Business Associate Agreement Checklist for Clinical AV and Telepresence Integrators

A business associate agreement (BAA) should reflect how your clinical AV or telepresence service actually handles protected health information (PHI)—not just the equipment being installed. Use this checklist to identify when a BAA is needed and the terms to address with a healthcare customer.

When Does a Clinical AV or Telepresence Integrator Need a BAA?

You generally need a BAA when a healthcare provider or other HIPAA covered entity engages your company to provide a service that involves creating, receiving, maintaining, or transmitting PHI on its behalf. The agreement should be in place before the customer allows your company to access PHI.

For example, a BAA may be needed if your work includes remotely troubleshooting a telepresence system that displays patient information, maintaining systems that store or transmit ePHI, or servicing equipment where the contracted work gives your technicians access to PHI. HHS specifically identifies IT support vendors and technicians servicing devices that store PHI as potential business associates. The HHS Business Associates guidance explains these examples.

Selling or installing equipment alone does not automatically make you a business associate if your service does not involve access to PHI. HHS also recognizes a limited exception for services whose functions do not involve PHI and where any access would be incidental, if at all, with reasonable safeguards in place. A transmission-only conduit may also fall outside the business associate definition, but the exception is narrow and does not generally cover persistent storage or routine access. See the HHS software-vendor FAQ and HHS conduit guidance.

Define Permitted PHI Uses and Disclosures

Describe the specific services the integrator will perform and the PHI uses and disclosures reasonably necessary to perform them. For example, the agreement might allow authorized technicians to access a patient-facing display or system logs when diagnosing a documented service issue, while prohibiting unrelated viewing, copying, or use.

Set boundaries for who may access PHI, the purposes for access, and whether any further disclosure is permitted. The BAA must not authorize uses or disclosures that would violate HIPAA if performed by the covered entity. HHS explains that business associate agreements must establish permitted and required uses and disclosures and limit them in line with applicable Privacy Rule requirements in its minimum-necessary guidance.

Make clear that product improvement, analytics, demonstrations, or training do not automatically authorize use of identifiable PHI. If a proposed use is not needed for the contracted service or otherwise permitted by law and the agreement, do not assume it is allowed.

Specify Safeguards and Incident Reporting Duties

Identify safeguards appropriate to the systems and work involved. Address access controls, unique user accounts, authentication, secure remote support, encryption where appropriate, workforce training, audit logging, secure configuration, and procedures for protecting PHI on service laptops, removable media, and temporary diagnostic files. HIPAA requires applicable safeguards for ePHI; the HHS Security Rule summary outlines the business associate agreement’s security and incident-reporting requirements.

Require prompt reporting of security incidents and suspected or confirmed impermissible uses or disclosures. Specify a practical contractual deadline, a contact method, and the initial details to provide—such as when the event was discovered, affected systems, PHI potentially involved, containment steps, and updates as facts develop.

Distinguish a general security incident from a breach of unsecured PHI. HIPAA requires a business associate to notify the covered entity of a breach of unsecured PHI without unreasonable delay and no later than 60 calendar days after discovery. The parties may agree to a shorter reporting deadline so the covered entity has time to assess and meet its own notification duties. See the HHS breach-notification requirements and HHS model BAA.

Set Subcontractor Requirements for PHI Handling

Identify the types of subcontractors that may handle PHI, such as cloud-hosting providers, remote-support vendors, equipment service partners, or platform providers. Require approval or notice as negotiated, and keep a current record of the subcontractors and the PHI-related services they provide.

Before a subcontractor creates, receives, maintains, or transmits PHI on your company’s behalf, require a written agreement that imposes the applicable HIPAA restrictions and safeguards. These subcontractor flow-down obligations apply through the business associate chain; the integrator remains responsible for establishing the required written assurances with its PHI-handling subcontractors. The HHS Business Associates guidance describes the requirement.

Address Patient Access, Amendments, and Disclosure Accounting

Specify how you will help the covered entity respond to patient requests involving PHI held by the integrator. The contract should explain how and when you will make relevant PHI available, support amendments to PHI in a designated record set, and provide information needed for an accounting of disclosures when applicable.

