Every client needs a BAA. Every subcontractor needs one too. Keep them all on one board.
A business associate must hold a BAA with each covered-entity client and each subcontractor that touches PHI — and be able to produce it. Put your standard BAA on Pacts: each client accepts it in one sitting, the record is append-only, and the board shows who is covered. No PHI enters Pacts: we hold the agreement and who accepted it, never your clients’ patient data.
Free for 3 standard terms · 5 clients · no card. Your clients accept without an account.
Healthcare-focused IT MSPs administering clinics’ and practices’ systems, medical billing and revenue-cycle (RCM) companies, and the other business associates on the same thread: standard terms sent by email to a named contact.
When an investigator asks for the BAA with a client you onboarded two years ago, what do you hand over?
- Every practice you onboard needs a BAA before their systems are touched — and it goes out as an attachment the office manager forwards.
- Your own subcontractors need a BAA from you, and those live in whichever inbox onboarded them.
- OCR made vendor accountability its 2026 enforcement priority; an investigator wants the BAA, its date and its exact text — not a thread.
Same meeting. Same terms. A page they accept — not a contract they sign.
Accepted before access
Your standard BAA as a page: the client’s named contact reads it and clicks Accept. The record is written before anyone is given credentials.
Both directions, one board
Covered-entity clients on one side, your subcontractors on the other. One place shows who is on the current BAA and who is pending.
Evidence an investigator accepts
Each acceptance is append-only: the named contact, the time, the exact text, hashed. The certificate is what you hand OCR or a client’s compliance officer.
Put these on Pacts:
Keep the negotiated MSA — or any client-imposed paper — in DocuSign. Does a click hold up? →
This is the whole recipient experience — try it.
A private link, the full text, one checkbox per document, one button. No account, no signature field, nothing to forward. Then the record, then the certificate.
See a sample certificateNo account · No signature · One click
Tick the box and accept — this is the whole recipient experience.
Start with the agreement you already send. Measure days-to-yes on your next five clients.
Send your first terms