HIPAA BAA Review Checklist

0 of 7 ticked

• States the permitted and required uses and disclosures of PHI, by listing purposes or pointing to the services agreement.

  HIPAA requires45 CFR 164.504(e)(2)(i) (source, opens in a new tab)

  A business associate may use PHI only as its BAA permits or the law requires, so this clause defines everything the vendor is allowed to do.

• Does not let the vendor use or disclose PHI in a way that would break the Privacy Rule if you did it yourself.

  HIPAA requires45 CFR 164.504(e)(2)(i) (source, opens in a new tab)

  The only exceptions the rule allows are the vendor's own management and administration and data aggregation for your operations.

• Vendor will not use or further disclose PHI other than as the BAA permits or requires, or as required by law.

  HIPAA requires45 CFR 164.504(e)(2)(ii)(A) (source, opens in a new tab)

  This is the core restriction. Without it, nothing in the contract stops uses the permitted-uses clause never mentioned.

• Any use of PHI for the vendor's own management, administration or legal duties stays within 164.504(e)(4), or none is granted.

  HIPAA requires45 CFR 164.504(e)(4) (source, opens in a new tab)

  The rule lets a BAA allow these uses, but disclosures for them must be required by law or made under written confidentiality assurances.

• If the vendor carries out any of your Privacy Rule obligations, it follows the rules that apply to you for that task.

  HIPAA requires45 CFR 164.504(e)(2)(ii)(H) (source, opens in a new tab)

  Applies when the vendor does work you would otherwise owe patients, such as sending notices. Tick it if the clause is there or no such work is delegated.

• Vendor's uses, disclosures and requests for PHI follow your minimum necessary policies.

  Recommended45 CFR 164.502(b) (source, opens in a new tab)

  Minimum necessary already binds business associates under 164.502(b). HHS's sample BAA writes it in; 164.504(e) does not list it.

• Names the products, services or features in scope, so you can keep PHI out of everything else.

  RecommendedHHS Sample BAA Provisions, Permitted Uses (a) (source, opens in a new tab)

  Vendor BAAs often cover a listed subset of products. HHS's sample lets the parties list purposes or point to a services agreement.

0 of 3 ticked

• Vendor will use appropriate safeguards to prevent use or disclosure of PHI other than as the BAA provides.

  HIPAA requires45 CFR 164.504(e)(2)(ii)(B) (source, opens in a new tab)

  The Privacy Rule's safeguard term. It covers PHI in any form, including paper and verbal, not only electronic records.

• Vendor will comply with the HIPAA Security Rule (45 CFR Part 164, Subpart C) for electronic PHI.

  HIPAA requires45 CFR 164.314(a)(2)(i)(A) (source, opens in a new tab)

  The Security Rule adds its own BAA term. Vendors are also directly liable under it, but the contract must still say so.

• Describes concrete controls, such as encryption at rest and in transit, access control, audit logging and backups.

  Recommended45 CFR 164.312 (source, opens in a new tab)

  The rule requires compliance, not a list, and encryption is an addressable specification. Named controls give you something to check.

0 of 7 ticked

• Vendor will report any use or disclosure of PHI not allowed by the BAA that it becomes aware of.

  HIPAA requires45 CFR 164.504(e)(2)(ii)(C) (source, opens in a new tab)

  This is broader than breach reporting: it covers any use or disclosure outside the contract, whether or not it becomes a reportable breach.

• Vendor will report any security incident it becomes aware of.

  HIPAA requires45 CFR 164.314(a)(2)(i)(C) (source, opens in a new tab)

  A separate Security Rule term. The rule does not fix the format or frequency of reports, so routine failed attempts can be covered by a standing notice.

• Vendor will notify you of breaches of unsecured PHI as 45 CFR 164.410 requires.

  HIPAA requires45 CFR 164.504(e)(2)(ii)(C) (source, opens in a new tab)

  Both the Privacy Rule and Security Rule BAA terms tie breach reporting to 164.410, the business associate notification rule.

• Breach notice comes without unreasonable delay and no later than 60 calendar days after discovery.

