Business Associate Agreement Checklist for Litigation Support and E-Discovery Vendors

A business associate agreement (BAA) defines how a vendor may handle protected health information (PHI) for a HIPAA-regulated client. For litigation support and e-discovery, a useful BAA should do more than promise confidentiality: it should describe permitted casework, safeguards, incident reporting, subcontractors, individual-rights support, and what happens to PHI when the work ends.

Use this checklist to assess the relationship and data flow. The HIPAA requirements depend on the parties’ roles and the services involved, so distinguish mandatory contract terms from additional protections the parties choose to negotiate.

When does a litigation support or e-discovery vendor need a BAA?

A vendor generally needs a BAA when it performs services on behalf of a covered entity—or on behalf of another business associate—and, as part of that work, creates, receives, maintains, or transmits PHI. The HIPAA business associate definition can cover a litigation support provider that handles PHI to help a covered entity or its business associate provide legal services. HHS specifically identifies document or file managers and litigation support personnel as examples of a lawyer-business associate’s subcontractors who may need written HIPAA terms. HHS Business Associates guidance and HHS guidance on lawyers and litigation support personnel.

Whether the vendor can actually access PHI matters. A company that merely sells software, with no access to the PHI, does not become a business associate solely because a covered entity uses its product. By contrast, hosting data or accessing it during troubleshooting may create a business associate relationship. HHS guidance on software vendors.

Do not assume that every e-discovery vendor involved in a lawsuit needs a BAA just because the collection contains health information. Identify who engaged the vendor, whose behalf it is acting on, and whether it handles PHI to perform that party’s services. A vendor engaged by a business associate to help deliver services to a covered entity may be a downstream business associate; a vendor’s role in a dispute alone does not answer the question.

Define permitted PHI uses and disclosures

Describe the services and case-related purposes for which the vendor may use PHI. For example, the agreement may permit collection, preservation, processing, hosting, indexing, search, review, redaction, and authorized production of data for the identified matter. Match permissions to the actual workflow and client instructions rather than granting a broad right to use PHI for any business purpose.

The BAA must establish permitted and required uses and disclosures, and must restrict use or further disclosure to what the agreement permits, what the law requires, or what HIPAA otherwise allows. It should also address any permitted disclosure for the vendor’s proper management and administration, if applicable. HHS sample business associate agreement provisions.

Specify how the vendor will handle data minimization, de-identification, redaction, and production instructions when those measures are appropriate to the matter. HIPAA’s minimum-necessary requirements may apply to relevant uses and disclosures; litigation relevance alone does not automatically mean every responsive health detail should be shared. HHS notes that counsel handling PHI should consider limiting it to the minimum necessary and using protections such as redaction or a protective order where appropriate. HHS guidance on PHI in legal proceedings.

Also state that the vendor may not use PHI for unrelated analytics, product development, advertising, or model training unless a separate, lawful basis and appropriate authorization expressly permit that use. Spell out who can approve a new use or disclosure and how the approval must be documented.

Set safeguards and incident-reporting requirements

Require safeguards appropriate to the PHI and the services, including administrative, physical, and technical controls for electronic PHI. Contract terms can address role-based access, workforce training, secure transfer, encryption, logging, retention controls, backup, and secure disposal. These are practical items to specify; the HIPAA Security Rule requires applicable safeguards but does not make every contract checklist item a universal, one-size-fits-all technical mandate. HHS sample BAA provisions and HHS Business Associates guidance.

Define how the vendor will report security incidents, unauthorized uses or disclosures, and suspected loss or exposure of PHI. Identify the reporting contact, required details, cooperation obligations, and update process. A contract may set a shorter reporting deadline than the outside time allowed by the Breach Notification Rule so the client has time to investigate and meet its own obligations.

HIPAA requires a business associate to notify the covered entity after discovering a breach of unsecured PHI without unreasonable delay and no later than 60 calendar days after discovery. That is a legal outside limit—not a recommended response target for a litigation data incident. HHS Breach Notification Rule guidance.

Require written flow-down terms for subcontractors

Identify which providers may handle PHI, such as hosting services, forensic collection teams, review-platform providers, or other technical vendors. Before disclosing PHI to a downstream business associate, the business associate must obtain written assurances that the subcontractor will apply the required restrictions and safeguards. For electronic PHI, the Security Rule also requires applicable protections to flow down through the subcontracting chain. HHS Business Associates guidance.

