Business Associate Agreement Checklist for Healthcare Law Firms and Outside Counsel

Determine whether outside counsel is a business associate

Start by identifying who is engaging the law firm and what services the firm will perform. Under HIPAA, a lawyer may be a business associate when providing legal services to a covered entity that involve access to protected health information (PHI). For example, HHS identifies an attorney whose legal services to a health plan involve PHI as a business associate. See the HHS Business Associates guidance.

Do not assume that every lawyer who receives medical records is a business associate. Outside counsel receiving PHI as opposing counsel, a witness, or another recipient in litigation is not necessarily performing services on behalf of the covered entity. A covered entity may disclose PHI in litigation under applicable Privacy Rule conditions without that disclosure alone making the recipient its business associate. See HHS guidance on PHI use and disclosure for litigation.

Record the parties, services, and PHI access in the engagement review. If the firm is acting as a business associate, the covered entity generally needs a written business associate agreement (BAA) before the firm handles PHI for those services. See HHS guidance on covered entities and business associates.

Identify covered PHI and permitted legal services

Describe the work covered by the BAA, such as advising on regulatory matters, conducting internal investigations, responding to audits, or handling litigation for the covered entity. Connect each service to the PHI the firm may need, rather than treating all client information as automatically within scope.

Identify the relevant information and systems, including paper files, electronic records, emails, discovery materials, and any PHI created or received by the firm on the client’s behalf. The BAA should specify the services and permitted uses and disclosures so the parties can distinguish authorized handling from unrelated use. HHS lists these terms among the required elements of a BAA in its sample business associate agreement provisions.

For litigation, separately document the basis for the covered entity’s disclosure where relevant. HIPAA permits certain disclosures for judicial and administrative proceedings under specific conditions; an opposing party’s lawyer does not become the covered entity’s business associate merely by receiving PHI through a permitted disclosure. See HHS guidance on judicial and administrative proceedings.

Define permitted uses and disclosures of PHI

Specify that the law firm may use or disclose PHI only as the BAA permits or as required by law. Identify allowed activities that are necessary to perform the legal services, and prohibit unrelated uses, further disclosures, or use of PHI for the firm’s independent purposes unless HIPAA and the agreement allow them.

Include a process for disclosures required by law, such as responding to a valid court order or other legal process. Clarify who will notify the covered entity, what information the firm must provide, and whether the client must review or approve a response when legally permissible. HIPAA’s rules for litigation disclosures depend on the circumstances and may require specific assurances or other conditions; see HHS’s litigation disclosure guidance.

The BAA should also address requests from individuals, amendments, and accounting information if the firm’s work involves those duties. HHS’s sample BAA provisions describe contractual terms for assisting covered entities with applicable Privacy Rule obligations.

Set minimum necessary access and workforce safeguards

Limit access to the PHI reasonably needed for the legal matter. Define which attorneys, paralegals, investigators, and support personnel may access it, and use matter-based permissions, role-based access, and procedures for promptly removing access when responsibilities change.

The minimum necessary standard generally requires reasonable efforts to limit PHI use, disclosure, and requests to what is needed for the intended purpose, subject to exceptions in the Privacy Rule. HHS explains the standard and its exceptions in its Minimum Necessary Requirement guidance.

Address workforce confidentiality obligations, training on the client’s applicable policies, secure handling of records, and sanctions for violations. A BAA should reflect the parties’ actual procedures; a training completion certificate alone does not establish that the organization or law firm is HIPAA-compliant.

Require HIPAA security and breach reporting controls

For electronic PHI, require safeguards appropriate to the firm’s role and systems, including access management, authentication, secure storage and transmission, workforce procedures, and incident response. The HIPAA Security Rule requires administrative, physical, and technical safeguards for electronic PHI. See the HHS Security Rule overview.

Specify how the firm will report unauthorized uses or disclosures, security incidents, and breaches of unsecured PHI. Include a practical reporting deadline, a contact method, and the information the covered entity needs to investigate and meet its own obligations. HIPAA requires a business associate to notify the covered entity of a breach of unsecured PHI without unreasonable delay and no later than 60 calendar days after discovery; the BAA can set a shorter reporting period to support a prompt investigation. See HHS Breach Notification Rule guidance and HHS sample BAA provisions.

Clarify who will investigate, preserve relevant records, identify affected individuals, mitigate harm, and coordinate required notices. Do not treat the 60-day outside limit as a recommended internal reporting target: the rule also requires notification without unreasonable delay.

Address subcontractors and downstream business associate agreements

List or define the types of subcontractors that may create, receive, maintain, or transmit PHI for the firm, such as e-discovery vendors, document managers, investigators, or litigation support providers. Require the firm to obtain written assurances from each applicable subcontractor that it will follow the same restrictions and conditions for PHI that apply to the firm.

Build a process for assessing a subcontractor’s access, approving it where required by the engagement, documenting the downstream agreement, and promptly reporting incidents involving that vendor. HHS specifically notes that a lawyer-business associate must ensure that subcontractors and others hired to assist with legal services safeguard PHI under the applicable restrictions. See HHS guidance on lawyers and subcontractors.

Establish return or destruction of PHI at termination

Set a termination process that requires the firm, when feasible, to return or destroy PHI received from or created for the covered entity. Specify the method, timing, and confirmation of return or destruction, and address copies held by subcontractors.

If return or destruction is not feasible, the BAA should require the firm to continue protecting the PHI and limit further uses and disclosures to the purpose that makes return or destruction infeasible. These terms are included in HHS’s sample business associate agreement provisions.

In short, an effective checklist ties the BAA to the firm’s actual role, limits PHI access and use, sets clear safeguards and reporting steps, flows protections down to subcontractors, and defines what happens to PHI when the engagement ends.

FAQs

Are healthcare law firms business associates under HIPAA?

Sometimes. A law firm may be a business associate when it provides legal services to a covered entity and those services involve access to PHI. A firm is not automatically a business associate simply because it receives PHI in a legal matter; the relationship and the services being performed matter. See HHS Business Associates guidance.

When must outside counsel sign a business associate agreement?

When the law firm is acting as a business associate by performing services on behalf of a covered entity that involve PHI, the covered entity generally must have a written BAA in place. A lawyer receiving records as opposing counsel or through another permitted litigation disclosure is not necessarily the covered entity’s business associate. See HHS guidance on covered entities and business associates and HHS guidance on judicial and administrative proceedings.

What breach reporting deadlines should a BAA specify?

For a breach of unsecured PHI, HIPAA requires the business associate to notify the covered entity without unreasonable delay and no later than 60 calendar days after discovery. A BAA should state a clear, potentially shorter deadline for the firm to report suspected or confirmed incidents so the covered entity has time to investigate and meet its own obligations. See HHS Breach Notification Rule guidance.

Can a law firm use subcontractors to handle PHI?

Yes, when subcontractors are used to help the firm provide services involving PHI, but the firm must ensure they agree in writing to the same applicable restrictions and conditions for that PHI. This may include e-discovery providers, document managers, investigators, and litigation support personnel. See HHS guidance on lawyers and subcontractors.