An OCR data request lands on your desk. It asks for the business associate agreement covering the transcription vendor that touched the records in question. You pull the file. What you find is a six-page PDF with a signature block that says /s/ M. Alvarez, Operations, no date, no countersignature from your practice, and no way to tell which of the vendor's three contract versions it belongs to. That gap is where BAA signature requirements stop being a paperwork question and start being an enforcement question.

This article is for the person who owns the vendor list: who is allowed to sign a BAA, whether an electronic signature holds up, what the effective date has to line up with, and what the file needs to look like when someone outside your practice asks to see it.

What HIPAA Actually Says About BAA Signature Requirements

The Privacy Rule does not use the word "signature." At 45 CFR 164.502(e) and 164.504(e), it requires a covered entity to obtain satisfactory assurances from a business associate, and it requires those assurances to be documented through a written contract or other written arrangement. The Security Rule mirrors this at 164.308(b).

So the short answer to the question most operators are actually searching: HIPAA does not require wet ink, notarization, or a witness. It requires a written agreement containing the mandated provisions, entered into by parties with authority to bind their organizations. A dated signature block is how you prove that happened. It is evidence, not a regulatory checkbox — which is exactly why sloppy execution hurts you.

HHS publishes sample business associate agreement provisions and is explicit that the sample language is not a complete contract. Signature blocks, term, termination mechanics, and indemnity are yours to add.

Government-to-government arrangements are the exception

If your covered entity and the business associate are both government agencies, 164.504(e)(3) permits a memorandum of understanding, or reliance on law or regulation, in place of a signed contract. If you are a private practice, an FQHC contracting with a county, or a hospital-affiliated group, assume you need the signed agreement.

Who Has Authority to Sign on Each Side

A BAA is a contract. The signature is only worth what the signer's authority is worth. Two failure modes show up constantly.

Your side: the office manager problem

In a five-provider practice, the office manager often signs everything because she is the one who reads the mail. If your practice is an LLC or PC, check the operating agreement or bylaws. If signing authority sits with the managing member or the board, and your office manager signs a BAA that includes indemnification and a breach-notification cost-shifting clause, you have a contract someone may later argue is unenforceable — and you will be arguing it during a breach.

Fix this once, in writing. Adopt a short signature authority policy naming the roles that may execute BAAs and any dollar or scope thresholds that require a second signature. Keep it with your policy set. It takes an afternoon and it resolves the question permanently.

Vendor side: "Operations" is not a title

When a vendor returns a BAA signed by an account executive, you have obtained assurances from someone whose job is to close the deal, not to bind the company to breach-notification timelines. Require a printed name, a title, and an entity name that matches the vendor's legal name — not the brand name on the invoice.

That last point catches people. Your billing company does business as one name and is legally organized as a holding entity in another state. If the BAA names the brand and the breach happens at the legal entity, you have a naming problem in the middle of an incident.

Electronic Signatures, Clickwrap, and the Portal Terms Problem

Electronic signatures satisfy BAA signature requirements. The federal E-SIGN Act (15 U.S.C. 7001) and state versions of the Uniform Electronic Transactions Act give an electronic signature the same legal effect as a handwritten one for most commercial contracts, and OCR has never taken the position that HIPAA requires paper.

What matters is that your e-signature process produces the same three things a paper file produces:

  • Attribution — you can show which human signed, from which email address, at what time.
  • Integrity — you can show the executed document has not changed since signing.
  • Retention — you can retrieve the executed copy for years, independent of the signing platform's account status.

Export the completion certificate or audit trail with the PDF and store both. If your e-signature vendor itself touches PHI in the documents you route through it, that vendor needs a BAA too.

Clickwrap and "our terms include a BAA"

A growing number of SaaS vendors say their BAA is incorporated by reference into online terms you accepted at signup. Sometimes there is a checkbox in an admin console labeled "Enable HIPAA mode" that triggers the BAA. This can be legally valid — and it is an evidentiary nightmare if you never captured it.

When a vendor's BAA lives in a portal, do three things the day you accept it: download the PDF of the exact version in force, screenshot the console page showing the acceptance and date, and note the acceptance in your vendor register. Vendors revise online terms. The version you agreed to in 2023 may not be retrievable in 2026, and the version that governs a 2023 disclosure is the one you will need.

Dating, Effective Dates, and the Gap Nobody Documents

Two dates matter, and they are frequently different: the date each party signed, and the date the agreement takes effect.

The obligation attaches when the vendor first creates, receives, maintains, or transmits PHI on your behalf. If your new answering service started taking calls on March 1 and the BAA was executed on April 12 with no effective date clause, you have a six-week window of unprotected disclosure sitting in your own file, documented by your own signature.

