This page lists three turns, the messages you send to the AI one after another in the same chat, and then a check of the answer. Keep it open next to your chat. Each turn shows the next thing to paste, with the values you entered already filled in. Nothing is sent from this page, and your conversation stays in the AI tool you are using.
Paste the full BAA, including exhibits, security schedules, and anything it incorporates.
Covered entity or business associate, and whether the form came from you or from them.
States whose breach, medical-privacy, or consent laws layer on top of HIPAA here.
Data elements, volume, and whether any of it carries its own regime: SUD records, psychotherapy notes, genetic or reproductive data.
The services agreement's limitation of liability, indemnity, insurance, and order-of-precedence language.
Watch for these throughout
HIPAA's outer notice limit is not a target. If the BAA lets the vendor take the full period, the covered entity's own clock can expire before it learns anything. Check the arithmetic on every draft.
State medical-privacy and breach statutes frequently impose shorter deadlines and broader definitions than HIPAA, and they change. Confirm each against the current statute rather than relying on a period the model supplies.
The liability answer usually lives in the underlying services agreement, not the BAA. Review the two together or the review is incomplete.
Substance use disorder records, psychotherapy notes, and genetic or reproductive data carry separate regimes that a standard BAA does not address. Screen the data scope before treating the form as adequate.
A signed BAA is not a compliance program. It does not substitute for vendor diligence, security review, or knowing which subcontractors actually hold the data.