DPAs and BAAs
Business associate agreement playbook
Positions for business associate agreements under HIPAA. Ten clauses.
Agreement
Business associate agreement
Side
Covered entity
Positions
10 clauses
Last reviewed
October 2026
Overview
This playbook covers the clauses that carry most of the risk in a business associate agreement. Each clause has a preferred position, a fallback your reviewers can accept without escalating, and a walk-away position that goes to the general counsel.
Every position is written as clause language, so a reviewer can paste it into the draft or accept a counterparty edit that matches it. A note under each clause explains what the position trades.
Who wrote it
Margaret Lindqvist, General Counsel at Proviso, with review from in-house lawyers at three of our customers. It was last checked against current market terms in October 2026.
Sample positions
Three of the 10 clauses. The full playbook adds a note on each position and who can approve it.
Subprocessors
Prior written approval for each new subprocessor.
30 days’ notice of a new subprocessor, with a right to object.
No notice of new subprocessors.
Breach notice
Notice within 24 hours of discovering a breach.
Notice within 72 hours, with details as they become known.
Notice later than 72 hours, or only “without undue delay”.
Audit
A right to audit once a year, on 30 days’ notice.
The vendor’s current SOC 2 Type II report, with an audit right after a breach.
No audit right and no independent report.
Load it into Proviso
Import the file from Playbooks in your workspace. Every position, fallback and approver comes across, ready to test on your last forty drafts before you publish it.
