Free HIPAA BAA checker.
Drop a Business Associate Agreement and see whether it contains the terms HIPAA requires, with each finding tied to the section of 45 C.F.R. Part 164 behind it. Your document never leaves your browser.
Check your BAA now →- Free forever (MIT)
- Nothing uploaded
- No account
- 1,825 cited checks
- PDF or DOCX
What it checks in a BAA
45 C.F.R. § 164.504(e) required terms
Permitted uses and disclosures, safeguards, reporting, access and amendment, accounting, HHS access to books and records, and return or destruction at termination.
Security Rule flow-down
The § 164.314(a) obligations for electronic protected health information.
Breach notification
Whether the business associate must report breaches of unsecured PHI, and how fast, under § 164.410.
Subcontractor BAAs
Business-associate-to-subcontractor agreements have their own playbook, so the downstream chain is checked too.
Scope against the main agreement
Drop the BAA with its services agreement and Vaulytica flags a BAA that is broader than the agreement it sits under.
What you get
A Word report
A findings index by severity, then each finding in full: the quoted clause, its position, the rule, and its source.
Comments on your own draft
Your .docx back with each finding attached as a Word comment on the clause it is about.
Deadlines on your calendar
Renewal, notice and cure dates the document states, as an .ics file.
Obligations and fix lists
Who owes what, and what to fix, as spreadsheets you can sort and share.
How it works
- Open vaulytica.com — no account, nothing to install.
- Drop your PDF or DOCX. It is read inside your browser tab; nothing is uploaded.
- Get your report in seconds. The document type is detected and only the checks that belong to it run.
Questions
Is a BAA checker the same as HIPAA compliance?
No. It checks the contract's terms. Compliance also depends on what the parties actually do, which no document review can confirm.
Can I use it on documents with patient information?
The document is processed only in your browser and nothing is uploaded. Follow your own organization's policies for handling PHI.
Does it check Notices of Privacy Practices?
Yes. HIPAA Notices of Privacy Practices have their own playbook.