Business Associate Agreement Checklist for Accountable Care Organizations and Data Vendors

An ACO’s vendor agreement should do more than name HIPAA. It should specify what protected health information (PHI) the vendor may handle, the purposes it may use it for, and how the parties will manage security, individual rights, subcontractors, and the end of the relationship.

First confirm each party’s role. An ACO is not automatically a HIPAA covered entity; depending on the data flow and services, it may be a covered entity, a business associate, or neither. A vendor that performs services involving PHI on behalf of a covered entity or business associate may need a business associate agreement (BAA) at the relevant point in that chain. HHS’s business associate contract guidance outlines the required provisions.

Define permitted PHI uses and disclosures

Describe the vendor’s services and identify the PHI it may receive, create, maintain, or transmit. Define the purposes for which it may use or disclose that information, such as a specified care-coordination, quality-improvement, or survey function, and prohibit uses outside the agreement unless permitted by law.

Set boundaries for redisclosure, data aggregation, and the vendor’s own management or legal activities. Do not allow broad language that could be read to permit unrelated analytics, marketing, sale, or reuse of identifiable data. The BAA cannot authorize a use or disclosure that would violate the HIPAA Privacy Rule if the covered entity made it. 45 CFR § 164.504 describes these contract requirements.

Specify which data fields and users are needed for the service, and apply the minimum necessary standard where it applies. HIPAA has exceptions, including certain disclosures made pursuant to an individual’s authorization and disclosures to a health care provider for treatment, so avoid treating minimum necessary as a blanket rule for every exchange. HHS minimum-necessary guidance explains the standard and its exceptions.

Specify safeguards and incident and breach reporting duties

Require appropriate safeguards for PHI and, where applicable, compliance with the HIPAA Security Rule for electronic PHI. Spell out how the vendor will report impermissible uses or disclosures, suspected or known security incidents, and breaches of unsecured PHI; identify the reporting contacts and the information the vendor must provide.

HIPAA requires a business associate to notify the covered entity of a breach of unsecured PHI without unreasonable delay and no later than 60 calendar days after discovery. That is an outside legal limit, not necessarily a practical response window for an ACO. Set a shorter contractual deadline for initial notice, followed by updates as the investigation develops. 45 CFR § 164.410 sets the breach-notification rule.

Require prompt cooperation with investigation, containment, mitigation, and any required notifications. The agreement should identify who assesses the event, who prepares notices, how affected individuals are identified, and who bears the agreed costs. Do not assume that the vendor’s notice to the ACO fulfills every notification duty the covered entity may have.

Set requirements for subcontractors handling PHI

Require the vendor to ensure that each subcontractor that creates, receives, maintains, or transmits PHI on its behalf accepts the same applicable restrictions and conditions. These subcontractor flow-down obligations should reach vendors supporting hosting, storage, analytics, support, mailing, and other services involving PHI.

Require the primary vendor to track relevant subcontractors, oversee their compliance, and pass incident-reporting and end-of-contract duties down the chain. Consider requiring advance notice or approval for material subcontractor changes so the ACO can assess new access or risk. HHS explains that contracts between business associates and their business associate subcontractors are subject to the same applicable contract requirements. HHS business associate guidance provides further detail.

Cover individual access amendment and accounting requests

Set a clear process for the vendor to help the covered entity respond to individuals’ requests to access PHI, request amendments, or receive an accounting of certain disclosures. Specify where the vendor sends requests it receives directly, how quickly it must provide records or supporting information, and how it will implement an approved amendment.

The covered entity remains responsible for fulfilling applicable Privacy Rule duties, but the BAA must require the business associate to make the relevant PHI available and assist as needed. If the vendor is the only holder of some records, the parties can agree that it will respond directly to individuals. HHS guidance on individual rights and business associates explains these arrangements.

