Business Associate Agreement Checklist for Continuous Glucose Monitor Data Platforms

When a continuous glucose monitor (CGM) platform handles data for a healthcare organization, a business associate agreement (BAA) can help define who may use that information, how it must be protected, and what happens if the relationship ends. Use this checklist to assess the platform’s role, data flows, subcontractors, and tracking technologies.

Determine whether CGM platform vendors and subcontractors are business associates

Start with the relationship and the data flow—not the vendor’s product label. A vendor is generally a business associate when it creates, receives, maintains, or transmits protected health information (PHI) on behalf of a HIPAA covered entity to perform a service or function. A subcontractor can also be a business associate when it handles PHI on behalf of another business associate. HHS guidance on business associates

• Map which parties collect, transmit, store, analyze, or support CGM data—including the platform, cloud host, analytics provider, and support vendors.
• Identify whether each party handles data for a covered entity or business associate, or instead provides a consumer-facing service directly to individuals.
• Document what identifiers accompany glucose readings, insulin doses, alerts, and account details. Identifiable health information handled in a HIPAA-regulated relationship may be PHI.
• Confirm that a required BAA is signed before the vendor receives PHI.

A consumer’s use of an app, or a person’s health data in isolation, does not automatically make the app vendor a business associate. The vendor’s role and whether it handles the information on behalf of a covered entity matter. HHS guidance on health apps and APIs

Define permitted PHI uses and minimum-necessary disclosures

Specify the services the CGM platform will perform and the PHI uses and disclosures needed for those services. Prohibit independent uses—such as advertising, sale, or unrelated profiling—unless a specific legal permission or valid authorization applies. HHS identifies defining permitted and required uses and disclosures as a core BAA term. HHS sample business associate contract provisions

Address the minimum necessary standard by limiting access and disclosure to what is reasonably needed for the purpose. For example, a support team may need account and device details to troubleshoot a sync problem, while a reporting function may need a defined set of readings rather than an entire patient record. The Privacy Rule has exceptions to this standard, including certain disclosures for treatment, so describe the rule accurately rather than applying it to every data exchange. HHS guidance on the minimum necessary requirement

• List permitted service functions, such as data hosting, transmission, monitoring, analytics, or technical support.
• Set limits on workforce access, data retention, and use of CGM data for product development or analytics.
• Require the vendor to obtain approval or another documented permission before making a new use or disclosure.
• Describe how the vendor will support individual rights requests when assigned that responsibility.

Require safeguards and timely incident and breach reporting

Require safeguards appropriate to the electronic PHI (ePHI) involved and the risks of the platform. HIPAA’s Security Rule requires regulated entities to assess risks and implement reasonable and appropriate measures to protect ePHI; the appropriate measures depend on the organization and its environment. HHS guidance on Security Rule risk analysis

Cover administrative, physical, and technical protections relevant to the service, such as access controls, authentication, audit logging, secure transmission, backup and recovery, workforce training, and vulnerability management. Ask the vendor to explain how its controls apply to CGM readings, insulin-dose records, account identifiers, and connected integrations; do not treat a general assurance or certification claim as a substitute for reviewing the actual safeguards.

Require the vendor to report security incidents and unauthorized uses or disclosures promptly, with enough detail for the covered entity to investigate and respond. Set a contractual deadline that allows the covered entity time to assess the event and meet its own obligations. Under the HIPAA Breach Notification Rule, a business associate must notify the covered entity of a breach of unsecured PHI without unreasonable delay and no later than 60 days after discovery; that outer limit is not a recommended incident-response target. HHS Breach Notification Rule guidance

• Define what counts as a reportable security incident, suspected breach, or unauthorized disclosure.
• Require timely initial notice, follow-up details, cooperation with investigation, and preservation of relevant records.
• Specify how the vendor will help identify affected individuals and provide information needed for any required notifications.

Flow privacy and security obligations down to subcontractors

Require the platform vendor to identify subcontractors that may handle PHI and to bind each such subcontractor to the applicable restrictions and conditions in the BAA. HIPAA requires a business associate to obtain these written assurances from a subcontractor that creates, receives, maintains, or transmits PHI on its behalf. The covered entity generally does not need to sign a separate BAA directly with each downstream subcontractor. HHS business associate FAQs

• Request a current list of relevant subcontractors and the services each provides.
• Require advance notice of material changes and a way to object to or address new subcontractors.
• Require downstream agreements to cover permitted PHI uses, safeguards, incident reporting, and return or destruction.
• Require the platform vendor to remain accountable for its subcontractors’ handling of PHI.

