Business Associate Agreement Checklist for Clinical Documentation Improvement Consultants

Use this checklist to review the business associate agreement (BAA) before a clinical documentation improvement (CDI) consultant handles protected health information (PHI). The agreement should match the consultant’s actual work, limit access to what that work requires, and set clear responsibilities for protecting and handling PHI.

When does a CDI consultant need a business associate agreement?

A CDI consultant generally needs a BAA when the consultant is not part of a covered entity’s workforce and performs services on its behalf that involve creating, receiving, maintaining, or transmitting PHI. Reviewing records for documentation gaps, coding accuracy, or clinical documentation improvement may fit this description, depending on the arrangement. See HHS guidance on business associates.

Confirm the consultant’s role before PHI access begins. The BAA requirement does not apply to every disclosure: for example, HIPAA does not require a BAA for a covered entity’s disclosure to a health care provider for treatment. The parties should assess the actual purpose and relationship rather than rely only on a job title. See HHS guidance on provider disclosures for treatment.

• Identify the covered entity, consultant, services, and PHI involved.
• Confirm whether the consultant is a business associate or a member of the covered entity’s workforce.
• Put the required written agreement in place before disclosing PHI for business-associate services.
• Make sure the BAA supplements, rather than conflicts with, the services agreement and the covered entity’s policies.

Define permitted uses and disclosures of PHI

Describe the CDI work the consultant may perform with PHI, such as reviewing clinical records, identifying documentation opportunities, preparing permitted reports, and communicating findings to designated personnel. The BAA should state that the consultant may use or disclose PHI only as the agreement permits or as law requires. HIPAA business associate requirements do not permit open-ended use of PHI for unrelated purposes. See 45 CFR § 164.504 and HHS sample BAA provisions.

• Specify the purpose, scope, and duration of access, including whether the consultant may create workpapers or reports containing PHI.
• Prohibit use for the consultant’s independent purposes, marketing, or unrelated client work.
• Require the consultant to follow the covered entity’s instructions and applicable privacy policies.
• Address any narrowly permitted disclosures, such as disclosures required by law, and require advance notice to the covered entity when legally permitted.

Set safeguards and incident reporting requirements

The BAA must require appropriate safeguards against uses or disclosures not allowed by the agreement, including applicable HIPAA Security Rule protections for electronic PHI (ePHI). The HIPAA Security Rule requires regulated entities to assess risks to ePHI and implement security measures to reduce those risks to a reasonable and appropriate level. See 45 CFR § 164.308 and 45 CFR § 164.312.

• Set access controls so each consultant can reach only the PHI and systems needed for assigned work.
• Address workforce training, secure devices and storage, account management, and safeguards for transmitting PHI.
• Require prompt reporting of unauthorized use or disclosure, security incidents, and suspected breaches, with a named contact and reporting method.
• Specify what an incident report should include, such as the known facts, affected information and individuals, containment steps, and updates as the investigation proceeds.

Under HIPAA, a business associate must notify the covered entity of a breach of unsecured PHI without unreasonable delay and no later than 60 calendar days after discovery. That is an outside federal limit, not a recommended operational target; the parties can set a shorter reporting deadline in the BAA so the covered entity has time to investigate and meet its own obligations. See 45 CFR § 164.410 and the HHS Breach Notification Rule guidance.

Specify support for individual rights requests

HIPAA gives individuals rights concerning PHI in a designated record set, including access and amendment rights. The BAA should explain how the consultant will help the covered entity respond to access amendment and accounting requests when the consultant holds, maintains, or uses relevant PHI. The agreement can specify whether the consultant will send records or information to the covered entity, respond directly when instructed, or carry out another defined task. See 45 CFR § 164.504 and HHS guidance on access to PHI held by a business associate.

• Set a process and timeline for forwarding requests received directly by the consultant to the covered entity.
• Require timely retrieval and delivery of PHI needed for access requests.
• Explain how the consultant will make PHI available for amendments and incorporate amendments when directed.
• Require the consultant to record and provide information about relevant disclosures so the covered entity can prepare an accounting when required.

