A BAA and an NDA are not interchangeable contracts. A Business Associate Agreement is a federally mandated contract under HIPAA that governs vendors handling protected health information on behalf of a healthcare organization. A Non-Disclosure Agreement is a private contract, governed by state law, that protects trade secrets and other confidential business information. They protect different data, are enforced by different people, and carry different penalties. An NDA cannot substitute for a BAA when patient data is involved, and a BAA does nothing to shield your pricing models, source code, or client lists.
Which One You Need
The deciding question is whether protected health information (PHI) will change hands. If your organization is a covered entity under HIPAA — a health plan, healthcare provider, or healthcare clearinghouse — and you share identifiable patient data with an outside vendor, federal law requires a BAA before that data moves. The vendor becomes a “business associate” the moment it creates, receives, maintains, or transmits PHI on your behalf, whether for billing, claims processing, data analysis, or IT services.1eCFR. 45 CFR 160.103 Skipping the BAA has led to six-figure settlements with the Office for Civil Rights.2U.S. Department of Health and Human Services. Resolution Agreements
An NDA covers everything else. Trade secrets, proprietary formulas, client lists, internal pricing, software source code, unreleased marketing plans. Two companies exploring a partnership, or a business hiring a consultant who will see sensitive information, use an NDA because it gives them a legal basis to sue if that information leaks. No federal agency requires it; the parties create it for themselves.
Sometimes both apply. A cloud-storage vendor that holds patient records and touches your proprietary analytics platform is handling two categories of sensitive data at once. The BAA covers the PHI obligations required by HIPAA, and a separate NDA protects the business information HIPAA does not reach. Trying to fold both into a single document usually creates gaps in one direction or the other.
What Each Agreement Protects
PHI Under a BAA
A BAA protects individually identifiable health information — any data tied to a specific person’s medical history, treatment, or payment for care. HIPAA’s Privacy Rule lists 18 identifiers that make health data “protected,” including names, Social Security numbers, dates of service, phone numbers, email addresses, medical record numbers, and full-face photographs.3eCFR. 45 CFR 164.514 A BAA restricts the vendor to using this information only as needed to perform its contracted function.
Strip all 18 identifiers, and if the covered entity has no reason to believe the remaining data could identify anyone, it qualifies as “de-identified” under the Safe Harbor method.3eCFR. 45 CFR 164.514 De-identified data is no longer PHI, and sharing it does not trigger the BAA requirement.
Confidential Business Information Under an NDA
NDAs cover a broader, more flexible category: any nonpublic business information that gives a company a competitive edge. Manufacturing processes, software architecture, customer databases, financial projections, and merger plans all qualify. The parties themselves define what counts as “confidential,” which gives NDAs more flexibility than BAAs but also means a vague definition can create enforcement problems.
Well-drafted NDAs include standard carve-outs — categories that do not count as confidential even if they look sensitive. The four common exclusions are information that becomes public through no fault of the recipient, information the recipient already had before the NDA, information the recipient develops independently, and information received from a third party with no confidentiality restriction. Courts will not enforce an NDA that tries to lock up information the recipient legitimately obtained on their own.
Who Enforces the Agreement
BAAs: Federal Enforcement
BAAs draw their authority from HIPAA, specifically 45 CFR 164.504(e), which spells out what the contract must contain.4eCFR. 45 CFR 164.504 – Uses and Disclosures: Organizational Requirements The Office for Civil Rights at HHS enforces these requirements and can impose civil money penalties even without an actual data breach. Failing to have a BAA in place is itself a violation.
Penalties follow four tiers based on the violator’s level of fault. For 2026, the inflation-adjusted amounts are:
- No knowledge of the violation: $145 to $73,011 per violation, with an annual cap of $2,190,294
- Reasonable cause, not willful neglect: $1,461 to $73,011 per violation, same annual cap
- Willful neglect, corrected within 30 days: $14,602 to $73,011 per violation, same annual cap
- Willful neglect, not corrected: $73,011 to $2,190,294 per violation, same annual cap
Those numbers are adjusted every January for inflation.5Federal Register. Annual Civil Monetary Penalties Inflation Adjustment You do not need to sue anyone. The government investigates and imposes the penalty.
NDAs: Private Litigation
NDAs rely on state contract law and, in most situations, state trade secret statutes. Nearly every state has adopted some version of the Uniform Trade Secrets Act, which provides injunctive relief and compensatory damages when trade secrets are misappropriated. At the federal level, the Defend Trade Secrets Act of 2016 lets trade secret owners bring civil claims in federal court when the information relates to products or services in interstate commerce.6Office of the Law Revision Counsel. 18 USC 1836
Remedies under the DTSA include injunctions against ongoing or threatened misappropriation, compensatory damages for actual losses or unjust enrichment, exemplary damages up to twice the compensatory award for willful and malicious theft, and attorney fees.7Office of the Law Revision Counsel. 18 USC 1836 Unlike a BAA violation, nobody from the government shows up to investigate. The injured party hires a lawyer, files a lawsuit, and proves the breach, which makes enforcement slower and more expensive.
