After-Hours Nurse Triage Vendor BAA Checklist: Key HIPAA Requirements

When you outsource after-hours nurse triage, the agreement should address how the vendor may use protected health information (PHI), how it must safeguard that information, and what happens if something goes wrong. Use this checklist to review the business associate relationship and identify terms to discuss with your privacy, security, and legal teams.

When does an after-hours nurse triage vendor need a BAA?

A nurse triage vendor generally needs a HIPAA Business Associate Agreement (BAA) when it performs a service on behalf of a HIPAA-covered health plan or provider and, in doing so, creates, receives, maintains, or transmits PHI. The vendor’s role and activities—not simply the fact that it answers calls—determine whether it is a business associate.

A covered entity generally must obtain written assurances from a business associate that it will protect PHI and follow applicable HIPAA requirements. A BAA should be in place before the vendor receives PHI. HIPAA has an exception for certain disclosures from one health care provider to another provider for treatment, so assess the relationship and service arrangement rather than assuming every clinical interaction requires a BAA. See HHS guidance on business associates.

Confirm which entities are involved, whether the vendor acts on your behalf, and what information it handles. If the vendor is a business associate, a general promise to “comply with HIPAA” does not replace the required written contract terms.

Define permitted uses and disclosures of PHI

Describe the vendor’s authorized uses and disclosures in terms specific to triage. For example, the BAA and related service agreement can define how the vendor may use PHI to identify callers, assess their concerns, document calls, provide clinical escalation, and communicate triage outcomes to designated members of your care team.

State that the vendor may not use or disclose PHI beyond the agreement or as required by law. Address whether the vendor may create or retain call recordings, transcripts, or analytics, and whether it may use PHI for any secondary purpose. Don’t assume that permission to perform triage also permits unrelated product development, marketing, or data use. HIPAA requires the BAA to set out permitted and required uses and disclosures. See 45 CFR § 164.504(e).

Define how the vendor will handle requests for PHI and align its access and use with your policies. The minimum necessary standard has exceptions, including certain disclosures to or requests by a health care provider for treatment; therefore, apply the rule to the specific activity rather than treating it as an absolute limit on treatment information. See HHS guidance on business associates and minimum necessary.

Specify administrative, technical, and physical safeguards

Require safeguards appropriate to the PHI the vendor handles, including electronic protected health information (ePHI). The HIPAA Security Rule requires applicable safeguards and Security Rule compliance for ePHI; the BAA should make those obligations clear. See 45 CFR § 164.308, § 164.310, and § 164.312.

• Administrative safeguards: Address risk management, workforce access and training, security incident procedures, and assigned security responsibilities.
• Technical safeguards: Address unique user identification, access controls, audit logging, authentication, integrity protections, and secure transmission of ePHI.
• Physical safeguards: Address physical access to locations and devices, workstation use, and the handling and disposal of media that may contain PHI.

HIPAA’s addressable implementation specifications require an appropriate assessment; they do not mean that every listed technology, such as encryption in every circumstance, is automatically mandatory in the same way. Ask the vendor how it assesses and implements safeguards for the systems, devices, and communication channels used for triage. Avoid treating a security questionnaire or a vendor’s general compliance statement as a substitute for clear contractual commitments.

Require written agreements with subcontractors

Identify whether the vendor uses subcontractors that create, receive, maintain, or transmit PHI—for example, a call-center platform, cloud hosting provider, transcription service, or answering service. The vendor must obtain written assurances from relevant subcontractors that they will accept the applicable restrictions and safeguards. This downstream agreement is commonly called a subcontractor BAA.

Require the vendor to flow down the appropriate PHI protections before giving a subcontractor access. You may also specify what information the vendor must provide about subcontractors, how it will notify you of material changes, and how it will address a subcontractor’s failure to meet its obligations. See HHS guidance on business associate and subcontractor agreements and 45 CFR § 164.504(e).

