the function as blanks for the lawyer to complete.
- Note that 164.504(e)(5) applies the same contract requirements between a business associate and a subcontractor.
AI must not
- Do not complete or sign a business associate agreement.
- Do not define business associate, covered entity, or protected health information. Section 160.103 was not opened.
- Do not restate 45 CFR 164.410, 164.524, 164.526, 164.528, or 164.314. Those sections were not opened.
- Do not decide that a person is a business associate, or that a breach must be notified.
The lawyer checks
- Confirm the parties and the function from the engagement, not from this list.
- Read 45 CFR 164.410 before describing what a breach report must contain.
- Read 164.524, 164.526, and 164.528 before writing the access, amendment, and accounting mechanics.
- Read 164.314 before relying on a security-rule term that this checklist only cites.
Method: how the Green, Yellow and Red levels are decided. This is guidance for planning, not legal advice.
Read the full text
The full text is available after you log in. It is free. When you log in you can:
- read the whole precedent, with its drafting notes beside it;
- copy it, or download it as a Word file or Markdown;
- add it to your firm’s knowledge base, so colleagues can find it;
- let the AI tools you connect read it from that knowledge base.
The summary, the law it rests on and the AI-use guidance above stay public. Privacy.
More in Health & Medical Law
- Practitioner's response to an Ahpra notification or proposed immediate action
- Eligible data breach assessment record
- Patient authority to release health records to the patient's lawyer
- Letter of instruction to an independent medical expert on breach of duty and causation (medical negligence)
- Patient information and consent form for AI scribes and AI-assisted care
- Therapeutic goods advertisement review checklist
- Notice of privacy practices review
- Request for access to health records (patient or authorised representative), with state and NZ variants
- Regulated health service advertising review
- Responding to a subpoena for medical records: health service checklist and production schedule (NSW courts)
- HIPAA use and disclosure limits checklist
- Advance care directive (Victoria): instructions note, completion and witnessing checklist, and decision-maker map
- Memo: is this AI tool regulated software as a medical device?
- Human research ethics submission readiness checklist
- Business associate subcontractor assurance checklist
- Open disclosure follow-up letter after an adverse event (health service)
- Memo assessing a mandatory notification obligation under the National Law
All precedents for Health & Medical Law · Tasks and AI use in this area