What Must Be in Each Contract
BAA Required Terms
Federal regulation dictates the minimum contents of a BAA. The contract must describe the permitted and required uses of PHI, prohibit the business associate from using the information beyond those purposes, and require appropriate safeguards against unauthorized access.8U.S. Department of Health and Human Services. Business Associates It must also ensure any subcontractors who touch the data agree to the same restrictions.4eCFR. 45 CFR 164.504 – Uses and Disclosures: Organizational Requirements
Breach notification is mandatory. Business associates must report any unauthorized access or disclosure to the covered entity without unreasonable delay and no later than 60 calendar days after discovering the breach.9eCFR. 45 CFR 164.410 – Notification by a Business Associate The contract must also address what happens to the data when the relationship ends.
NDA Essentials
Because no federal agency dictates NDA terms, the parties have wide latitude. At a minimum, an enforceable NDA needs to identify the disclosing and receiving parties, define what counts as confidential information, specify how long the confidentiality obligation lasts, and include valid consideration. In a mutual NDA where both sides share secrets, the exchange itself typically serves as consideration. In a one-way NDA, access to the confidential information or the business opportunity usually suffices.
Duration is one of the most consequential choices. Fixed-term NDAs that expire after two or three years are common in deal negotiations and consulting arrangements. For genuine trade secrets, though, a time limit can backfire: courts have found that an expiring NDA may undermine a claim that the information still qualifies as a trade secret after the agreement lapses. If the information has long-term value, the confidentiality obligation should last as long as the information remains secret.
The Whistleblower Immunity Notice
Since 2016, any NDA or similar agreement with an employee, contractor, or consultant that restricts disclosure of trade secrets must include a notice about whistleblower immunity. Under the Defend Trade Secrets Act, individuals cannot be held liable, civilly or criminally, for disclosing trade secrets confidentially to a government official or attorney to report a suspected violation of law, or in a sealed court filing.10Office of the Law Revision Counsel. 18 USC 1833
Skip the notice and the penalty is targeted: the employer loses the ability to recover exemplary damages or attorney fees if it later sues that individual for trade secret misappropriation.10Office of the Law Revision Counsel. 18 USC 1833 Actual damages remain available, but the punitive layer disappears. Companies can satisfy the requirement by putting the notice directly in the NDA or by cross-referencing a separate written policy that contains the required language. It is one of the most commonly overlooked drafting requirements, and one of the easiest to fix.
What Happens When the Agreement Ends
BAA: Return or Destroy PHI
When a BAA terminates, the business associate must return or destroy all PHI it received from the covered entity, including any copies it created. When returning or destroying the data is not feasible, a realistic scenario when information lives across backup systems and cloud infrastructure, the business associate must continue to protect the data under the original BAA terms and limit any further use to the purposes that make destruction impractical.11eCFR. 45 CFR 164.504 The same obligation flows down to any subcontractors that handled the data.
Best practice is to require a written certification of destruction, sometimes called a PHI Destruction Certification, so the covered entity has documentation for its compliance files. Spelling out acceptable destruction methods, data formats, and who bears the cost inside the original BAA prevents arguments at termination.
NDA: Return or Destroy Confidential Materials
NDAs typically include a “return or destroy” clause requiring the receiving party to hand back or delete all confidential materials and certify in writing that it has done so. In practice, this is one of the hardest NDA provisions to enforce. Confidential information migrates across email servers, cloud backups, collaboration tools, and personal devices in ways that make complete destruction genuinely difficult. A corporate officer certifying total destruction is making a promise modern data architecture may not let them keep.
Draft the clause with realistic expectations: require destruction of all reasonably accessible copies, mandate written certification, and include a surviving confidentiality obligation that covers any residual data the recipient cannot locate or delete. Treating return-or-destroy as a formality rather than a binding obligation is how companies end up in litigation.
The Workforce Boundary
Not everyone who handles PHI needs a BAA. HIPAA’s definition of “business associate” excludes members of the covered entity’s own workforce — employees, volunteers, trainees, and anyone whose work is under the organization’s direct control.1eCFR. 45 CFR 160.103 These individuals are governed by the organization’s internal HIPAA policies and training instead. Independent contractors generally fall outside the workforce and require a BAA, so most organizations execute one with any outside party who might encounter PHI rather than risk the classification.