Set security incident and breach reporting requirements

Require prompt reporting of security incidents and impermissible uses or disclosures, with clear instructions for whom the vendor must contact and what information it should provide. The BAA should distinguish routine security incidents from a breach of unsecured PHI and should explain how the vendor will support investigation, mitigation, and any required notifications.

For a breach of unsecured PHI, a business associate must notify the covered entity without unreasonable delay and no later than 60 calendar days after discovery. That is the federal outer limit, not a recommended target for every contract. You can negotiate a shorter reporting deadline so you have time to assess the incident and meet your own obligations. Specify the initial notice deadline, required follow-up details, and cooperation expected from the vendor. See 45 CFR § 164.410 and the HHS Breach Notification Rule guidance.

Identify PHI handled during triage calls and control access

Document the types of PHI the vendor may encounter during a call, such as a patient’s name and contact details, symptoms, medications, health history, care instructions, or information about the caller’s provider. Depending on the service, PHI may also appear in call recordings, transcripts, voicemails, notes, text messages, escalation records, or system logs.

Match the vendor’s access to its triage duties. Ask how it assigns access by role, authenticates users, records access, removes access when workers leave or change roles, and protects information when staff work remotely. Ensure the vendor can access the information needed to perform the service while avoiding unnecessary access. For ePHI, the Security Rule includes technical access control and audit control requirements. See 45 CFR § 164.312.

Also define how the vendor will document and share triage outcomes, who may receive an escalation, and what approved channels the vendor may use. These operational details help turn general PHI protections into controls suited to your after-hours workflow.

Address PHI return or destruction and termination after a material breach

At the end of the relationship, require the vendor, if feasible, to return or destroy PHI it maintains and retain no copies. If returning or destroying some PHI is infeasible, the agreement should require continued protection and limit further use and disclosure to the reason that makes return or destruction infeasible. Include PHI in all relevant formats, such as recordings, transcripts, backups, and vendor-maintained records. See 45 CFR § 164.504(e)(2)(ii)(J).

Authorize termination if the vendor violates a material term of the BAA. HIPAA also requires a covered entity that knows of a pattern of activity or practice amounting to a material breach or violation to take reasonable steps to cure it or end the violation; if those steps fail, it must terminate the agreement if feasible. Put practical steps in the contract, such as escalation contacts, corrective-action deadlines, suspension of access, and secure transition of the triage service. See HHS guidance on responding to business associate violations.

In short, a well-defined BAA connects the vendor’s triage duties to permitted PHI use, appropriate safeguards, subcontractor controls, incident reporting, and a secure end to the relationship.

FAQs

Does an after-hours nurse triage service need a BAA?

Generally, yes, if the service performs work on behalf of a HIPAA-covered provider or health plan and creates, receives, maintains, or transmits PHI as part of that work. The specific relationship matters, and certain provider-to-provider treatment disclosures are excepted from the business associate contract requirement. Assess the vendor’s role and activities before sharing PHI.

What PHI can be shared with a nurse triage vendor?

Share information the vendor is permitted to use under the BAA and needs to perform the triage service, such as relevant identity and contact details, symptoms, medication information, or pertinent care history. Define the permitted information and purpose in the agreement, and consider how recordings, transcripts, notes, and escalation messages will be handled.

What security safeguards should a triage vendor’s BAA address?

Address safeguards for ePHI and other PHI the vendor handles, including workforce and risk-management practices, role-appropriate access, authentication, audit logging, physical protections, secure transmission, incident response, and secure disposal. The precise safeguards should fit the vendor’s systems and the information involved and comply with applicable HIPAA Security Rule requirements.

How quickly must a nurse triage vendor report a breach?

For a breach of unsecured PHI, federal HIPAA rules require the business associate to notify the covered entity without unreasonable delay and no later than 60 calendar days after discovery. A BAA can set a shorter deadline, and a shorter contractual timeline may give the covered entity more time to investigate and meet its own notification duties.