The covered entity remains responsible for its HIPAA obligations, and the BAA should give it enough time and cooperation to respond within applicable deadlines. HHS explains that an individual’s access right extends to PHI in a designated record set maintained by a business associate on behalf of a covered entity.

Document compliance and access to records

The agreement should require the consultant to make internal practices, books, and records relating to PHI available to HHS for purposes of determining the covered entity’s compliance with the HIPAA Privacy Rule. See 45 CFR § 164.504.

For practical compliance review access, the parties may also agree on what security documentation the consultant will provide, how the covered entity can review compliance, and how reviews will protect other clients’ confidential information. These review procedures can be useful contractual terms; they should not be described as a universal HIPAA requirement for the covered entity to routinely monitor the consultant. See HHS guidance on covered entities and business associate oversight.

• Identify records the consultant must preserve, such as access logs, incident reports, and documentation of PHI disclosures.
• Set a process for providing relevant records to the covered entity and HHS when required.
• Consider defining reasonable notice, scope, and confidentiality protections for any additional client review or assessment rights.

Require equivalent protections from subcontractors

If the CDI consultant engages a subcontractor that creates, receives, maintains, or transmits PHI on the consultant’s behalf, the consultant must ensure that the subcontractor agrees in writing to the same restrictions and conditions that apply to the consultant for that PHI. The consultant should have the subcontractor business associate agreement in place before sharing PHI with that subcontractor. See HHS business associate guidance and 45 CFR § 164.504.

• Require the consultant to identify subcontractors that may handle PHI and describe their roles.
• Require written agreements that flow down the applicable privacy and security obligations.
• Require the consultant to address subcontractor incidents and noncompliance, including corrective action or termination when necessary.

Plan for termination and PHI disposition

The BAA should require the consultant, when the agreement ends, to return or destroy PHI received from or created or received on behalf of the covered entity, if feasible. If return or destruction is not feasible, the agreement must extend its protections to the PHI and limit further uses and disclosures to the reasons that make return or destruction infeasible. See 45 CFR § 164.504.

• Set a deadline and method for PHI return or destruction, including copies held in workpapers or approved storage.
• Require written confirmation of completed return or destruction when appropriate.
• Address any PHI that must be retained and specify how it will remain protected and restricted.
• Provide for ending the consultant’s system access and recovering any covered entity devices or credentials.

In short, a strong BAA defines the consultant’s permitted work, safeguards PHI, assigns incident and individual-rights support duties, covers subcontractors, and sets a clear process for ending access and disposing of PHI.

FAQs

Must a clinical documentation improvement consultant sign a BAA before accessing PHI?

If the consultant is a business associate performing CDI services on behalf of a covered entity that involve PHI, the parties generally need a written BAA before PHI is disclosed for those services. The requirement depends on the consultant’s role and purpose; workforce members and certain disclosures, such as disclosures to a health care provider for treatment, are treated differently under HIPAA. See HHS business associate guidance.

What PHI uses and disclosures should a CDI consultant’s BAA permit?

Permit only uses and disclosures needed to perform the defined CDI services, such as reviewing clinical documentation and reporting findings to authorized personnel. The agreement should prohibit unrelated use or disclosure except where permitted by law, and it should clearly address any specific additional use the parties authorize.

What safeguards and breach reporting duties should the agreement include?

The BAA should require appropriate safeguards, including applicable Security Rule protections for ePHI, and reporting of unauthorized uses or disclosures, security incidents, and breaches. For a breach of unsecured PHI, HIPAA requires notice to the covered entity without unreasonable delay and no later than 60 calendar days after discovery; the parties may set a shorter contractual deadline. See 45 CFR § 164.410.

How should PHI be handled when the BAA ends?

The BAA should require the consultant to return or destroy PHI when feasible. If that is not feasible, the consultant must continue protecting the PHI and restrict further use or disclosure to the circumstances that prevent its return or destruction. The agreement should also cover termination of system access and any required retention. See 45 CFR § 164.504.