Skip to main content

How-to

How to Get a Business Associate Agreement Signed With a Vendor

Where Microsoft, Google and other large vendors actually route a BAA request: self-serve admin console or sales-gated contract exhibit.

Solomon AmosPublished 30 Oct 20269 min read

If you have searched how to get a business associate agreement, you have probably hit the same wall twice: a vendor's marketing page says nothing about HIPAA, and the first human who replies to your email wants to know your contract value before discussing anything else. That is not always a sign the vendor refuses to sign a BAA. It is often a sign you are looking in the wrong place. Large vendors route BAA requests through very different channels. Some, including Microsoft and Google, let an administrator accept the terms inside a settings panel they already have access to. Others treat the BAA as a negotiated exhibit that only a sales or legal team can countersign, usually gated behind an enterprise-tier contract. Knowing which path a given vendor uses before you ask saves weeks of back and forth.

Why 'the vendor won't sign' is usually a routing problem

Most procurement teams assume a vendor without a visible HIPAA page has decided not to support healthcare customers. In practice the BAA is often buried one level below where a buyer looks. For self-serve cloud platforms, the agreement lives inside the admin console as an amendment to the standard terms of service, something a tenant administrator can accept without talking to anyone. For platforms sold through named account teams, the same agreement exists but it is treated as a contract exhibit, held back until a deal is in legal review. The difference is commercial structure, not security posture. A vendor can have a mature security programme and still gate its BAA behind sales, simply because every enterprise contract at that company goes through the same negotiation workflow regardless of the clause involved.

Self-serve
Microsoft 365 and Google Workspace admin consoles
Tenant admins on eligible plans can typically review and accept the BAA addendum themselves, without opening a sales conversation.
Sales-gated
Most CRM, HR and messaging platforms at enterprise tier
The BAA is usually countersigned manually by an account or legal team as part of the master agreement.
Badge without contract
A recurring pattern on trust centres
In the CertReports index on 2026-10-30, a HIPAA badge on a trust centre page signals support for the requirement, not a signed BAA with your organisation.
A business associate contract must describe the permitted and required uses of protected health information by the business associate, and must provide that the business associate will not use or further disclose the information other than as permitted by the contract or as required by law.

How Microsoft routes a BAA request

Microsoft publishes its HIPAA business associate agreement as an amendment to its Online Services Terms rather than as a separate document a sales rep emails over. For Microsoft 365, Azure and Dynamics 365 tenants on eligible commercial plans, a global or compliance administrator can usually find and accept the BAA addendum inside the admin centre, under the organisation's service agreements or compliance settings, without raising a ticket. Enterprise Agreement customers who prefer a formally countersigned copy can still ask their account team to attach it as a contract amendment at renewal, but that route exists for convenience rather than necessity. The practical lesson: check the admin centre first. Many IT teams assume they need an account manager simply because that is how every other contract change happens at their organisation.

How Google routes a BAA request

Google splits this across two products. In Google Workspace, a super administrator can review and accept the BAA from within the Admin console's legal and compliance settings, available on the editions Google designates as HIPAA-eligible, again without a sales call. In Google Cloud, acceptance happens through the console alongside the Cloud Data Processing Addendum, and it only extends to the specific services Google lists as covered. Accepting a BAA with either product does not automatically extend to every workload you run on it: a storage bucket might be in scope while a preview feature is not. That distinction, between a vendor being eligible to sign a BAA and a specific product actually being covered once one is signed, is exactly what separates HIPAA eligible from HIPAA compliant, and it is worth checking against the vendor's own covered-services list rather than assuming coverage follows the brand name.

Flow diagram comparing a self-serve admin console BAA path with a sales-gated contract exhibit path
Two routes to the same signature: an admin console toggle or a negotiated contract exhibit.

Self-serve versus sales-gated: where to look before you assume

The table below is a starting point, not a guarantee. Plan tiers, regions and product lines change which path applies, so always confirm inside the vendor's own admin settings or ask support to point you to their compliance page before escalating to an account team.

VendorTypical routeWhere to look first
Microsoft 365 / AzureSelf-serve on eligible commercial plansAdmin centre, service agreements or compliance settings
Google WorkspaceSelf-serve on HIPAA-eligible editionsAdmin console, legal and compliance section
Google Cloud PlatformSelf-serve, scoped to covered servicesConsole, alongside the Cloud DPA
AWSSelf-serve via account settings and AWS ArtifactAWS Artifact agreements
SalesforceSales-gated, usually a paid Health Cloud or Shield add-onAccount executive or named success manager
SlackSales-gated, tied to Enterprise Grid plus a compliance add-onEnterprise sales team
ZoomAvailable on paid plans, often self-serve request formZoom's compliance or legal centre, then support
Box / Dropbox BusinessSales-gated on enterprise tiersAccount team, as part of contract negotiation

Where large vendors tend to put the BAA. Confirm against the vendor's current terms before relying on this.

A HIPAA badge is not the same as a captured BAA

Trust centres make this worse, not better. A badge that says HIPAA sits next to badges for SOC 2 and ISO 27001 and reads like another certification, but HIPAA does not issue certificates, it requires a signed contract between two specific parties. A badge tells you the vendor has built a HIPAA-aligned programme and is willing to sign. It does not tell you that your organisation has a countersigned agreement on file. The card below shows a trust centre pattern worth checking directly: look at whether the HIPAA row links to an actual request workflow or simply states support for the requirement, and check the subprocessor list to see who else might touch protected health information once the BAA is in place.

Intercom logo

Intercom · Trust report

Customer support · Public evidence as of 26 Oct 2026

Visit trust centreFull evidence

Framework overview

CertReports state for each framework with public evidence: 1 verified, 10 vendor-stated.

