📋 NDA vs. BAA: Know the Difference

Non-Disclosure Agreement (NDA)

General confidentiality protection

  • Protects trade secrets and business information
  • Defines confidential information broadly
  • Standard remedy provisions
  • Customizable term and scope
  • Not HIPAA-mandated
  • Useful for pre-PHI discussions

Business Associate Agreement (BAA)

HIPAA-required for PHI access

  • Specifically protects PHI
  • HIPAA-defined permitted uses
  • Mandatory breach notification
  • Subcontractor flow-down required
  • Legally required under HIPAA
  • Specific termination procedures

When to use both: Many healthcare relationships require both an NDA (for business secrets, pricing, strategies) and a BAA (for PHI). Our HIPAA-compliant NDA can include BAA provisions as an addendum, or you can execute them separately.

Key HIPAA NDA Provisions

🔒

PHI Definition and Handling

Required

Explicitly defines Protected Health Information consistent with HIPAA and establishes handling requirements including the minimum necessary standard.

"Protected Health Information" or "PHI" means any information, including demographic information, that relates to: (i) the past, present, or future physical or mental health or condition of an individual; (ii) the provision of health care to an individual; or (iii) the past, present, or future payment for the provision of health care to an individual, and that identifies the individual or with respect to which there is a reasonable basis to believe the information can be used to identify the individual.
📝

Permitted Uses and Disclosures

Required

Limits the use and disclosure of PHI to only those purposes necessary to perform services under the agreement.

Receiving Party shall not use or disclose PHI other than as permitted or required by this Agreement or as Required by Law. Receiving Party shall use or disclose only the minimum amount of PHI necessary to accomplish the intended purpose of the use or disclosure.
🔐

Safeguards Requirements

Required

Requires appropriate administrative, physical, and technical safeguards to prevent unauthorized use or disclosure of PHI.

Receiving Party shall implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of any PHI that it creates, receives, maintains, or transmits on behalf of Disclosing Party, in accordance with the HIPAA Security Rule.
👥

Subcontractor Obligations

Required

Requires that any subcontractors with PHI access agree to the same restrictions and conditions.

Receiving Party shall ensure that any subcontractors that create, receive, maintain, or transmit PHI on behalf of Receiving Party agree in writing to restrictions and conditions that are at least as restrictive as those that apply to Receiving Party under this Agreement.
📋

Audit Rights

Recommended

Provides the disclosing party with rights to audit compliance with confidentiality and security obligations.

Upon reasonable notice, Disclosing Party may audit Receiving Party's compliance with this Agreement. Receiving Party shall make its internal practices, books, and records relating to the use and disclosure of PHI available to Disclosing Party or the Secretary of HHS for purposes of determining compliance.

🚨 Breach Notification Requirements

HIPAA requires notification of breaches affecting 500+ individuals within 60 days. However, best practice NDA provisions require faster internal notification:

24h
Discovery to internal notification
48h
Initial assessment complete
72h
Notify covered entity
60d
HIPAA max (500+ affected)
Upon discovery of a Breach of Unsecured PHI, Receiving Party shall notify Disclosing Party without unreasonable delay and in no case later than seventy-two (72) hours after discovery. Notification shall include: (i) identification of each individual whose PHI has been or is believed to have been accessed; (ii) a description of what happened; (iii) the date of discovery; (iv) the types of PHI involved; and (v) mitigation steps taken.

Subcontractor Flow-Down Requirements

HIPAA requires that confidentiality and security obligations flow down through the entire chain of contractors and subcontractors who may access PHI.

Covered Entity
→
Business Associate
→
Subcontractor
→
Sub-subcontractor

Each level must have written agreements with equivalent protections. Our HIPAA NDA includes provisions requiring:

Generate Your HIPAA-Compliant NDA

Customize provisions based on your specific healthcare relationship and compliance needs.

Generate HIPAA NDA →

⚖️ Consult a Healthcare Attorney

HIPAA compliance requirements are complex and enforcement carries significant penalties. While our templates provide a strong foundation, we strongly recommend having a healthcare attorney review any agreement involving PHI before execution. Request a consultation.