Recorded template baseline: September 18, 2024. Historical bundle release: July 9, 2026. Actual agreement and notice dates depend on execution or adoption. This resource does not establish operational compliance.
HIPAA Business Associate Agreement Template
Customization required. This template is provided for policy operations and counsel review. Replace every
NEXQ-reviewed value, verify every factual statement, and confirm applicability before publication. The template is not legal advice and does not create an attorney-client relationship.
Recorded template baseline: September 18, 2024
Last updated: September 30, 2026
Owner: NEXQ privacy, security, and legal
operations
Applies to: NEXQ websites, web applications, protected
workspace surfaces, mobile app surfaces, APIs, secure healthcare and
healthtech workflow demonstrations, security and post-quantum readiness
planning, diagnostics-workflow support concepts, oncology workflow
research, cardiovascular longevity research, research collaboration,
support, and related services
This BAA template is for situations where NEXQ creates, receives, maintains, or transmits PHI for a HIPAA covered entity or another business associate. Publication is not execution of an agreement. The parties must identify themselves, specify the services and authorized data uses, settle response and reporting procedures, and execute the applicable agreement before relying on it. The historical template date does not establish a contract’s effective date.
1. Parties
Covered Entity / Customer: Applicable covered entity or customer
identified in the signed agreement
Business Associate: NEXQ
Effective date: As stated in the executed agreement; the template
baseline is September 18, 2024
2. Permitted uses and disclosures
Business Associate may use or disclose PHI only for the services and purposes expressly specified in the executed agreement, or as required by law. Written customer instructions do not authorize a use or disclosure that HIPAA prohibits. Any permission for management/administration, legal responsibilities, or de-identification must be expressly included and meet applicable HIPAA conditions. Management/administration disclosures must be required by law or supported by the required confidentiality and incident-reporting assurances. De-identification must meet 45 CFR 164.514 and the agreement’s restrictions on subsequent use. Except for uses expressly permitted under 45 CFR 164.504(e), the agreement must not authorize conduct that would violate the Privacy Rule if performed by Covered Entity.
3. Safeguards
Business Associate will use appropriate administrative, physical, and technical safeguards to prevent unauthorized uses or disclosures of PHI and comply with the applicable HIPAA Security Rule requirements in 45 CFR Part 164, Subpart C for ePHI.
4. Reporting
Business Associate will report to Covered Entity any use or disclosure not provided for by this BAA, security incident, or breach of unsecured PHI as required by HIPAA and the agreement.
5. Subcontractors
Business Associate will ensure subcontractors that create, receive, maintain, or transmit PHI on its behalf agree in writing to the same applicable restrictions, conditions, and requirements, including Security Rule safeguards for ePHI.
6. Access, amendment, and accounting
Business Associate will make designated-record-set PHI available for access under 45 CFR 164.524; make and incorporate amendments as directed or agreed under 45 CFR 164.526; and maintain and provide disclosure information required by 45 CFR 164.528. The executed agreement must specify routing and response procedures that allow Covered Entity to meet applicable deadlines. For any Privacy Rule duty delegated by Covered Entity, Business Associate will comply with the Privacy Rule requirements applicable to that duty.
7. Books and records
Business Associate will make internal practices, books, and records relating to PHI available to the Secretary of HHS as required by HIPAA.
8. Return or destruction
Upon termination, Business Associate will return or destroy all PHI received from, or created, maintained, or received on behalf of, Covered Entity, including subcontractor-held PHI, if feasible, and retain no copies. Where return or destruction is infeasible, protections continue and further uses/disclosures are limited to the purposes that make return or destruction infeasible.
9. Termination
Covered Entity may terminate if Business Associate violates a material term of this agreement. Any agreed cure process must preserve this termination right and applicable HIPAA duties.
10. Minimum necessary
Business Associate will request, use, and disclose only the minimum necessary PHI for the permitted purpose, except as otherwise permitted by HIPAA.
11. No sale or marketing
Business Associate will not sell PHI or use/disclose PHI for marketing without required authorization and agreement terms.
12. Regulatory updates
The parties will amend this BAA as needed to comply with changes in HIPAA or related regulations.
Contract review references
Review the final agreement against 45 CFR 164.504(e), 45 CFR 164.314(a), and HHS sample provisions. This template does not establish executed terms or operational compliance.