2 more frameworks on the evidence page

2Documents and agreements

Legal and review documents Intercom publishes or offers, as of 30 Sep 2026.

1Security practices

Public statements from Intercom, shown as statements, not attestations, as of 30 Sep 2026.

  • Penetration testing · annual

14Subprocessors

Named on Intercom's public subprocessor list, last seen 30 Sep 2026.

A HIPAA row on a trust centre indicates willingness to sign, not a captured agreement with your account. Every line is a dated public record from the Data Privacy Framework list and Intercom's trust centre. A framework not shown means no public evidence was found, not that Intercom lacks it.CertReports

Step by step: getting a BAA signed with any vendor

  1. 1

    Check the admin console or account settings first

    Before emailing anyone, look for a compliance, legal or data protection section inside the product you already have access to. Self-serve vendors put the BAA here, not on the marketing site.

  2. 2

    Confirm your plan or edition is eligible

    Many BAAs only apply to specific tiers or regions. Note the exact product names you use, since a parent company can have one product covered and another excluded.

  3. 3

    If there is no self-serve option, go to support, not sales

    Support teams can usually confirm the correct workflow faster than a sales inbox, and can route you to the right contract team without a pricing conversation.

  4. 4

    Ask for the current template before negotiating anything

    Request the BAA document itself so your privacy or legal team can review it against your own requirements while the commercial conversation continues separately.

  5. 5

    Get a named signatory and a countersigned copy

    A link accepted inside a console is still a contract. Keep the accepted version, the acceptance date and the name of the administrator who accepted it on file.

  6. 6

    Record the scope of covered services

    Note which specific products, regions or editions the BAA actually covers, and store that alongside your BAA checklist so renewals do not silently drop coverage.

How to fill out a BAA once you have one

Filling out a BAA is mostly a matter of getting the right entities and dates into a template that is otherwise standard across the industry. Most vendor BAAs follow the same structure required by the HIPAA Privacy and Security Rules, so the blanks are predictable even when the wording differs.

  1. Enter the full legal name of the covered entity (your organisation) and the business associate (the vendor), matching the names on your master services agreement exactly.
  2. Confirm the effective date, which should align with or predate the date any protected health information first flows to the vendor.
  3. Check the permitted uses and disclosures section against what the vendor actually does with the data, not a generic description.
  4. Confirm the breach notification timeframe stated in the BAA and record it next to your incident response plan.
  5. Note the subcontractor clause: if the vendor uses subprocessors, the BAA should require them to accept equivalent terms. Cross-check this against the vendor's own subprocessor list.
  6. Confirm the return or destruction of data terms for when the contract ends, and who signs on each side with their title and date.

What to check before you sign

A signed BAA is a legal commitment, not a security assessment, so it should not be the only thing you look at. Pair it with the vendor's actual evidence: a current SOC 2 report, an active HIPAA programme description, and a subprocessor list that matches what the BAA's subcontractor clause describes. The specific clauses worth reading twice, such as breach notification timing and the scope of permitted uses, and the common confusion between a vendor being willing to sign and a specific product actually being covered, are both worth checking against the vendor's own documentation before you countersign anything.

Checklist graphic showing BAA fields to confirm: entity names, effective date, permitted uses, breach notice window, subcontractor clause, data return terms
The same six fields appear in nearly every vendor BAA, whatever the surrounding wording looks like.

If a vendor genuinely will not sign

Some vendors will not sign a BAA at any tier, usually because their product was never built to handle protected health information and extending one would create liability they have not assessed. If support and sales both confirm this, do not try to negotiate one, use a different product for that workflow or de-identify the data before it reaches the vendor. Before concluding this is the case, run the product through a 30-minute vendor security review using whatever public evidence the vendor does publish, since a vendor with a mature compliance programme elsewhere in its stack is far more likely to be willing once the request reaches the right team. For a wider check across your whole stack, a regulations and evidence check can show which of your vendors need a BAA at all, which is often fewer than procurement assumes.

People also ask

How to get a business associate agreement with microsoft?

Check the Microsoft 365 or Azure admin centre first, under service agreements or compliance settings. Microsoft publishes its HIPAA BAA as an amendment to its Online Services Terms, and administrators on eligible commercial plans can usually accept it there without a sales call. Enterprise Agreement customers can also have their account team attach it as a contract amendment at renewal if a formally countersigned copy is preferred.

How to get a business associate agreement?

Start inside the admin or account settings of the product itself, since many large vendors let an administrator accept the BAA as a self-serve addendum. If there is no such option, contact support rather than sales to confirm the correct workflow, then request the current template so legal can review it while any commercial terms are agreed separately. Keep the signed or accepted copy and its effective date on file.

How to sign a business associate agreement with google?

In Google Workspace, a super administrator can review and accept the BAA inside the Admin console's legal and compliance section, available on HIPAA-eligible editions. In Google Cloud, acceptance happens in the console alongside the Cloud Data Processing Addendum and only extends to the specific services Google lists as covered, so confirm your workload is on that list.

How to fill out a business associate agreement?

Enter the full legal names of both parties exactly as they appear on your master agreement, set an effective date that aligns with when protected health information first flows to the vendor, and check the permitted uses, breach notification timeframe, subcontractor clause and data return terms against what the vendor actually does. Have a named signatory on each side date and sign the final version.

HIPAABAAvendor riskbusiness associate agreementhealthcare compliance
S

Solomon Amos · Founder, CertReports

Solomon builds CertReports, the public evidence index for vendor security reviews. PhD in machine learning and cybersecurity, two years embedded at HMRC digital programmes, founder of TapTax. He writes about what registries, trust centres and auditors actually publish, and how buyers can use it before the questionnaire goes out.

Read next on CertReports

You might also like