The covered entity remains responsible for fulfilling HIPAA rights to access, amendment, and accounting, but its BAA must require the business associate to provide necessary assistance. The parties can agree that the business associate will respond directly in appropriate circumstances; otherwise, the integrator should route requests to the customer promptly and preserve the information needed to support the response. See the HHS guidance on business associates and individual rights.

Define the request-routing contact, response time, format, and escalation process. For accounting of disclosures, clarify what information the integrator must maintain and provide; do not treat every technical log entry as automatically subject to an accounting. The HHS sample BAA provisions offer language for access, amendments, and disclosure accounting.

Define Records Access and Agreement Termination

Include the required provision making the integrator’s internal practices, books, and records relating to PHI available to the Secretary of HHS for purposes of determining HIPAA compliance. Separately, the parties can negotiate customer audit cooperation, evidence of safeguards, and access to service records. The HHS sample BAA provisions distinguish the Secretary’s records access from other terms the parties may negotiate.

Explain what happens to PHI when the agreement or service ends. The BAA must provide for PHI to be returned or destroyed when feasible. If return or destruction is infeasible, the agreement must extend its protections to the retained PHI and limit further uses and disclosures to the purposes that make return or destruction infeasible. Specify a usable return format, secure transfer method, destruction process, and how PHI held by subcontractors will be handled. HHS summarizes these requirements in its guidance on PHI retention after services end.

Inventory Telepresence Data and Integrator Access

Before drafting the BAA, map the systems and data involved in the service. Consider whether any of the following could contain or expose PHI:

• Live video or audio from patient encounters, including recordings or stored clips.
• Patient names, appointment details, room assignments, or other identifying information displayed on screens.
• Call metadata, session histories, device names, or support tickets linked to a patient or encounter.
• System logs, screenshots, diagnostic files, backups, and configuration exports.
• Credentials, remote-support tools, administrator accounts, and subcontractor access paths.

For each data type, document where it is created, transmitted, stored, and deleted; who can access it; and whether the integrator or a subcontractor can view or maintain it. Treat the inventory as a practical scoping tool, not a substitute for assessing whether information meets HIPAA’s definition of PHI. A BAA may be required for a vendor that maintains ePHI even if the data is encrypted and the vendor cannot view it, as explained in HHS conduit guidance.

In short, a useful checklist connects the integrator’s actual access and data flows to clear permitted uses, safeguards, reporting duties, subcontractor flow-down obligations, patient-rights support, records access, and PHI return or destruction terms.

FAQs.

When does a clinical AV integrator need a business associate agreement?

A clinical AV integrator generally needs a BAA before a covered entity allows it to provide a service involving PHI—for example, remote troubleshooting that requires access to patient information or maintaining systems that store or transmit ePHI. Equipment sales or work with only incidental access may not create a business associate relationship; assess the actual service and access involved.

Which telepresence data should a BAA cover?

Cover PHI handled in live or recorded audio and video, patient-identifying displays, call and session metadata, support tickets, logs, diagnostic files, backups, and any other information the integrator creates, receives, maintains, or transmits for the customer. Include data held or accessed by subcontractors.

What incident reporting duties should the agreement specify?

Specify how quickly the integrator must report security incidents, suspected impermissible uses or disclosures, and breaches of unsecured PHI; whom to notify; what initial facts to provide; and how the integrator will investigate, mitigate, preserve relevant records, and send updates. HIPAA sets a maximum of 60 calendar days after discovery for reporting a breach of unsecured PHI to the covered entity, while the BAA may set a shorter deadline.

What should happen to PHI when the BAA ends?

The agreement should require the integrator to return or destroy PHI when feasible and address PHI held by subcontractors. If return or destruction is infeasible, the agreement must continue the required protections and restrict further uses and disclosures to the purposes that make return or destruction infeasible. Specify the transfer format, secure process, and any confirmation of destruction.