  HIPAA requires45 CFR 164.410(b) (source, opens in a new tab)

  The outer limit set by 164.410(b). It binds the vendor even if the BAA is silent, and a BAA allowing longer conflicts with the rule.

• Treats a breach as discovered on the first day any vendor employee or agent knew, or should have known, of it.

  Recommended45 CFR 164.410(a)(2) (source, opens in a new tab)

  This is how the rule starts the 60-day clock. BAAs that start it at the vendor's 'confirmation' of a breach can push notice later.

• Notice identifies affected individuals where possible and gives the details you need for patient notices.

  Recommended45 CFR 164.410(c) (source, opens in a new tab)

  The rule already requires this content from the vendor. Writing it in avoids a bare 'we had an incident' email with nothing you can act on.

• Says who sends breach notices to patients, HHS and, where needed, the media.

  RecommendedHHS Sample BAA Provisions, Obligations (c) (source, opens in a new tab)

  HHS's sample BAA suggests the parties decide whether the vendor handles these notices for you. Deciding in advance saves days during an incident.

0 of 4 ticked

• Vendor will ensure subcontractors that handle PHI agree to the same restrictions and conditions that apply to the vendor.

  HIPAA requires45 CFR 164.504(e)(2)(ii)(D) (source, opens in a new tab)

  A vendor may pass PHI to a subcontractor only with written assurances. HIPAA counts those subcontractors as business associates too.

• Subcontractors that handle electronic PHI agree in a written contract to comply with the Security Rule.

  HIPAA requires45 CFR 164.314(a)(2)(i)(B) (source, opens in a new tab)

  The Security Rule's version of the flow-down term. The vendor, not you, signs the subcontractor BAA.

• Vendor names its subcontractors that handle PHI, or publishes a list, and tells you before adding one.

  Negotiable45 CFR 164.502(e)(1)(ii) (source, opens in a new tab)

  HIPAA requires flow-down, not disclosure of who the subcontractors are. A list lets you see where PHI actually goes.

• Return or destruction duties at termination reach PHI held by subcontractors, not only by the vendor.

  RecommendedHHS Sample BAA Provisions, Term and Termination (c) (source, opens in a new tab)

  HHS's sample BAA notes the parties can add terms on obtaining or ensuring destruction of PHI held by subcontractors.

0 of 4 ticked

• Vendor will make PHI available so you can meet patients' right of access under 45 CFR 164.524.

  HIPAA requires45 CFR 164.504(e)(2)(ii)(E) (source, opens in a new tab)

  If the vendor holds part of a patient's record, you cannot answer an access request on time without it.

• Vendor will make PHI available for amendment and incorporate amendments under 45 CFR 164.526.

  HIPAA requires45 CFR 164.504(e)(2)(ii)(F) (source, opens in a new tab)

  A correction you accept has to reach every copy of the record, including the one in the vendor's system.

• Vendor will make available the information you need to give an accounting of disclosures under 45 CFR 164.528.

  HIPAA requires45 CFR 164.504(e)(2)(ii)(G) (source, opens in a new tab)

  Patients can ask who received their PHI. Disclosures the vendor made are part of that answer.

• Sets how fast the vendor responds to your requests and what it does with requests patients send it directly.

  Recommended45 CFR 164.524(b)(2) (source, opens in a new tab)

  You must act on an access request within 30 days (one 30-day extension allowed). HHS's sample suggests fixing the vendor's timeframes.

0 of 1 ticked

• Vendor will make its internal practices, books and records on PHI available to HHS to determine your compliance.

  HIPAA requires45 CFR 164.504(e)(2)(ii)(I) (source, opens in a new tab)

  HHS can investigate how your PHI was handled wherever it sits. This clause makes the vendor's records part of that review.

0 of 5 ticked

• Lets you terminate the contract if you determine the vendor has violated a material term.

  HIPAA requires45 CFR 164.504(e)(2)(iii) (source, opens in a new tab)

  If you know of a pattern of material breach, the rule expects you to seek a cure and, failing that, terminate if feasible.