Address termination and PHI return or destruction

Provide for termination if the vendor materially violates the agreement, and define any notice-and-cure process the parties choose to use. HIPAA requires the contract to authorize termination for a material violation; when a covered entity knows of a material breach or violation, the rules also require reasonable steps to cure it or end the violation and, if unsuccessful, termination when feasible. See 45 CFR § 164.504.

At termination, require the vendor to return or destroy PHI if feasible, including PHI held by subcontractors, and describe how it will document completion. If return or destruction is infeasible, define which PHI may be retained, limit further use and disclosure to the purpose that makes disposal infeasible, and require safeguards for as long as it remains in the vendor’s possession. HHS’s sample BAA provisions describe these options.

Review vendor security controls and workforce practices

Assess how the vendor protects PHI in the systems and workflows used for your services. Ask for evidence of its security risk analysis and risk-management practices, access controls, activity reviews, incident-response process, and workforce security and training procedures. HIPAA requires risk-based security measures; the specific controls should reflect the data, system, and risk involved. 45 CFR § 164.308 covers administrative safeguards.

Make the agreement specific about any controls the parties expect, such as role-based access, authentication, encryption, logging, secure data transfer, and secure disposal. Treat these as contractual requirements tailored to the service, rather than assuming that every particular technology is expressly mandated in the same way for every vendor.

Include the required right for the Secretary of HHS to access the vendor’s internal practices, books, and records relating to PHI when needed to determine the covered entity’s HIPAA compliance. This HHS access to books and records clause is a regulatory contract requirement, not simply an optional audit right for the ACO. The parties may also define separate operational audit or evidence-review rights.

Confirm data access authorization for ACO survey vendors

For an ACO survey vendor, identify who engages the vendor, which organization supplies the sample or contact information, what data the vendor receives, and where the results go. The applicable CMS process may impose program-specific steps in addition to the BAA. For example, CMS states that Shared Savings Program ACOs must contract with a CMS-approved vendor for the CAHPS for MIPS Survey and authorize that vendor to collect and report survey data to CMS. CMS CAHPS for MIPS Survey guidance describes that process.

Document the permitted survey purpose, the approved data elements, the handling of contact and response data, and any applicable CMS data-use authorization terms. A CMS vendor authorization or data-use authorization is not automatically the same thing as an individual HIPAA authorization. Confirm the legal basis for the data flow and the parties’ HIPAA roles before transferring identifiable data; use an individual authorization when required for the proposed use or disclosure.

A sound ACO vendor agreement connects a clearly limited data purpose to enforceable safeguards, reporting, subcontractor, individual-rights, and termination duties. Confirm that the CMS survey authorization and any data-use terms also match the actual data flow, rather than relying on a generic BAA alone.

FAQs

What PHI uses and disclosures should an ACO vendor agreement permit?

Permit only the uses and disclosures needed for the defined services, plus any additional uses the agreement and HIPAA rules specifically allow. Identify the data and recipients, restrict further disclosure, and apply the minimum necessary standard where it applies. See 45 CFR § 164.504 and HHS minimum-necessary guidance.

What incident and breach reporting duties should the agreement include?

Require notice of impermissible uses or disclosures, security incidents, and breaches of unsecured PHI; set a prompt contractual reporting deadline and require facts, affected-person information as available, investigation updates, mitigation, and cooperation with notifications. HIPAA sets an outside limit of 60 calendar days after breach discovery for business-associate notice to the covered entity, without unreasonable delay. 45 CFR § 164.410.

Must subcontractors handling ACO PHI sign business associate agreements?

When a subcontractor creates, receives, maintains, or transmits PHI on behalf of a business associate, the business associate must ensure that the subcontractor agrees to the same applicable restrictions and conditions. The provisions may be in a separate BAA or another agreement that meets HIPAA’s requirements. HHS business associate guidance.

When may an ACO terminate the agreement and require PHI return or destruction?

The agreement must authorize termination if the business associate materially violates its terms. At termination, the business associate must return or destroy PHI if feasible; if that is infeasible, the agreement should limit further use and disclosure and require continuing safeguards for retained PHI. HHS sample BAA provisions.