Use an effective date that matches the start of PHI access, and say so plainly: "This Agreement is effective as of March 1, 2026, regardless of the date of signature." Better yet, execute before access. Build it into onboarding: no credentials, no VPN account, no data feed, no shared folder until the BAA is countersigned. Give the responsibility to whoever provisions access, not to whoever negotiates price.

Countersignature is not optional in practice

A BAA signed only by the vendor is a proposal. A BAA signed only by you is a request. Files with one-sided execution are extremely common in small practices because the returned copy never gets routed back to the compliance folder. Assign a single person to confirm fully executed copies and log them. Nobody else needs to touch it.

Subcontractor Chains: The Signature You Never See

Since the 2013 Omnibus Rule, business associates must obtain BAAs from their own subcontractors, and those subcontractors are directly liable under HIPAA. Your billing company's offshore coding partner, your EHR host's backup provider, your marketing agency's email platform — each link needs its own signed agreement. HHS covers the structure in its business associate guidance.

You do not sign those downstream agreements and you should not try. What you should do is require, in your BAA, that the business associate represent it has executed written agreements with all subcontractors that handle your PHI, and that it will identify them on request. Then actually make the request during annual review for your highest-risk vendors.

The reason this matters operationally: a substantial share of the large breaches posted to OCR's breach reporting portal involve business associates rather than covered entities directly. Your patients' data most often leaves through someone else's building.

What Documented Evidence Looks Like at Audit

For every vendor with PHI access, your file should contain:

  1. The fully executed BAA — both signatures, both printed names and titles, both dates.
  2. The legal entity name matching your contract and invoices.
  3. The effective date, and evidence it precedes or matches first PHI access.
  4. The e-signature audit trail or acceptance screenshot, if signed electronically.
  5. The version identifier — amendments and restatements attached, superseded copies retained.
  6. The termination record, if applicable, including confirmation of PHI return or destruction.

Retention is six years. Under 164.530(j)(2) and 164.316(b)(2)(i), documentation must be kept six years from the date of creation or the date it was last in effect, whichever is later. For a BAA signed in 2019 and terminated in 2025, the clock runs to 2031. Do not purge on the signature date. Some state records laws run longer; check yours.

If you are staring at a vendor list where half the entries have no agreement at all, drafting from scratch is not the bottleneck you think it is. A six-step wizard that produces a signature-ready business associate agreement in PDF and DOCX will close the gap in an afternoon, as a one-time purchase rather than another subscription line item. Generate, route for signature, log the executed copy, move to the next vendor.

A 30-Day Cleanup Workflow for a Neglected Vendor List

Days 1–5 — Inventory. Practice administrator pulls every vendor from accounts payable for the last 24 months. Privacy officer flags each as PHI access, no PHI access, or unclear. Unclear goes on the call list.

Days 6–10 — Classify. For each flagged vendor, write one sentence describing what PHI it touches and why. This sentence is your defense if someone asks why a vendor was excluded. Conduit-only carriers such as the postal service and standard telecom transmission generally fall outside BA status; a cloud host storing encrypted PHI does not, even without the key.

Days 11–20 — Execute. Send agreements. Track sent, returned, and countersigned as three separate states. Escalate anything unreturned at day 15 to the person who controls the vendor's payment.

Days 21–30 — File and close. Store executed copies in one location with consistent naming: VendorLegalName_BAA_Executed_YYYY-MM-DD.pdf. Update your risk analysis to reflect the vendor inventory. NIST's SP 800-66 Rev. 2 is a useful map for tying vendor relationships back to Security Rule safeguards.

Watch the proposed Security Rule

HHS published a proposed Security Rule overhaul in January 2025 that would, among other changes, require business associates to verify their safeguards through written analysis and certification on a recurring basis. It is not final as of December 2025. Do not rewrite your template around it yet — but if you are negotiating a multi-year agreement now, include an amendment clause that lets you update the BAA when rules change without renegotiating the whole contract.

Five Signature Defects Worth Fixing This Week

  • Undated signatures. No date means no provable start. Add a date field and reject returns without one.
  • Title-less signers. "J. Reed" tells you nothing about authority.
  • Brand-name entities. Match the legal name on the W-9.
  • One-sided execution. Countersign and return, then file the version with both marks.
  • Orphaned amendments. An amendment signed in 2024 that references a base agreement nobody can locate is worthless.

Start With the Ten Vendors That Scare You Most

You do not have to fix the whole list this month. Rank vendors by volume of PHI and depth of system access, take the top ten, and confirm each has a fully executed, dated, correctly-named agreement in your file. That is a defensible afternoon of work.

When you hit a vendor with no agreement in place, build the BAA and export it signature-ready rather than borrowing a template from a colleague's practice. And if the cleanup surfaces that your risk analysis and policy set are equally stale, automated risk analysis and compliance documentation will get the rest of the file current. Neither product is a government credential — no such thing exists — but both produce the documentation OCR asks to see.