---
title: "HIPAA business associate agreement checklist"
url: "https://ailawframework.com/precedents/health-and-medical-law/us-baa-checklist"
type: "precedent"
site: "AI Law Framework"
id: "a32-us-baa-checklist"
area_id: "A32"
kind: "checklist"
ai_level: "yellow"
version: 1
task_ids: ["A32-T1-R9", "A32-B7-2", "A32-T1-R8"]
law_stated_as_at: "2026-10-22"
---

# HIPAA business associate agreement checklist

> Checklist for the written terms in a HIPAA business associate contract under 45 CFR 164.504(e) and 164.502(e). It is a review list. It is not the contract.

Canonical page: https://ailawframework.com/precedents/health-and-medical-law/us-baa-checklist  
Law stated as at: 2026-10-22

Site index for agents: https://ailawframework.com/llms.txt

## Key facts

- Kind: Checklist. Steps or checks to work through and tick off.
- Practice area: [Health & Medical Law](https://ailawframework.com/precedents/health-and-medical-law.md)
- Jurisdictions: United States
- AI level: Yellow. You and the tool draft together, with you directing. You check every statement you rely on.
- Law stated as at: 2026-10-22
- Status: Maintained. Checked on 2026-10-22 against the 2 authorities it cites, for United States.

## When to use it

Use when a covered entity or business associate is reviewing a written contract before protected health information is shared. Do not use it as the signed contract, and do not use it to decide who is a business associate.

## Used for these tasks

- [Review a hospital or health-services agreement](https://ailawframework.com/practice/health-and-medical-law/review-a-hospital-or-health-services-agreement.md)
- [Review an AI clinical-tool vendor contract for privacy and TGA issues](https://ailawframework.com/practice/health-and-medical-law/review-an-ai-clinical-tool-vendor-contract-for-privacy-and-tga-issues.md)
- [Map health-privacy duties across the records systems](https://ailawframework.com/practice/health-and-medical-law/map-health-privacy-duties-across-the-records-systems.md)

## How AI may be used

Yellow: the lawyer checks every term against the contract and the current regulation before anyone signs.

**AI may:**

- List the contract terms described in 45 CFR 164.504(e)(2) as questions against the draft.
- Record the names of the parties and the function as blanks for the lawyer to complete.
- Note that 164.504(e)(5) applies the same contract requirements between a business associate and a subcontractor.

**AI must not:**

- Do not complete or sign a business associate agreement.
- Do not define business associate, covered entity, or protected health information. Section 160.103 was not opened.
- Do not restate 45 CFR 164.410, 164.524, 164.526, 164.528, or 164.314. Those sections were not opened.
- Do not decide that a person is a business associate, or that a breach must be notified.

**The lawyer checks:**

- Confirm the parties and the function from the engagement, not from this list.
- Read 45 CFR 164.410 before describing what a breach report must contain.
- Read 164.524, 164.526, and 164.528 before writing the access, amendment, and accounting mechanics.
- Read 164.314 before relying on a security-rule term that this checklist only cites.

## Authorities

- [45 CFR § 164.504](https://www.law.cornell.edu/cfr/text/45/164.504)
- [45 CFR § 164.502](https://www.law.cornell.edu/cfr/text/45/164.502)

## Full text and drafting notes

The full text and the drafting notes are not part of this public page. Signed-in firm accounts can read them at https://ailawframework.com/precedents/health-and-medical-law/us-baa-checklist and through the signed-in MCP connector https://ailawframework.com/mcp/firm.

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*