MightyForms is now part of FormBuilder.AnnouncementMightyForms login

Business Associate Agreement (BAA)

BAA support is planned with our upcoming HIPAA offering. HIPAA plans and BAAs are not yet available; current plans do not support PHI collection. The information below describes the planned offering.

What is a BAA?

A Business Associate Agreement (BAA) is a legally binding contract required under HIPAA between a covered entity (healthcare provider, health plan, or healthcare clearinghouse) and a business associate (service provider handling PHI).

The BAA ensures that business associates will appropriately safeguard Protected Health Information (PHI) they receive, create, maintain, or transmit on behalf of the covered entity.

Who Needs a BAA?

You Need a BAA If You Are:

  • Healthcare providers (doctors, clinics, hospitals)
  • Health insurance companies
  • Healthcare clearinghouses
  • Business associates of covered entities
  • Any organization handling PHI

You Don't Need a BAA If:

  • You don't collect health information
  • Forms are for general business use
  • No PHI is processed or stored
  • You're not a HIPAA covered entity

What Our BAA Covers

Obligations & Activities

  • Permitted uses and disclosures of PHI
  • Safeguards to prevent unauthorized use or disclosure
  • Reporting of security incidents and breaches
  • Ensuring agents and subcontractors comply with HIPAA

Security Requirements

  • Implementation of administrative, physical, and technical safeguards
  • Encryption of PHI at rest and in transit
  • Access controls and audit logging
  • Regular security assessments

Compliance & Termination

  • Return or destruction of PHI upon termination
  • Compliance with HIPAA Security and Privacy Rules
  • Cooperation with HHS investigations
  • Indemnification provisions

Our Responsibilities as a Business Associate

When you sign a BAA with FormBuilder, we commit to:

  1. Use PHI only as permitted by the BAA and your instructions
  2. Implement appropriate safeguards to protect PHI
  3. Report any breaches within 60 days of discovery
  4. Ensure our subcontractors sign BAAs and comply with HIPAA
  5. Make our practices available for HHS audits
  6. Return or destroy PHI when our services end
  7. Maintain documentation for 6 years as required by HIPAA

Our Subcontractors

We work with trusted subcontractors who also sign BAAs and comply with HIPAA:

  • Cloudflare - Infrastructure, security, and content delivery
  • Stripe - Payment processing (no PHI shared)
  • SendGrid - Email delivery (no PHI in emails)

View our full subprocessors list for complete details.

How to Get a BAA

1

HIPAA Plan — Coming Soon

BAAs are planned with our upcoming HIPAA plan

2

Contact Our Team

Email [email protected] with your organization details

3

Review & Sign

We'll send you our standard BAA for review and signature

4

Start Collecting PHI

Once executed, you can securely collect PHI through FormBuilder

BAA Pricing

Pro Plan

$39/month

  • Business forms and response workflows
  • Custom branding and advanced fields
  • No BAA or PHI collection
  • Priority support
View Pro Features
RECOMMENDED

HIPAA Plan

$99/month

  • Standard BAA included
  • HIPAA mode and compliance controls
  • Audit logging and access controls
  • Retention controls
  • Priority compliance support
View HIPAA Features

Frequently Asked Questions

Can I use my own BAA template?

For Enterprise customers, we can review and potentially accept your organization's BAA template. Contact our legal team at [email protected].

How long does it take to get a BAA?

BAAs are not yet available. Setup and review timing will be confirmed when the HIPAA plan launches.

What happens if there's a breach?

We follow strict breach notification procedures, notifying you within 60 days of discovery, providing details about the breach, affected individuals, and steps taken to mitigate harm.

Can I audit your security practices?

Enterprise customers can request security documentation and audit reports. We also undergo regular third-party security assessments.

Ready to Get Started?

Contact us to discuss your requirements and the planned HIPAA offering.

We use necessary cookies to run FormBuilder and optional analytics cookies to understand site usage. You can accept analytics cookies or keep only necessary cookies.