• At termination, vendor returns or destroys all PHI it still holds in any form and keeps no copies, if feasible.

  HIPAA requires45 CFR 164.504(e)(2)(ii)(J) (source, opens in a new tab)

  Ending the contract should end the vendor's hold on your patients' data, including exports and copies outside the main system.

• If return or destruction is infeasible, the BAA's protections continue and use is limited to what made it infeasible.

  HIPAA requires45 CFR 164.504(e)(2)(ii)(J) (source, opens in a new tab)

  For example, another law may require the vendor to keep certain records. Whatever is retained stays protected for as long as it is kept.

• Vendor confirms return or destruction in writing by a set date, including backups once they age out.

  Negotiable45 CFR 164.504(e)(2)(ii)(J) (source, opens in a new tab)

  The rule requires return or destruction 'if feasible' but sets no deadline or proof. A dated written confirmation closes that gap.

• Lets you have PHI returned in a usable format, or sent to a new vendor, when you leave.

  RecommendedHHS Sample BAA Provisions, Term and Termination (c) (source, opens in a new tab)

  HHS's sample BAA notes the agreement could have the vendor transmit PHI to another of your business associates at termination.

0 of 9 ticked

• Sets a breach and incident notice period shorter than HIPAA's 60-day outer limit, as a fixed number of days.

  NegotiableHHS Sample BAA Provisions, Obligations (c) (source, opens in a new tab)

  60 days is a ceiling, not a target. HHS's sample BAA notes the parties may agree a stricter timeframe, which gives you time to investigate.

• Vendor pays breach costs it causes (notices, credit monitoring, forensics) and indemnifies you, outside the liability cap.

  NegotiableCommercial term; not in 45 CFR 164.504(e) (source, opens in a new tab)

  HIPAA does not allocate breach costs between the parties. Without this, a low general liability cap can leave you paying for the vendor's breach.

• Vendor carries cyber liability insurance at a stated minimum and shows proof on request.

  NegotiableCommercial term; not in 45 CFR 164.504(e) (source, opens in a new tab)

  An indemnity is only as good as the vendor's ability to pay. HIPAA says nothing about insurance, so it has to be in the contract.

• You may review security evidence, such as a SOC 2 Type II or HITRUST report, or audit on reasonable notice.

  NegotiableHHS Guidance on HIPAA and Cloud Computing, Q10 (source, opens in a new tab)

  HHS says HIPAA does not require vendors to share security documentation or allow audits, but customers may require it through the BAA.

• Says where PHI is stored and whether staff or subcontractors outside the US can access it.

  NegotiableHHS Guidance on HIPAA and Cloud Computing, Q9 (source, opens in a new tab)

  HHS says HIPAA does not bar storing PHI offshore, but location can change the risk and enforceability, so your risk analysis should cover it.

• States whether the vendor may de-identify your PHI and what it may do with the de-identified data.

  RecommendedHHS Sample BAA Provisions, Permitted Uses (a); 45 CFR 164.514(a)-(c) (source, opens in a new tab)

  De-identified data is no longer PHI, so the BAA stops protecting it once created. HHS's sample says the parties should specify this.

• Bars using your PHI, or data derived from it, to train or improve AI models or products without your written consent.

  Negotiable45 CFR 164.502(a)(3) (source, opens in a new tab)

  A vendor may use PHI only as its BAA permits, so broad 'improve our services' wording is where training rights hide. Narrow it.

• Obligations for PHI the vendor still holds survive termination until it is returned or destroyed.

  RecommendedHHS Sample BAA Provisions, Term and Termination (d) (source, opens in a new tab)

  HHS's sample BAA includes a survival clause so the return, destruction and retention duties outlive the contract itself.

• Changes need both parties' written agreement, apart from updates the law requires.

  NegotiableHHS Sample BAA Provisions, Miscellaneous (b) (source, opens in a new tab)

  HHS's sample has the parties agree to amend for legal changes. A vendor that can rewrite the BAA by editing a web page can narrow it silently.