Require the vendor to maintain written HIPAA terms with each relevant subcontractor, restrict access to authorized personnel, and notify the client of material changes to its service providers. The agreement should make the vendor responsible for coordinating incident reports, preserving records, and securing PHI throughout the downstream chain.

HHS specifically explains that when a lawyer-business associate hires document managers, investigators, or litigation support personnel to help provide legal services to a covered entity, the lawyer must ensure those helpers agree to the same privacy restrictions and conditions for the PHI they receive. HHS guidance on subcontractors assisting lawyers.

Address individual rights and regulatory access to records

Set out how the vendor will help the covered entity respond to requests involving PHI in the vendor’s possession. This may include making PHI available for access, supporting amendments to information in a designated record set, and supplying details needed for an accounting of disclosures. The BAA should define response contacts, deadlines, and secure transfer procedures.

The covered entity remains responsible for fulfilling individual-rights obligations, but it must contract for the business associate’s assistance where required. In particular, PHI in a business associate’s designated record set may need to be made available for access or amendment, and the business associate must provide information needed for an accounting when applicable. An e-discovery workspace is not automatically a designated record set; assess the records and the vendor’s role. HHS guidance on business associates and individual rights.

The agreement must also provide for access to the business associate’s internal practices, books, and records relating to PHI when the Secretary of Health and Human Services needs them to determine HIPAA compliance. Make sure ordinary contract confidentiality language does not obstruct that regulatory access. HHS sample BAA provisions.

Specify breach termination and PHI disposition

State what happens if either party identifies a material breach of the BAA. HIPAA requires reasonable steps to cure a known pattern of material breach or violation and, if those steps do not succeed, termination where feasible. The agreement must authorize the covered entity to terminate for a material breach. HHS Business Associates guidance.

At the end of the services, the BAA must require the vendor, if feasible, to return or destroy the PHI it still maintains and keep no copies. If return or destruction is infeasible, the vendor must continue protecting the PHI and limit further uses and disclosures to the purposes that make return or destruction infeasible. HHS sample BAA provisions.

For litigation work, specify how the parties will handle preservation duties, legal holds, active discovery, backups, and any required retention. A legal hold or other legal requirement may affect the feasibility of PHI return or destruction; document the reason, restrict retained PHI, and set a review or disposition process rather than treating retention as permission for continued general use.

Apply the checklist to litigation data flows

Before transferring data, map the complete path from collection through final disposition. Identify each party that creates, receives, maintains, or transmits PHI and record the purpose, access, and contractual role at each step.

• Confirm the relationship: Identify the covered entity, any business associate, the vendor’s client, and whether the vendor handles PHI on their behalf.
• Trace the data: List collection tools, transfer methods, hosting environments, review platforms, exports, and downstream providers.
• Limit and authorize use: Tie each use and disclosure to the matter, permitted instructions, and applicable minimum-necessary practices.
• Check safeguards and response: Confirm access controls, incident contacts, reporting procedures, and cooperation expectations.
• Close the matter deliberately: Document return or destruction, any legal hold or infeasibility, retained copies, and continued protections.

A practical BAA checklist connects each data flow to a permitted purpose, a responsible party, a safeguard, and an exit plan. Confirming those elements—along with subcontractor flow-down obligations and support for individual rights—helps make the agreement useful throughout the litigation lifecycle.

FAQs

Does an e-discovery vendor handling PHI need a BAA?

Often, yes, if the vendor creates, receives, maintains, or transmits PHI on behalf of a covered entity or another business associate as part of its services. The answer depends on the parties’ relationship and the vendor’s access and role; a vendor’s involvement in litigation alone does not establish that it is a business associate. HHS Business Associates guidance.

What PHI uses and disclosures should a BAA permit?

It should authorize only the uses and disclosures needed for the described services, such as case-related collection, processing, hosting, review, redaction, and authorized production. It should also specify any permitted disclosures required by law or expressly allowed for proper management and administration, while barring unrelated uses and disclosures. HHS sample BAA provisions.

Must e-discovery subcontractors sign written HIPAA terms?

When a subcontractor will handle PHI on behalf of a business associate, the business associate must obtain written assurances that the subcontractor will follow the required restrictions and safeguards before the PHI is disclosed. The agreement should cover each downstream provider that handles PHI for the service. HHS Business Associates guidance.

What should happen to PHI when the BAA ends?

If feasible, the vendor should return or destroy the PHI it maintains and retain no copies. If that is infeasible, the BAA’s protections continue to apply and further use or disclosure must be limited to the purposes that make return or destruction infeasible. Address legal holds and other retention requirements explicitly. HHS sample BAA provisions.