Free BAA Request Letter Template for Therapists
A ready-to-use, fill-in-the-blank letter you can send to any vendor that handles client data but hasn't given you a signed Business Associate Agreement (BAA) yet. Enter your email below and we'll send you the full template to copy, fill in, and send today.
Written & fact-checked by the Therapy HIPAA Hub editorial team — see our editorial standards.
Updated October 2026 · Based on HHS model BAA guidance
Quick Answer
A BAA request letter is a short, formal letter asking a vendor that touches client PHI to sign a Business Associate Agreement. You need one whenever a vendor outside your main EHR — billing services, IT contractors, AI note-taking tools — doesn't already have a BAA on file. Without it, using that vendor for anything involving client data is an unauthorized disclosure under HIPAA.
Which Vendors Actually Need This Letter
Your main EHR (SimplePractice, TherapyNotes, Jane, etc.) almost always includes a BAA automatically when you sign up. This letter is for the smaller, easy-to-overlook vendors around it:
Billing or medical coding services outside your main EHR
IT support or managed service providers who can access your systems
Transcription or AI note-taking tools
Cloud storage used for client files (if not covered by your EHR's BAA)
A scheduling or texting tool used alongside your EHR
Any contractor or virtual assistant who touches client records
Get the Full Letter Template
Enter your email and we'll send you the ready-to-send letter — copy, fill in the brackets, done.
No spam. One-time 3-email series. Unsubscribe anytime.
Trusted by 225,000+ Therapists
50% Off Your First 4 Months of SimplePractice
SimplePractice is the #1 HIPAA-compliant practice management platform for therapists. Includes a signed BAA, encrypted messaging, telehealth, and full insurance billing.
Limited-time summer offer · No credit card required for trial
Need HIPAA-compliant email only? See Hushmail for Healthcare →
FAQ — BAA Request Letters
Who needs to receive this letter?
Any vendor that creates, receives, maintains, or transmits Protected Health Information (PHI) on your behalf and has not already given you a signed Business Associate Agreement (BAA). Your main EHR almost always includes one by default — this letter is for the smaller tools and contractors that often get missed.
What if the vendor doesn't respond or refuses?
If a vendor that handles PHI won't sign a BAA, you cannot legally continue using them for anything involving client data. Set a deadline in the letter (two weeks is reasonable), and if they don't respond or decline, you need to find an alternative or stop using them for PHI-related tasks.
Is this letter a legally binding BAA by itself?
No — this is a request letter, not the BAA itself. Most vendors will respond with their own BAA document (or the HHS model BAA) for you to review and sign. The letter simply opens the conversation and puts your request in writing, which is useful documentation on its own.
Do I need a lawyer to send this?
No. Requesting a BAA is a standard, routine compliance step — vendors who work with healthcare providers receive these requests regularly and usually have a process already in place. A lawyer is only necessary if a vendor's BAA terms need negotiation.
How long should I keep a copy of this letter and the signed BAA?
Keep both for at least 6 years from the date signed or last in effect, whichever is later — the same retention period HIPAA requires for all compliance documentation. OCR auditors commonly request copies of BAAs and the correspondence around them.