Specify termination rights and PHI return or destruction

State what happens to PHI when the BAA or underlying service agreement ends. HIPAA’s required BAA terms call for the business associate, if feasible, to return or destroy PHI received from or created on behalf of the covered entity. If return or destruction is infeasible, the agreement must extend protections to the retained information and limit further uses and disclosures to the reasons that make return or destruction infeasible. HHS sample business associate contract provisions

Specify the process and timing for returning or securely destroying production data, copies, and subcontractor-held information. Address backups and other systems where immediate deletion may not be technically feasible, including how long data remains, who can access it, and when it will be deleted. Include termination rights for a material breach and a practical process for transition to another platform.

Assess consumer app coverage and data flows outside HIPAA

Map how CGM data moves between the device, manufacturer services, healthcare organization, platform, and any app selected by the individual. A vendor that handles PHI on behalf of a covered entity may be a business associate; an app that receives information at an individual’s direction is not automatically one. HHS explains that an app’s facilitation of access at the individual’s request alone does not create a business associate relationship. HHS FAQ on apps designated by individuals

Information received by an app that is neither a covered entity nor a business associate may fall outside HIPAA’s protections once it reaches that app. That does not mean the information is unregulated: depending on the service and its role, the Federal Trade Commission’s Health Breach Notification Rule or other laws may apply. FTC guidance on the Health Breach Notification Rule

• Separate data handled for a healthcare organization from data collected directly for a consumer-facing service.
• Identify where users connect third-party apps or authorize exports, and explain what protections apply after transfer.
• Review privacy notices, consent flows, and applicable breach-response responsibilities for data outside HIPAA.

Review online tracking disclosures and required permissions

Check whether pixels, cookies, software development kits, or other tracking technologies can access CGM data or information linked to an individual’s health. If a tracking vendor receives PHI on behalf of a covered entity or business associate, assess whether the disclosure is permitted and whether the vendor must sign a BAA. HHS says a cookie banner that asks users to accept or reject tracking does not constitute a valid HIPAA authorization. HHS guidance on online tracking technologies

• Inventory tracking technologies in logged-in dashboards, mobile apps, appointment flows, and other relevant interfaces.
• Determine what data each tool receives, including identifiers, device details, glucose readings, and page or event information.
• Disable or configure tools to prevent impermissible PHI disclosures, and document any applicable permission or authorization.

HHS’s tracking guidance notes that a court vacated a portion concerning certain IP-address disclosures associated with visits to unauthenticated public webpages. Assess the actual CGM platform data flow rather than assuming every website visit presents the same HIPAA issue. HHS online tracking guidance and update

In short, evaluate each party’s role, narrowly define permitted data uses, verify safeguards and reporting procedures, bind subcontractors, and plan for data disposition and tracking. Trace CGM information across both healthcare and consumer-facing systems so you can determine where a BAA applies and where other privacy rules may govern.

FAQs

Do CGM glucose readings and insulin doses qualify as PHI?

They can qualify as PHI when they are identifiable health information held or handled by a HIPAA covered entity or business associate in a HIPAA-regulated context. The readings or doses alone do not automatically make every consumer app or device company subject to HIPAA.

When does a CGM platform vendor need a BAA?

A vendor generally needs a BAA when it creates, receives, maintains, or transmits PHI on behalf of a covered entity to perform a service or function. Whether a BAA is needed depends on the vendor’s role and relationship—not simply on whether its technology processes health data.

Must subcontractors that handle CGM data sign agreements?

When a subcontractor creates, receives, maintains, or transmits PHI on behalf of a business associate, the business associate must obtain a written agreement requiring the applicable privacy and security protections. The covered entity generally does not need to contract directly with each downstream subcontractor.

Does a cookie banner authorize disclosing PHI to tracking vendors?

No. A cookie banner that asks users to accept or reject tracking is not, by itself, a valid HIPAA authorization. Determine whether the tracking tool receives PHI, whether the disclosure is otherwise permitted, and whether a BAA and any required authorization are in place.